Cybersecurity & Privacy : Law360 : Legal News & Analysis

By, admscgu1i

• 4 Views
• 9 Min Read
• (0) Comment

The article discusses a range of mitigation measures, including contacting unintended recipients of personal data, securing the deletion or recovery of exposed information, isolating compromised systems, and maintaining clear records of actions taken. It focuses on the actions that should be taken during the early stages of an incident to contain the breach, protect affected individuals, and meet regulatory requirements. Includes the key steps, timeframes, and documentation requirements to keep your organisation compliant. A practical guide to data breach reporting under UK GDPR, covering when you must notify the ICO, how to report a breach (and what to do if you don’t need to), and when affected individuals need to be told. Discover why training your entire workforce to instantly spot and escalate these requests is essential to avoid serious regulatory compliance breaches.

On June 2, 2025, the New Jersey Division of Consumer Affairs (the “Division”), alongside the Office of the Attorney General, announced proposed rules (the “Proposed Rules”) to implement the New Jersey Data Privacy Act (NJDPA). Given the continued focus on consumer health data, companies should evaluate any data collection and consent processes related to their business. This lawsuit represents a significant test case for Washington’s MHMDA, which has been in effect since March 2024. In June, the New York state legislature passed the Health Information Privacy Act (NY HIPA), which proposed strict limits on processing “regulated health information,” defined to include any data reasonably linkable to an individual and related to physical or mental health. On December 19, 2025, the New York Governor signed the Responsible https://dominicandesign.net/license-plate-search-services-key-aspects-and-recommendations.html AI Safety and Education Act (RAISE Act) into law, amending the version that was originally passed by the state legislature in June. On June 22, 2025, the Texas Governor signed the Texas Responsible Artificial Intelligence Governance Act (TRAIGA) into law, making Texas the second state to pass comprehensiveAI regulation (with Colorado being the first).

• New rules on what companies can do with personal information include tighter consent requirements, a ‘right to be forgotten’, and a simple test for what’s OK.
• They’ve opened “at least one criminal probe” following complaints about the glasses being used to film women on the street in public without their consent, Reuters reports.
• With the launch of Meta’s new AI agent that it says can handle your life for you, the social network exec posted this video highlighting how secure, private, and trustworthy Muse is, and that it will get even more secure in the future.
• States did fill most of the enforcement gap left at the federal level, with California and Texas leading as the prominent regulators in the privacy and cybersecurity landscape.
• We use vendors that may also process your information to help provide our services.
• A US-based education tech provider announced a cybersecurity incident affecting its Canvas platform – used by institutions around the world, including Australia.

While most organisations recognise internal policies such as a Data Protection, Data Breach, Retention, or Subject Access Request Policy, as vital components of the data protection compliance framework, simply having them written is only part of the equation. Satellites now serve civilians and militaries alike, are run by private companies, and are governed by almost no one. InternetLab's report reveals the shocking lack of transparency in the spread of facial recognition systems throughout Brazilian schools. A look into how migrants are being tracked through an expanding global surveillance ecosystem and what this means for privacy, fundamental rights, and access to protection. Companies affected by these developments—likely most companies of any meaningful size in the United States—will need to understand their current compliance obligations as well as anticipate the potential legislative and regulatory changes ahead in 2026.

What Recent FTC Enforcement Actions Reveal About COPPA Risks

• "As we have said many times before, we have never built a backdoor or master key to any of our products or services and we never will," the company added.
• Policy vs practice Having policies in place and having effective data protection compliance processes are two very different things, and having policies is not indicative that you are meeting your obligations.
• The tech giant has not told BBC News what the complaint relates to but the Financial Times, external has reported it is another challenge to a Home Office demand for so-called "backdoor" access to highly encrypted Apple user data.
• It includes powers allowing the government to issue secret notices – called technical capability notices – which can secretly force companies to provide UK security services with ways to access customer data.
• Apple has meanwhile referred reporters to a statement given last year, after its initial challenge to the UK government's request.
• The government had fought unsuccessfully to keep legal challenges to its first notice to Apple secret.

Colorado, California, and Montana have passed neural data privacy laws meant to prevent the exploitation of brain information collected by consumer products. Eileen Guo, investigative tech reporter for MIT Technology Review, joins to discuss. Prince Harry has lost his lawsuit against the publisher of the Daily Mail newspaper, but his other legal battles against Britain's tabloids were more successful. The report alleges that surveillance labels included "LGBTQIA," "DO NOT HOST," and evaluated individuals on a "risk" level. A major database breach at James Dolan's Madison Square Garden arena revealed an apparent internal list tracking nearly 40,000 celebrities, according to a new report from WIRED. Flock CEO Garrett Langley apologized in an interview with CBS News amid claims the surveillance company's license plate readers have been misused by some police officers.

• PI’s submission on the Use of Technology in the Operations and Activities of Mercenaries, Mercenary-Related Actors and Private Military and Security Companies
• The California Privacy Protection Agency Board enthusiastically supported preliminary staff recommendations in proceedings on privacy policies and reducing friction when exercising consumer rights under the California Consumer Privacy Act (CCPA).
• Additionally, on September 23, 2025, California finalized its regulations on cybersecurity audits, risk assessments, and automated decisionmaking technology (ADMT).
• On December 1, 2025, the FTC announced a settlement with Illuminate Education Inc. (Illuminate) following the education technology provider’s security incident.
• Furthermore, compliance obligations under the Rule are significant, as the diligence, auditing, recordkeeping, and reporting requirements for restricted transactions may require that entities either build out or establish comprehensive compliance programs to comply with the Rule.
• The RAISE Act creates requirements for the training and use of AI frontier models, including creating a safety plan.

MeitY unveils DEPA handbook to enable trusted data sharing for AI training

“I read their consent and they said they were going to record and use our appointment for training,” she said. Shira Fischer, a physician who works in health policy in Boston, sought a speech pathologist for her child in 2022, when virtual appointments became the norm because of Covid-19. Identify where state-specific requirements sit in templates, workflows, vendor contracts, and training materials, so a pivot is a rewrite of pieces, not the whole document. Adjusted for state population, it’s broader than every state trigger except Texas and Nebraska. If the SECURE Data Act’s “relates to” language holds, companies can consolidate the patchwork of policies, contracts, and workflows they have built across more than 20 states into one framework. Programs heavily indexed to obligations specific to California, Colorado, or Texas will need a hard second look; the controls and contracts baked into them reflect choices a national standard may render redundant or wrong.

STAT Plus: The ‘HIPAA-compliant’ myth and other health privacy fallacies

While no federal privacy legislation or state comprehensive privacy laws emerged, highlights from the past year included critical federal regulations and significant state enforcement actions. At the federal level, the FTC relied on Section 5 of the FTC Act to frame security failures as unfair or deceptive practices, while signaling a shift toward more targeted enforcement focused on deception, fraud, and data security. For now, companies should monitor developments and reassess their use of tracking technologies to reduce litigation risk. There have been significant circuit splits on the VPPA and whether pixel tracking litigation falls under it. Plaintiffs relied on state privacy statutes such as the California Invasion of Privacy Act (CIPA), wiretapping laws, and even the Video Privacy Protection Act (VPPA), a federal statute originally intended to protect video rental histories. Litigation over website tracking technologies continued into 2025 as plaintiffs challenged these practices under various legal theories.

US airlines may face fresh scrutiny as Democrats plan probes into pricing and passenger rights

Ruth Ehrlich, director of external relations at Liberty, said the case was "hugely important" and has "far-reaching implications for the public's privacy rights well into the future". The government's requests for Apple to permit it access to data held under this system were issued under the Investigatory Powers Act (IPA). Advanced Data Protection is an opt-in feature that allows users to turn on a higher level of protection for data stored in iCloud, such as back-ups, Drive storage, photos and voice memos. The government said it would not comment on legal proceedings or what it called "operational matters". The row, which centres on the government's desire to be able to see material protected by an advanced data protection system – which currently even Apple itself cannot access – has been rumbling on since early 2025.

Data Privacy Rules Built for Human Behavior Have an AI Agent Problem

Part of the concern comes from reports of officers misusing the cameras to stalk civilians, including https://ulstergrandprix.net/category/news/page/18/ ex-wives and girlfriends. One woman is speaking out after she was secretly filmed, saying that technology like Meta's AI-powered smart glasses threatens personal privacy. Meta has unveiled new artificial intelligence models it says can compete with the industry's leading systems. A jury found that the social media company had deceived consumers for years about its data privacy policies. Meta's AI agent integration shows how fast the consumer technology is evolving. "End-to-end encryption is an essential security tool that protects our personal data, including our bank details, health information, private conversations and images," she said.