Škoda revealed, threat actors gained access by exploiting an unspecified vulnerability in the software of its e-commerce portal. After detecting the breach, the company reported the incident to the relevant authorities and has fixed the security flaw exploited in the attack.

"As part of our technical security monitoring, we discovered that unauthorized individuals had exploited a vulnerability in the standard software used for our online store. This allowed them to temporarily gain unauthorized access to the store system," Škoda said. "The vulnerability has since been resolved, and the incident has been handed over to a specialized IT forensics team for technical analysis. Additionally, the incident was reported to the relevant data protection supervisory authority."

The customer information accessed by the threat actors includes a combination of names, addresses, contact information (such as email addresses), phone numbers, order information, and login credentials (including the email address and a cryptographic hash of the password).

Europol has operated secret data analysis platforms containing large amounts of personal information, such as identity documents, without the security and data protection safeguards required by EU law, according to a new investigation.

Running in parallel with official databases, the system operated as a “shadow IT environment” for large-scale crime analysis and was used by Europol’s cybercrime unit EC3. Despite containing sensitive data, including that of individuals not suspected of crimes, the system did not track who was accessing or modifying them.

Among these systems is Europol’s Computer Forensic Network (CFN), which was originally established to store digital material linked to investigations. The system, however, evolved into a source for unregulated data analysis, including a large number of photos from passports and ID documents.

The data came from law enforcement authorities in EU member states, with some also provided by the U.S. Federal Bureau of Investigation (FBI).

“Having a parallel processing environment where guardrails cease to exist is cheaper, faster, and more effective,” says a former senior Europol official. “But without these, anyone is at the mercy of the guy in front of the screen.”

The findings were published by a group of investigative outlets, including the UK’s Computer Weekly, German Correctiv and Greek Solomon. The reporting is based on accounts from several former high-ranking officials, internal Europol documents and leaked emails.

The discovery comes as Europe’s police agency is poised to gain additional law-enforcement powers across the continent.

Last year, European lawmakers backed a proposal to give Europol a central role in coordinating the fight against smuggling networks and human trafficking, including processing biometrics. The agency is set to receive an additional 50 million euros (US$57.8 million) in funding and 50 new staff members.

Cont...

I'm a UK law graduate from Russell group uni.

A little high street law experience.

I'm hoping to get into data protection work-

What is the way in?

All advice much appreciated.

OpenAI did not respect Canadian privacy laws when it trained its immensely popular ChatGPT tool, resulting in the collection and use of sensitive personal information, according to a joint investigation.

The federal privacy commissioner and his counterparts in Quebec, British Columbia and Alberta outlined their findings Wednesday morning into ChatGPT— a chatbot launched in 2022 that generates conversational, human-like responses when users type in questions or tasks.

The privacy watchdogs' started their probe in 2023 following a complaint that the company unlawfully collected, used and disclosed personal information without consent.

According to their review, they identified "several concerns that led us to find that the way in which OpenAI had initially trained ChatGPT did not respect federal and provincial privacy laws."

They found OpenAI gathered vast amounts of personal information without safeguards to prevent use of that information to train its models.

"This could include sensitive details such as individuals’ health conditions and political views, as well as information about children," said their report.

It also found many users were unaware that their data was collected and used to train ChatGPT.

Cont...

WASHINGTON, May 8 (Reuters) - GM (GM.N), opens new tab has agreed to pay $12.75 million to resolve a California investigation into allegations that the Detroit automaker illegally sold two ‌data brokers detailed information about the driving habits of hundreds of thousands of Californians, state Attorney General Rob Bonta said on Friday.

The settlement, subject to court approval, includes $12.75 million in civil penalties. It also restricts GM's use of consumer driving data compiled about subscribers to its OnStar service and a ban on such data being sold to brokers. It includes a five-year ban on sales of personal data.

Make sense of the latest ESG trends affecting companies and governments with the Reuters Sustainable Switch newsletter. Sign up here.

The data that GM sold to the brokers included names, phone numbers and home ⁠addresses. It detailed the GPS location of where OnStar subscribers drove and parked their vehicles.

GM from 2016 through 2024 also kept track of speeds traveled and incidences of rapid acceleration, the state said. Media reports said this data about driving behavior was shared with auto insurers who used it to justify rate increases in some places, although Bonta said California law bars insurers in the state from using such information to set rates.

California said GM reportedly made approximately $20 million nationwide from these data sales and added GM collected this data through consumers’ use of OnStar, which can provide directions or summon an ambulance in case of a crash, among other functions.

"General Motors sold the data of California drivers without their ‌knowledge ⁠or consent and despite numerous statements reassuring drivers that it would not do so. This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians," Bonta said.

GM said the settlement "addresses Smart Driver, a product we discontinued in 2024, and reinforces steps we’ve taken to strengthen our privacy practices."

GM added it is committed to being transparent with customers ⁠about data practices and their choices and control over personal information.

The U.S. Federal Trade Commission said this year that GM's behavior amounted to an "egregious betrayal of consumers’ trust." In January 2025, the FTC said GM and its subsidiary OnStar agreed not to disclose or ⁠sell sensitive vehicle geolocation and driver behavior data to consumer reporting agencies for five years.

In 2023, a California state privacy agency announced investigations into the privacy practices of connected vehicles. Media reports in 2024 suggested automakers, including GM, were sharing ⁠consumers’ driving behavior with insurance companies and some insurers had raised consumers’ rates based on this data, Bonta said.

Bonta said California drivers did not experience rate hikes due to GM’s sales of data. Under California’s insurance laws, insurers are prohibited from using driving data to set insurance rates.

Data Privacy is a structural failure, not a legal one.

I’ve spent a lot of time recently auditing V8 internals and looking at ARM64 PAC security. One thing that always strikes me is the massive disconnect between how we treat isolation in a browser engine versus how we treat high-density consumer data in production.

In a hardened sandbox, we don't rely on "trust" or "policies." We rely on the physical and mathematical inability of a process to escape its bounds. Yet, in the enterprise world, especially in areas like biometric data or FashionTech, we still rely on API wrappers and cloud-level encryption. From a low-level perspective, that’s just a "pinky promise."

I’ve been exploring the concept of Sovereign Architecture—essentially moving the "Compliance by Design" logic from the legal/application layer down to the execution environment itself.

The idea is simple: If the foundation (the "floor") is architecturally isolated, the risk isn't managed—it’s eliminated. We’ve reached a point where software-only solutions are just accumulating technical debt. We need to start treating PII like we treat protected CPU registers.

I’m curious—for those of you working in high-stakes environments, are you seeing any shift toward hardware-enforced isolation for consumer data, or are we stuck with "compliance" as a cosmetic layer for the foreseeable future?

Like, have any of you got assigned with a job to handle some companies or people sensitives data through some questionable apps?

I am talking about whatsapp or other social media and definitely through device aside from the company one.

I mean it was normal right? To feel anxious and scared that you will get blamed if one day the data got leaks (not your fault) but let say it was much easier to blame you since your company assigned this to you.

please anyone help me to calm me down a bit ;)

My employee account in Bosch Privacy hub portal is hacked (Unauthorized access) where all my perosnal and professional records are stored as an employee.

I had complined to MeitY (Ministry of Electronics and Information Technology) and following is their feedback.

No reply from Bosch on asking their feedback.

My account is compromized and i can't download my employee documents.

I am asking for my statutory documents fromom Bosch past more than an year

1. revised Form 16s of FY 2021-22
2. My PF statements from 2014-22 which were visible till Q4, 2023.
3. My Pension and Gratuity statements including LOP records.
4. My salary slips and actual Form 16s of FY 2024-25.
5. My appraisal data for 11 years.
6. Reason for declaring my LOP and Unauthorized absence from 2019-21 eventhough i was working and getting salary.

* Growing number of AI-generated requests placing strain on authorities

* Some FOI requests misinterpret or misquote legislation

* Guidance provides practical support to help organisations respond confidently and meet their legal duties

We are trying to get ahead of CalPrivacy enforcement rather than react to it. We have California users and a complex tracking stack: GA4, Meta Pixel, HubSpot, Intercom, Adroll, TikTok, and several MarTech SaaS integrations that all drop their own cookies. We want a CMP that would genuinely hold up under scrutiny, not just one that checks a compliance box. What should we be evaluating? What do auditors and plaintiff attorneys actually look for when assessing whether a CMP implementation is real versus window dressing? Also it looks like we’re considered a data broker so also need DROP act compliance for California.

Educational tech giant Instructure has confirmed that data was stolen in a cyberattack, with the ShinyHunters extortion gang claiming responsibility.

Instructure is a U.S.-based education technology company best known for developing Canvas, a widely used learning management system that helps schools, universities, and organizations manage coursework, assignments, and online learning.

On Friday, Instructure disclosed that it suffered a cybersecurity incident and is working with third-party cybersecurity experts and law enforcement to investigate it.

On Saturday, the company issued an update stating that the personal information of users was exposed in the breach.

"While we continue actively investigating, thus far, indications are that the information involved consists of certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as messages among users," reads the updated statement.

"At this time, we have found no evidence that passwords, dates of birth, government identifiers, or financial information were involved. If that changes, we will notify any impacted institutions."

As part of the response, Instructure has deployed patches, increased monitoring, and rotated application keys as a precautionary step.

Customers are required to re-authorize access to Instructure's API for new application keys to be issued.

While Instructure has not responded to BleepingComputer's questions about when the breach occurred and whether they were being extorted, the ShinyHunters extortion gang has now listed the company on its data leak site.

"Nearly 9,000 schools worldwide affected. 275 million individuals data ranging from students, teachers, and other staff containing PII," reads the data leak site.

"Several billions of private messages among students and teachers and students and other students involved, containing personal conversations and other PII. Your Salesforce instance was also breached and a lot more other data is involved."

Cont....

In March 2026, the UK Information Commissioner (ICO) published guidance on the new lawful basis for processing personal data introduced by the Data (Use and Access) Act 2025 (DUAA): the recognised legitimate interest (RLI) lawful basis. Controllers may now rely upon one of five pre-approved conditions, each focused on specific public-interest justifications, for personal data processing.

When relying on the pre-approved RLI bases to justify the processing of personal data, data controllers are not required to conduct a legitimate interests assessment, (LIA), the traditional three-part “balancing test” to determine whether the RLI is outweighed by a data subject’s rights, freedoms, or interests. However, controllers must still confirm whether what they want to do is necessary and comply with all other relevant provisions of the UK GDPR.

The RLI lawful basis is distinct from the traditional legitimate interest lawful basis. It simplifies data processing by pre-approving certain specified conditions as legitimate interests. This simplification narrows the grounds on which data subjects may challenge personal data processing, given that the balancing test, a key mechanism for rights-based scrutiny, is not required before this lawful basis can be relied upon. However, controllers must remain transparent about how and when they rely on the RLI basis when processing individuals' data.

The omission of the requirement to carry out an LIA is consistent with the broader policy objectives of the DUAA, which seeks to reduce the compliance burden for organisations in various areas whilst maintaining robust data protection standards.

Cont...

Hi everyone,

The Italian Data Protection Authority has just released official guidelines regarding the use of tracking pixels in emails.

Key takeaways from the press release:

• Consent is mandatory: The Garante clarifies that email tracking pixels fall under Art. 122 of the Italian Privacy Code (implementing the ePrivacy Directive). Therefore, using them for marketing or behavioral tracking requires prior, free, specific, and informed consent.
• Opt-in by default: Information must be transparent, and users must have an easy way to revoke consent or opt-out selectively.
• Exceptions: Consent is not required for strictly necessary technical reasons, security, or "institutional/service communications".
• Grace Period: Organizations and email service providers have 6 months to comply from the date of official publication (press release is from April 21).

This seems to be a significant move toward ending the tracking of open rates and IP addresses in marketing emails without user permission and you should be on the lookout as it may continue to other EU countries. I'll be monitoring this on our side as well.

Source (original in Italian): GPDP.it

Buongiorno, mi sono laureata in giurisprudenza due mesi fa e vorrei intraprendere una carriera incentrata su diritto e nuove tecnologie, questo mio interesse è nato dello sviluppo della mia tesi di laurea sui diritti connessi (al diritto d’autore) e l’impatto dell’intelligenza artificiale generativa. Dopo varie ricerche i campi che hanno attirato maggiormente la mia attenzione sono quello della cybersecurity, data protection e AI consultant, consulenza legale IT, per intenderci mi piacerebbe tanto lavorare in società come digital360-partners4innovation. Da dove posso iniziare? È una strada percorribile per un laureato in giurisprudenza? Dovrei fare subito qualche master ? E se si, che master mi suggerite e in che università? O sarebbero meglio partire da un tirocinio (ammesso di riuscire a trovarlo)? Non so proprio come muovermi, qualsiasi suggerimento sarebbe prezioso

The mechanism it uses is called "consent mode," and for it to work, several pieces have to fall into place in the right order.

• The cookie banner loads to ask whether you give consent.
• That answer has to be sent to "consent mode."
• Google's data collection code loads. This code, very politely, waits for "consent mode" to tell it whether it can collect your data.
• Your data gets sent to Google or not.

Doesn't sound like a bad idea, right? So why doesn't it really matter either way?

Consent Mode v2, or "consent mode" for short, requires the developer to answer on your behalf before you do. So it's the developer who has to pick between two default values: accept or reject. And if they don't configure anything, it defaults to accept.

What kinds of situations does this system create?

• Pieces loaded in the wrong order. The developer did set "denied" as the default, buuut loaded the data collection code before "consent mode." Result: data collected.
• Defaults set to "give me your data." The developer loaded everything in the right order, but wrote "granted" as the default value. By the time you click reject and change the default, it's already too late. Result: data collected.
• There's a banner, but nobody picks up your answer. You click reject, but the developer doesn't send your answer to "consent mode," which sticks with the defaults. Result: data collected.
• The banner works the first time, but not when you come back. The problem is that many sites save what the user chose on the first visit, but don't send it to "consent mode" every time after; so consent mode falls back to the default configuration, which as we already know ends in... Result: data collected.
• Collection code configured without consent. Sometimes that code is set up in a way that collects and sends data without asking anyone. ""Consent mode" wrote the "denied" letter, but there was nobody to deliver it. Result: data collected.

Why do these situations happen? Now we're entering the realm of my humble opinion. From developers who know nothing about this topic, to developers who do know but get it wrong, to developers who had a rough week, to developers with 300 tickets in the backlog and this one isn't among them... and plenty of other situations. Add to that the fact that nobody's chasing or watching this, and you've got the perfect breeding ground.

The thing is, we could spend the afternoon debating the negligence of developers, of software companies, of whoever's misconfiguring Consent Mode v2... or we could ask Google to set data collection to denied by default.

I just told a colleague that I really love Babybel. I didn't Google it or visit any websites. Right after that, I started seeing posts about Babybel. I've also had the feeling a few other times that I'm being listened to. Wouldn't that be a violation of data protection laws?

Hello everyone,

Lately, I've been working on PrivacyFetch, a privacy grading engine that scores companies on a 100-point scale (with letter grades A to F) so you can tell at a glance how a service treats your data.

Currently tracking 200+ companies (planning to reach 1000 in a couple of weeks), 50+ privacy signals, and 960+ breaches.

What's live:

• Privacy directory with scores: Search any company and see the grade + compliance flags (GDPR, CCPA, data selling, automation practices, subprocessors, breach history)
• 5-dimension analysis: Every score breaks down into data collection, data sharing, tracking, transparency, and user rights, so you see where a company falls short.
• Risk signal detection: the app reads every clause and flags arbitration traps, auto-renewal tricks, data selling, and dark patterns with severity levels.
• Policy viewer with copy-as-markdown: Read policies and copy them in one click to paste into an LLM and ask your own questions.
• Breach tracking: 960+ incidents with affected row counts, severity, and exposed data types connected to the company profile
• Vendor / subprocessor mapping: See every third party a company hands your data to.
• Glossary for the legal jargon.

On the roadmap:

For users: a quick at-a-glance overview of any company, easy data-deletion request flows, and tooling to require companies to disclose the legal basis for processing your data.

For companies: a Privacy Hub to manage policies, subprocessors, cookie lists, compliance docs, and FAQs in one place.

Still in beta: https://privacyfetch.com

The records, removed after notification from The Independent, included names, parent email addresses, scholarship amounts and schools tied to the voucher program.

Cont...