This is a permanent edition. It carries the briefing exactly as published on this date and does not change.
California Seeks Accountability for 23andMe Data Breach Following Ownership Change
The California Attorney General is pursuing legal action against the new owners of 23andMe regarding a 2023 data breach that exposed sensitive genetic and health information of millions of users. This lawsuit highlights the continuing legal ramifications and accountability challenges associated with data breaches, particularly when company ownership transitions. The action underscores the long term liability for organizations holding vast amounts of personal and health data. It also emphasizes the importance of robust data security practices and transparent breach notification protocols.
A financial technology company operating globally experiences a significant data breach, leading to a ransom demand from the attackers. The company is headquartered in the EU and processes personal data of EU residents. Which of the following is the most immediate and critical regulatory obligation for the company under the GDPR?
Immediately pay the ransom to recover the data and prevent further disclosure.
Notify all affected data subjects within 24 hours of discovering the breach.
Conduct a Data Protection Impact Assessment (DPIA) for the breach.
Notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it.
Microsoft is facing criticism for allegedly threatening a security researcher with a criminal investigation. This incident raises serious concerns about the responsible disclosure process and the potential chilling effect on legitimate security research. It highlights the delicate balance between protecting proprietary information and encouraging vulnerability discovery.
Immigration and Customs Enforcement (ICE) has awarded a significant $25 million contract for biometric scanners, indicating an expansion of its surveillance capabilities. This development raises substantial privacy concerns regarding the collection, storage, and utilization of sensitive biometric data by government agencies. It underscores the growing debate about civil liberties and government oversight in the context of advanced surveillance technologies.
Recent reports indicate that AI language models like ChatGPT are being exploited for prompt injection attacks and to create malicious payloads, turning web pages into phishing lures. These incidents highlight the evolving threat landscape where AI tools are weaponized for cybercriminal activities. This necessitates urgent attention to AI governance frameworks and responsible AI development to mitigate potential misuse.
Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.