All articles tagged with #data protection
The Supreme Court has ruled that privacy protections apply to individuals’ cellphone location history, strengthening digital privacy by limiting how such data can be accessed or used by authorities and third parties.
France’s domestic intelligence agency DGSI is ending its contract with Palantir and selecting French firm ChapsVision to replace it, reflecting Europe’s push to reduce reliance on U.S. tech for sensitive security work. The Palantir contract, renewed in 2025 for 2028, remains in force for now as the handover is prepared, and Germany has similarly chosen ChapsVision for its data analysis.
South Korea fined Coupang 624.6 billion won ($409 million) for a data breach that exposed the personal information of roughly two-thirds of the population, the largest such penalty in the country; authorities said security controls were lax and response was delayed, triggering leadership changes and fueling broader debates over US-Korea tech regulation.
Security researcher Alexander Hanff revealed that Chrome quietly installs a 4GB weights.bin file for Gemini Nano's on-device AI whenever default AI features are enabled, re-downloading it if the user tries to delete it and offering no consent or transparency. The move has sparked privacy and data-regulation concerns (GDPR), potential environmental impact from emissions tied to widespread device usage, and broad backlash, with Mozilla promising a kill switch and Vivaldi calling for user autonomy while Google remains silent.
Microsoft issued an emergency update for ASP.NET Core's DataProtection package (versions 10.0.0–10.0.6) to fix a high-severity flaw (CVE-2026-40372) that allowed unauthenticated attackers on macOS and Linux to forge authentication tokens and gain SYSTEM privileges; upgrade to 10.0.7 immediately, and rotate the DataProtection key ring and audit long-lived artifacts since forged tokens could remain valid after patching.
Microsoft released out-of-band security updates for a critical ASP.NET Core Data Protection vulnerability (CVE-2026-40372) that could let unauthenticated attackers forge authentication cookies and gain SYSTEM privileges. The flaw comes from a regression in the 10.0.0–10.0.6 NuGet packages, which could cause forged payloads to bypass authenticity checks; upgrading to 10.0.7 and redeploying with a rotated DataProtection key ring fixes the issue. This follows April’s Patch Tuesday and includes additional out-of-band Windows Server fixes. No service disruption is reported, but applications using DataProtection should update promptly to prevent token forgery and data exposure.
International aid groups operating in Gaza warn they face a choice between complying with Israel’s new data‑sharing rules or losing access to Gaza and the West Bank; the rules would force registration and broad disclosure of staff and donor information, potentially endangering personnel. NGOs argue the demands conflict with EU GDPR protections, prompting a High Court challenge and urgent EU engagement to suspend the measures. The EU Commission says it’s monitoring the situation and aims to facilitate privacy‑respecting solutions, warning that blocking aid could jeopardize life-saving relief.
Officials in Jersey (Information Commissioner Paul Vane) and Guernsey have joined a broad coalition of jurisdictions warning that AI-generated images and videos can harm real people, urging tighter oversight. They issued guidance on steps individuals can take to protect themselves, such as limiting what you share online, being cautious with AI platforms, and talking to children about AI use. The warning follows a recent incident where a deepfake targeting school staff prompted a police investigation.
Ireland's data protection regulator is leading an EU-wide investigation into Elon Musk's Grok chatbot after reports of sexualized deepfake images, examining how the AI collects and handles data across EU countries.
European data privacy authorities have opened a formal probe into X, Elon Musk’s platform, over sexualised AI-generated imagery and how it is handled under EU privacy rules, potentially leading to enforcement if rules are found to have been violated.
Oxfam refuses to disclose Palestinian staff details to Israel amid a Gaza aid crackdown, arguing that sharing sensitive data would threaten staff safety and breach humanitarian principles; Israel has deregistered dozens of NGOs and demanded extensive staff information, while MSF offered a limited, safeguarded list and PNGO warned the move jeopardizes aid work.
Doctors Without Borders (MSF) says it will provide a defined list of Palestinian and international staff to Israeli authorities under new security requirements, calling it an exceptional measure to safeguard operations. Critics warn the move could endanger aid workers in Gaza and the West Bank. Israel says dozens of NGOs have complied or are weighing the rules, and MSF notes that international staff arrivals into Gaza have been blocked since Jan 1, 2026, highlighting a deteriorating humanitarian situation.
Disney will pay $10 million to settle allegations of violating children's privacy laws by failing to properly label YouTube videos as made for children, leading to targeted advertising and data collection without parental consent. The settlement follows an FTC inquiry and requires Disney to improve compliance with children's data protection laws, specifically under COPPA.
Due to security vulnerabilities and data leaks, LastPass is no longer recommended; instead, five better password managers are suggested, including Bitwarden, 1Password, Dashlane, Proton Pass, and Enpass, each offering various features, security, and affordability to enhance user safety and convenience.
WeTransfer clarified that it does not use uploaded files to train AI models after customer backlash over ambiguous terms, updating its policies to prevent confusion and reassure users about data privacy.