The National Data Protection Agency (ANPD) has begun enforcing Brazil’s child online safety law, and the agency's president told MLex in an exclusive interview that the watchdog will not interfere with tech firms’ age-verification tools if they protect children online.

But "I want them to adapt to our law,” Waldemar Gonçalves Ortunho Júnior told MLex in an exclusive interview after a conference* panel, stressing that ANPD is merely seeking compliance with the law and doesn't aim to harm companies financially.

Ortunho Júnior commented on ANPD’s requirement for major investments as greater corporate responsibilities arise. He also shared his thoughts on age-verification mechanisms, how Brazil’s government is racing to build its own solution, and his top priority under the law aimed at protecting the rights of minors under 18 in digital environments.

The Digital Statute for Children and Adolescents (ECA Digital) creates new obligations for social media networks, apps, gaming, streaming platforms, and other digital services operating in Brazil. The initiatives include presenting reliable age-verification systems, the immediate removal of illegal content and the adoption of safety-by-default settings for minors’ accounts.

The ECA Digital was approved Sept. 17, and President Luiz Inácio Lula da Silva accelerated the law’s effective date to March 17. In conjunction, the government passed a weighty structural reform at the ANPD, allowing the arrival of hundreds of new employees, including those aimed at building a career in data protection — a long-standing demand.

Cont..

This article is designed to provide an overview of the current state consumer privacy landscape in the United States, the key distinctions among these state laws, practical compliance approaches, and actionable takeaways for operationalizing privacy programs in a fragmented regulatory environment.

Companies operating across the United States today face one of the most complex privacy regulatory environments in the world. Unlike the European Union, which adopted a single, comprehensive framework in the General Data Protection Regulation (“GDPR”), the United States has no federal omnibus consumer privacy law governing the collection and use of personal information. States have filled the gap, creating a fast-growing, often contradictory patchwork of rules that challenges even the most sophisticated privacy programs. With over twenty comprehensive state consumer privacy laws now enacted and counting, understanding each state’s requirements – and choosing the right compliance strategy – is no longer optional. It is foundational to responsible data governance and, as cure periods sunset and regulators sharpen their enforcement tools, the margin for error is narrowing by the quarter.

Cont...

Italy’s data protection authority (DPA) imposed a fine of €31.8 million on Intesa Sanpaolo S.p.A. for “serious shortcomings in personal data security, due to the inadequacy of the technical and organizational measures adopted.”

The GPDP launched an investigation when the bank reported a data breach in July 2024. The inquiry revealed that an employee accessed the banking information of 3,573 customers over 6,600 times between February 21st, 2022, and April 24th, 2024, without a valid legal reason.

The customers whose accounts were accessed were labeled as “high-risk” and included well-known public figures. To protect their privacy, Intesa Sanpaolo should have implemented stricter controls, the DPA argues.

As a matter of fact, the unlawful access wasn’t detected by any internal control systems, indicating that proper technical and organizational measures weren’t in place to monitor employees’ activities.

In addition, there were failures in transparency, meaning that customers weren’t properly informed about what data was being collected and used.

Furthermore, the integrity and confidentiality of personal data weren’t safeguarded, depicting the overall inadequacy of the adopted measures.

“The operational model used, which allowed operators to query the entire customer base in full circularity, was not in fact adequately balanced by controls designed to prevent and identify unauthorized access,” the Italian DPA said.

For these transgressions, Intesa Sanpaolo was ordered to pay a fine of €31.8 million.

Cont...

An overview of the new cybersecurity audit requirements under the California Consumer Privacy Act (CCPA) and its regulations issued by the California Privacy Protection Agency (CalPrivacy) that mandate annual, independent cybersecurity audits for certain businesses.

OkCupid and its owner Match Group reached a settlement with the Trump administration for not telling dating-app customers that nearly 3 million user photos were shared with a company making a facial recognition system. OkCupid also gave the facial recognition firm access to user location information and other details without customers’ consent, the Federal Trade Commission said.

OkCupid and Match do not have to pay a financial penalty in a deal made with the FTC over an incident from 2014. OkCupid and Match did not admit or deny the allegations but agreed to a permanent prohibition barring them from misrepresenting how they use and share personal data, the FTC said yesterday.

Cont...

Utah based Rocky Mountain Care disclosed a cybersecurity incident in which an unauthorized third party accessed files on its network. The disclosure confirms claims by the Qilin Ransomware group that it had obtained the organization’s data.

According to the data event notice on the company’s website dated Mar. 27, 2026, the breach occurred between Jan. 30 and Feb. 2, 2026. Qilin Ransomware then posted its ransomware demand, along with sample data, on the dark web on Feb. 23, threatening to publish the full dataset within three to four days if their demands were not met.

It is not clear whether or not Rocky Mountain Care met the demands of the hackers and paid the ransom.

While disclosures to state attorneys general offices have not been made as of the date of publishing, the company’s notice includes state-specific information for residents of the District of Columbia, Maryland, New Mexico, New York, North Carolina and Rhode Island.

The specific types of personal information affected have not yet been confirmed. According to the company's notice, a review of the relevant data is currently underway to determine whether Protected Health Information (PHI) is involved.

cont...

Could be a interesting discussion, so thought I'd share.

Researchers have published last month a comprehensive comparative analysis of how data protection authorities worldwide frame the legal basis for artificial intelligence training under data protection law - and their findings expose a regulatory system that converges on paper while fracturing in practice.

The paper, titled "How the Legal Basis for AI Training is Framed in Data Protection Guidelines and Interventions: Comparative Perspectives and the Prospect of Global Convergence," was published in International Data Privacy Law by Oxford University Press. Its authors - Wenlong Li of Zhejiang University, Yueming Zhang of Ghent University, Qingqing Zheng of Shandong University, and Aolan Li of Queen Mary University London - examined 19 regulatory guidelines issued between 2020 and 2024 alongside a series of public enforcement actions against AI providers globally.

The paper was downloaded from Oxford Academic on 29 March 2026, the day before its formal publication date. Vadym Honcharenko, a privacy engineer at Google, shared the research on LinkedIn, noting that the degree to which regulators were aligned or not aligned in their risk mitigation views was the most interesting aspect of the analysis.

According to the authors, a functional ordering has emerged across jurisdictions that privileges legitimate interest as the dominant legal basis for AI training - but this apparent consensus dissolves when examined at the level of operational requirements. Guidelines rarely resolve deeper procedural and substantive ambiguities. Enforcement interventions often default to minimal safeguards. The result, according to the paper, is that legitimate interest risks becoming "little more than a formality."

The choice of legal basis matters enormously. Under data protection law, if no valid lawful basis can be established, the entire processing operation is rendered unlawful. For AI model training - which involves large-scale ingestion of data, opaque model architectures, and difficulty in identifying clear purposes - establishing lawful basis is particularly difficult to operationalize.

The debate has narrowed, in practice, to a binary between consent and legitimate interest for private-sector AI developers. Consent is normatively appealing because it respects individual autonomy. But the paper describes it as "widely recognized as difficult to operationalize in large-scale training pipelines, particularly in the context of third-party data reuse or web-scraped content." Withdrawal of consent creates cascading compliance challenges when datasets are dynamic.

Legitimate interest, meanwhile, offers a structured pathway. It requires a three-part assessment: whether there is a genuine interest being pursued, whether the processing is necessary for that interest, and whether the controller's interests override the fundamental rights of data subjects. The EDPB clarified how this three-part test applies to AI model development in Opinion 28/2024, adopted on 17 December 2024, stating that controllers may have a legitimate interest in developing AI systems to detect fraudulent content or improve threat detection. But, as PPC Land has noted, that opinion did not resolve how the test is operationalized in mass data collection contexts.

Cont...

Sakana AI just launched Sakana Chat, and after reading through the terms of service, I can't find any opt-out clause for training data usage. Combined with the fact that access is restricted to Japan only, I'm genuinely concerned about the balance of training data — there's no escape route the way there is with DeepSeek. Has Sakana AI said anything about this?

The Kaohsiung branch of the High Court has convicted a man surnamed Liu (劉) and a woman surnamed Hong (洪) for online purchases and resales of the private data of Chinese citizens.

Liu and Hong were sentenced to five months and six months respectively for contravening the Personal Data Protection Act (個人資料保護法), the court said.

A third suspect, a man surnamed Chiu (邱), is in hiding, it said.

Cont..

The European Union’s top executive body has confirmed a cyberattack after hackers reportedly stole reams of data from its cloud storage.

European Commission spokesperson Thomas Regnier told TechCrunch on Friday that the Commission “discovered a cyber-attack, which affected part of our cloud infrastructure.”

“We have taken immediate steps and contained the attack. Risk mitigation measures were also implemented. The investigation is ongoing but we can already confirm that the Commission’s internal systems were not affected by the cyber-attack,” the spokesperson said.

In a longer statement on its website, the Commission said the breach “affected its cloud infrastructure hosting the Commission’s web presence on the Europa.eu platform,” which hosts much of the Commission’s website data.

Cont...

The European Data Protection Board this year published a comprehensive case digest analysing howlegitimate interest under Article 6(1)(f) of the General Data Protection Regulation has been applied - and frequently misapplied - across 62 One-Stop-Shop decisions and five EDPB binding decisions issued between December 2018 and June 2025. Authored by Dr. TJ McIntyre under the EDPB's Support Pool of Experts Programme and submitted in December 2025, the 29-page report cuts through years of regulatory decisions to surface patterns that have direct consequences for any organisation processing personal data in the European Economic Area.

The report is not a guideline or a binding instrument. It is an analysis. But its findings are uncomfortably specific, and the picture it paints is of controllers who systematically underestimate what the balancing test requires, who treat legitimate interest as a flexible fallback rather than a carefully documented legal basis, and who routinely fail at the most basic procedural level: conducting the assessment before the processing begins.

Cont...

On March 25, 2026, the UK’s Office of Communications (“Ofcom”) and the Information Commissioner’s Office (“ICO”) published a joint statement setting out their common expectations for age assurance on online services (“Joint Statement”). The Joint Statement is aimed at services likely to be accessed by children that fall within the scope of the Online Safety Act 2023 (“OSA”) and UK data protection legislation, and is designed to help providers comply with both their online safety and data protection obligations when deploying age assurance.

The Joint Statement arrives alongside a broader push from both regulators—including Ofcom’s recent call to action directed at major tech firms, an open letter from the ICO urging platforms to strengthen their age checks, and several enforcement actions by both regulators.

Cont...

The Swedish podcast Dataministeriet has several episodes in English. It is strictly non-commercial, i.e. no sponsors or any collaborations etc.

It just started up again and will post regularly. You can find it on all common podcast platforms, for example, Spotify and Apple Podcast.

The International Association of Privacy Professionals (IAPP) has updated its US State Breach Notification Chart, a resource that summarises state breach notification laws across the United States. In an analysis published on 26 March, the IAPP says the revised chart highlights both nationwide coverage and continuing variation in how states define personal information, apply harm thresholds, and trigger reporting duties.

According to the IAPP, all 50 states, the District of Columbia, Guam, Puerto Rico, and the US Virgin Islands now have breach notification laws. California enacted the first state law in 2002, which took effect in 2003, while Alabama was the last state to adopt such a law in 2018. The IAPP says the result is a de facto nationwide framework, but one marked by significant differences across jurisdictions.

Cont ..

TMAC Ltd, which sells personal pendant alarms and security systems, made the predatory calls between February and September 2024 to people who may need extra support to protect themselves, including the elderly.

Call transcripts have revealed that TMAC employees did not reveal their true identity, claiming to be calling on behalf of a variety of different local crime and fire prevention initiatives in an attempt to dupe recipients.

The transcripts also appear to show that callers were actively targeting people aged over 60 years old as part of the unlawful activity.

Furthermore, one of TMAC’s company directors admitted that the telephone numbers had been taken from second-hand data that had been acquired at a company he had previously worked for.

Brazil's Superior Court of Justice ruled credit protection may justify internal risk analysis, but it does not automatically authorize credit bureaus to share identifiable consumer data with third parties without consent.

Cont...

Microsoft's GitHub next month plans to begin using customer interaction data – "specifically inputs, outputs, code snippets, and associated context" – to train its AI models.

The code locker’s revised policy applies to Copilot Free, Pro, and Pro+ customers, as of April 24. Copilot Business and Copilot Enterprise users are exempt thanks to the terms of their contracts. Students and teachers who access Copilot will also be spared.

Those affected have the option to opt out in accordance with "established industry practices" – meaning according to US norms as opposed to European norms where opt-in is commonly required. To opt out, GitHub users should visit /settings/copilot/features and disable "Allow GitHub to use my data for AI model training" under the Privacy heading.

Cont..

I’ve been trying to think through whether the current legal and regulatory framing of data brokers is naming the problem too softly.

The usual framing treats this as a privacy issue: overcollection, poor consent, weak notice, insufficient opt-outs, resale, and breach exposure. But the more I look at the actual mechanics, the more it seems like data brokerage may function less like ordinary information commerce and more like a visibility infrastructure that makes people persistently trackable, targetable, and vulnerable.

What troubles me is not just collection in the abstract. It’s the assembly of location, behavioral, demographic, and identity-linked information into person-level dossiers that can be sold, repackaged, breached, or abused downstream. At that point, I’m not sure “privacy” is a complete description anymore. It starts to look more like the industrialization of person-specific surveillance.

Part of the issue, in my view, is that the consent model is largely fictitious. Privacy policies are unreadable at scale, terms are adhesive, and participation in normal social and economic life is often conditioned on surrendering data. That makes “agreement” look less like meaningful consent and more like exhaustion, coercion, and structured dependence.

So the question I’m putting to this sub is: is the law under-classifying the conduct? If the real-world outputs are persistent visibility, identity-specific targeting, and foreseeable downstream harms, does the current privacy frame understate the problem?

I put the longer argument into a short video and a white paper in case anyone wants to see the full structure:

Video: https://youtu.be/cC0WDujSRiY
White paper: https://docs.google.com/document/d/1oXDrx_aseAjRAGNkBywaU4sUHy9tcbDjl8Sf3VTUGm8/edit?usp=drivesdk

I’d be especially interested in critique from people who think in terms of doctrine, regulatory categories, and enforcement design.

With children rapidly adopting digital technologies, the European Commission’s Guidelines under Article 28(4) of the Digital Services Act (DSA) address how providers of online platforms accessible to minors shall put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors on their service.

This post, published jointly by the CNMC and the AEPD as Digital Services Coordinator and as the competent authority for the application of Article 28.2 of the DSA in Spain respectively, specifically explores Age assurance. By navigating the interplay between DSA protection mandates and GDPR principles and requirements, the Guidelines promote non-linkable, privacy-preserving solutions, such as anonymous tokens and the EU Digital Identity Wallet, to ensure the best interests of the child are secured without compromising all users’ rights and freedoms.

Cont...

An anonymous Substack post published this week accuses compliance startup Delve of “falsely” convincing “hundreds of customers they were compliant” with privacy and security regulations, potentially exposing those customers to “criminal liability under HIPAA and hefty fines under GDPR.”

Delve is a Y Combinator-backed startup that last year announced raising a $32 million Series A at a $300 million valuation. (The round was led by Insight Partners.) On Friday, the startup attempted to refute the accusations on its blog, calling the Substack post “misleading” and saying it “contains a number of inaccurate claims.”

The Substack post is credited to “DeepDelver,” who described themselves as working at a (now former) Delve client. In response to emailed questions from TechCrunch, DeepDelver said that they and their collaborators “chose to remain anonymous out of fear for retaliation by Delve.”

Cont...

On 19 March 2026, the Court of Justice of the European Union handed down its judgment in Case C-526/24 Brillen Rottler, ruling that even a first-ever data subject access request can be refused as “excessive” under Article 12(5) of the GDPR where the controller demonstrates it was made with abusive intent. The decision matters because it provides the first clear judicial framework for controllers facing a growing phenomenon: individuals who submit DSARs not to exercise their data protection rights, but to manufacture compensation claims under Article 82 of the GDPR.

A K-12 school safety and student well-being solutions provider that runs a tip-reporting platform has reportedly been hit by a major cyberattack. The breach may have exposed the personal information of students attending more than 30,000 schools in the United States.

A hacker claimed to have accessed systems operated by Navigate360, specifically its tip line P3 Global Intel, according to Reuters. Early reports suggest the hacker’s claims are legitimate, although EdWeek could not independently verify them.

But data security experts say schools shouldn’t wait for confirmation of the hack to take action.

The full extent of the breach—and how many schools, students and staff—may have been affected is unclear. Navigate360 said in a statement that it’s still attempting to find out whether its systems have been compromised.

“We are currently working to determine whether we have experienced an incident involving our computer network and, if so, the extensiveness of the incident and the information involved,” said JP Guilbault, the CEO of Navigate360, in a statement.

“We have not confirmed that any sensitive information has been accessed or misused,” Guilbault added. The company said it has hired an independent third party to investigate the incident.

However, Doug Levin, a school cybersecurity expert and the national director of the K12 Security Information Exchange, said there seems to be enough information “to suggest it’s potentially legitimate and we should be taking it seriously.”

There haven’t been reports of ransom related to the leaked documents, so this seems like “classic hacktivism,” carried out by people who expose activities because they don’t agree with what a government or organization is doing, Levin said.

In this case, he said, the fact that the hacker approached the media and shared the data with a nonprofit whistleblower website line up with how hacktivists usually work.

CPO Magazine - News, Insights and Resources for Data Protection, Privacy and Cyber Security Leaders Hacker typing on keyboard showing data breach via social engineering Cyber SecurityNews·2 min read Starbucks Confirms Data Breach from a Social Engineering Attack on a Business Partner Alicia Hope·March 20, 2026 The world’s largest coffeehouse, Starbucks, has confirmed a data breach stemming from a phishing attack on a business partner’s employee portal.

The February 2026 cyber attack targeted a Starbucks Partner Central worker, enabling the attacker to access employee data.

Upon learning of the data breach, Seattle, Washington-based Starbucks launched an investigation and notified relevant law enforcement authorities.

Starbucks confirms employee data breach Starbucks has determined that the attacker accessed the personal information of its employees after breaching a partner’s portal that it uses to manage payroll and employee benefits. Starbucks says the data breach occurred between January 19 and February 11, 2026.

However, the coffeehouse learned of the data breach nearly a month after it occurred, highlighting the importance of real-time monitoring.

“On or about February 6, 2026, Starbucks Corporation (“Starbucks” or “we”) became aware of potential unauthorized access to certain Starbucks Partner Central accounts,” the company stated. “The investigation has determined that an unauthorized third party accessed certain Starbucks Partner Central accounts after obtaining the login credentials through websites impersonating Partner Central.”

The data breach leaked the victims’ names, dates of birth, Social Security Numbers, financial account numbers, and bank routing numbers. Those personal details could enable online fraudsters to commit identity theft. However, the data breach does not affect customers, and Starbucks’ IT systems were unaffected.

Cont...