❌

Normal view

California to receive $6m settlement after 23andMe data breach

19 October 2026 at 22:34

Millions of customers’ genetic and personal information exposed in 2023, including more than 855,000 Californians

California’s attorney general, Rob Bonta, on Monday announced the state will receive a $6m settlement payment in 23andMe’s bankruptcy, resolving California’s legal claims related to a 2023 data breach that exposed 6.9 million customers’ ⁠genetic and other ⁠personal information.

California had ​unsuccessfully tried to block the $305m sale of 23andMe assets to TTAM Research Institute, a non-profit controlled by the 23andMe ⁠co-founder Anne Wojcicki. The state had argued that the bankruptcy sale violated California’s Genetic Information Privacy Act, and it had said ⁠consumers did not give express consent to the sale.

Continue reading...

© Photograph: JHVEPhoto/Alamy

© Photograph: JHVEPhoto/Alamy

© Photograph: JHVEPhoto/Alamy

Calls to strengthen workplace privacy in Australia as employers turn to AI to track staff

Monitoring tools common in a range of workplaces, including factories, office jobs, delivery work and in retail – often without employees being informed

Employers are increasingly using technology, from CCTV to keystroke monitoring, to track workers’ moves and it is being accelerated by the use of AI, the Human Technology Institute has warned.

Examples provided to Guardian Australia by the institute include a fast-food restaurant using surveillance cameras to stop workers using their phones, and AI tracking leading to a cashier warned over making a mistake once every 533 scans.

Continue reading...

© Photograph: Bloomberg/Getty Images

© Photograph: Bloomberg/Getty Images

© Photograph: Bloomberg/Getty Images

‘I felt disgusted’: MEP speaks out over nude deepfakes and urges EU action

Lena Schilling of Austrian Greens says images are ‘digital violence against women’ and a threat to democracy

An Austrian MEP has spoken out about her experience of being “stripped naked” online without her consent and has urged the EU to take action, as a report found that one in six female MEPs had been targeted by sexualised AI-generated content.

Lena Schilling of the Green party said she had learned last month about nude deepfakes of herself circulating online. When she opened the links, she found herself staring at images from one of her first ever press conferences – but the images had been digitally altered to remove her clothing.

Continue reading...

© Photograph: APA-Images/Alamy

© Photograph: APA-Images/Alamy

© Photograph: APA-Images/Alamy

‘I felt disgusted’: MEP speaks out over nude deepfakes and urges EU action

Lena Schilling of Austrian Greens says images are ‘digital violence against women’ and a threat to democracy

An Austrian MEP has spoken out about her experience of being “stripped naked” online without her consent and has urged the EU to take action, as a report found that one in six female MEPs had been targeted by sexualised AI-generated content.

Lena Schilling of the Green party said she had learned last month about nude deepfakes of herself circulating online. When she opened the links, she found herself staring at images from one of her first ever press conferences – but the images had been digitally altered to remove her clothing.

Continue reading...

© Photograph: APA-Images/Alamy

© Photograph: APA-Images/Alamy

© Photograph: APA-Images/Alamy

Il Garante multa chi spia le mail dei dipendenti. L’Authority ci aveva provato con i suoi

16 October 2026 at 17:33

Due chiavette Usb criptate, in una busta antieffrazione, in un armadio chiuso a chiave. Dentro c’è la posta di tre ex dipendenti di Michael Page, colosso della selezione del personale, usciti nel 2021 e passati a un concorrente. L’azienda ha tenuto in vita le loro caselle fino al 25 settembre 2023, per due di loro oltre due anni e mezzo. Dice di averle setacciate per parole chiave, ma il Garante non se la beve e annota che non ne ha dato prova. Ha girato ai vecchi capi le mail che continuavano ad arrivare, poi ha mandato dentro un consulente informatico forense. Niente risposta automatica, e il motivo l’azienda l’ha messo nero su bianco: altrimenti gli ex “si sarebbero accorti dell’inattività delle proprie caselle di posta elettronica e sarebbero riusciti ad occultare i propri comportamenti”. Per il Garante della privacy non si fa. Con il provvedimento n. 583 del 6 agosto 2026, pubblicato a inizio ottobre, ha inflitto a Michael Page International Italia una sanzione di 225 mila euro.

Il cuore della decisione sta in poche parole: la società ha conservato la posta e ci è entrata “a ritroso”, “a prescindere dal formarsi di qualunque sospetto”. I controlli difensivi ammessi dalla Cassazione valgono solo per i dati raccolti dopo che il sospetto è nato. Bocciate anche la conservazione delle mail per dieci anni e la regola che imponeva ai dipendenti di consegnare, su richiesta, la password al superiore. La posta, scrive l’Autorità, è corrispondenza “assistita da garanzie di segretezza tutelate anche costituzionalmente”. Chi può aprirla al posto del lavoratore “non può essere il superiore gerarchico né, più in generale, il datore di lavoro”. Michael Page aveva chiesto che il provvedimento non fosse pubblicato, perché i concorrenti avrebbero potuto usarlo per screditarla. Richiesta respinta. Davanti all’Autorità la società si era difesa parlando di indagini difensive contro la concorrenza sleale dell’ex personale; contro la multa può ricorrere al tribunale. Non è un caso isolato, è una linea.

Il 18 dicembre 2025, con il provvedimento n. 754, il Garante ha multato per 40 mila euro la LTL spa, lenti oftalmiche a San Vito al Tagliamento. Aveva tenuto aperta per circa due mesi la casella del suo ex amministratore delegato, mandato via il 2 agosto 2023. Lui ci inoltra per errore, dall’account della compagna, la bozza dell’impugnazione del licenziamento. Alle 18.23 di quel 21 settembre arriva la “risposta” dell’avvocato dell’azienda a una lettera che nessuno gli aveva spedito. Il 18 giugno 2026 è toccato a Piaggio: 460 mila euro per le mail di due ex dipendenti, conservate per tutto il rapporto più altri cinque anni e acquisite, scrive il Garante, prima “dell’insorgere del sospetto”. Quel provvedimento però oggi sul sito dell’Autorità non c’è più. È stato rimosso in ottemperanza a un’ordinanza cautelare del Tribunale di Pisa del 22 settembre, e l’opposizione è pendente. Il messaggio alle aziende, insomma, è chiaro. Il problema sono i tempi.

I tre ex di Michael Page hanno presentato reclamo il 15 settembre 2022 e la decisione è arrivata quasi quattro anni dopo. L’articolo 143 del Codice privacy chiede di decidere entro nove mesi, dodici se servono approfondimenti. Per la LTL il reclamo era del 30 ottobre 2023: oltre due anni. Il Fatto ne aveva raccontato lo stallo a metà novembre 2025, e la sanzione è arrivata un mese dopo. La Cassazione, con la sentenza 22791 di quest’anno, ha stabilito che il ritardo non fa decadere il potere di sanzionare. Chi aspetta giustizia per la posta violata, però, aspetta lo stesso.

Gli uffici, del resto, lavorano sotto un Collegio ridotto a tre da gennaio, quando si è dimesso Guido Scorza per effetto delle inchieste di Report e del Fatto. Pasquale Stanzione, Ginevra Cerrina Feroni e Agostino Ghiglia sono rimasti al loro posto nonostante l’inchiesta della Procura di Roma che dovrebbe essere prossima a chiusura. Ed è qui che la frase sulle ricerche “a ritroso” fa un certo effetto. Il 4 novembre 2025, due giorni dopo una puntata di Report sull’Autorità, l’allora segretario generale Angelo Fanizza chiese al direttore dei sistemi informativi di estrarre “urgentemente” mail, accessi Vpn e cartelle condivise dei dipendenti del Garante, per trovare chi passava notizie al Fatto e a Report. Il direttore dei sistemi IT contestò la richiesta. Quando la vicenda divenne pubblica Fanizza si dimise, e il Collegio si dichiarò estraneo. Michael Page almeno frugava nella posta di tre persone. Al Garante si voleva frugare in quella di tutti.

L'articolo Il Garante multa chi spia le mail dei dipendenti. L’Authority ci aveva provato con i suoi proviene da Il Fatto Quotidiano.

Other Courts Should Heed a Federal Judge's Warning About Flock-Enabled Mass Surveillance

14 October 2026 at 05:01
robed arms flank ALPR cameras and a judge's gavel | Paul Weaver/Zuma Press/Newscom/Flas100/Oleg Dudko/Doreen Salcher/Dreamstime/Midjourney/Fatima Ruiz

Back in 1983, the Supreme Court declared that "a person traveling in an automobile on public thoroughfares has no reasonable expectation of privacy in his movements from one place to another." That increasingly doubtful proposition underpins a nationwide network of more than 144,000 AI-assisted cameras that track the travels of innocent motorists across the country billions of times each week.

So far, state and federal courts have almost uniformly rejected constitutional challenges to automated license plate readers (ALPRs) installed by companies such as Flock Safety. But in a decision that could signal a shift in the legal treatment of Flock cameras, a federal judge in Oklahoma recently recognized that they enable "a type of indiscriminate mass surveillance."

ALPRs are much more sophisticated than the technology that the Supreme Court considered in 1983, when it approved the warrantless use of a radio transmitter that helped police tail a suspected methamphetamine manufacturer's car. Three decades later, by contrast, the Court said police should have obtained a search warrant before attaching a GPS tracker to another drug suspect's car.

The majority opinion in the latter case emphasized the physical intrusion necessary to install the tracker. But five justices embraced an alternative rationale, saying GPS tracking impinges on reasonable expectations of privacy by revealing potentially sensitive information about the target's historical whereabouts.

That theory came to the fore in a 2018 case involving mobile-phone location data collected by cell sites, which the majority said implicated the Fourth Amendment because "individuals have a reasonable expectation of privacy in the whole of their physical movements." The Supreme Court reiterated that principle this year, extending it to data collected by Google's Location History feature.

"An individual has a reasonable expectation of privacy in records about his cell phone's location," Justice Elena Kagan said in the majority opinion, "and police intrude on that constitutionally protected interest when they demand the information." By similar logic, U.S. District Judge Sara E. Hill concluded this month in the Oklahoma case, people have a reasonable expectation of privacy in ALPR records, and police therefore generally need a warrant to search them.

Those databases include "information about all vehicles that pass by any network-connected camera at all times," which police can peruse "on demand," Hill noted. "Freedom from persistent, dragnet-style surveillance while in public is not a foreign concept in our society, and it is a reasonable expectation that society already accepts," as reflected in the Supreme Court's cellphone decisions.

Like cars, cellphones "move in public places where people can see you in plain view," Hill wrote. "But it becomes constitutionally problematic when law enforcement can indiscriminately and passively catalog your whereabouts over an extended period of time and then use that information for any purpose whenever convenient."

At this point, Hill's decision is an outlier. "It appears that nearly every court examining the issue to date has determined that ALPR technology use is not a search under the Fourth Amendment because people have no reasonable expectation of privacy in their movements on public streets," she noted.

Last month, for instance, a federal judge in California held that ALPR database searches are "clearly distinguishable from and less extensive than the 'near perfect surveillance' achievable" with cell-site or Location History data. And the day after Hill's ruling, a state judge in California rejected a challenge to San Jose's Flock camera network, saying "there is no reasonable expectation of privacy in license plate data collected from cameras directed solely at public streets."

A federal lawsuit involving the same city's ALPR system, which the Institute for Justice filed last April, is still pending. So are challenges to Flock cameras in cities such as Wichita, Kansas, and Norfolk, Virginia.

Even when they reject such lawsuits, courts commonly acknowledge that the legal picture could change as the number and capabilities of ALPRs multiply. If so, it seems likely that Hill will eventually be joined by other judges who recognize the perils of "indiscriminate mass surveillance."

© Copyright 2026 by Creators Syndicate Inc.

The post Other Courts Should Heed a Federal Judge's Warning About Flock-Enabled Mass Surveillance appeared first on Reason Magazine.

Ghana swiftly rejects US health deal, calls it ‘humiliating’

1 October 2026 at 21:30

Ghana has rejected a proposed health compact with the United States that would have provided an estimated $109 million in US health funding over five years, with President John Dramani Mahama saying the agreement raised serious concerns over health data, financing obligations, and Ghana’s regulatory authority.

The decision places Ghana among a few African countries that have pushed back against new US health agreements introduced as Washington restructures its foreign assistance following the dismantling of USAID. Zimbabwe has also rejected a similar agreement, while Zambia has raised concerns over provisions in its negotiations with the United States.

Ghana raises concerns over health data

Speaking at the Council on Foreign Relations in New York on September 25, Mahama said the proposed compact was presented to Ghana as a replacement for health funding previously provided through USAID.

He said Ghana’s Ministry of Health reviewed the document before preparing a Cabinet Information Paper.

“Ghana is a sovereign nation, and we have our own processes. We are a democratic country,” Mahama said.

According to the President, the Cabinet identified several provisions that raised concerns, particularly those relating to Ghana’s health information.

“One, it says that we shall give the United States our pathogen profile,” he said, adding that the agreement also required Ghana to provide medical records.

“It also says we should give our medical records. I mean, who takes another country’s medical records? And so that was strange.”

Concerns over health-data sharing have been central to resistance to the new US health agreements in several African countries. 

No FDA inspection

Mahama also raised concerns about the treatment of medicines and other medical products supplied under the proposed arrangement.

He said Ghana would have been required to contribute funding to the program while, according to his account of the compact, the country’s Food and Drugs Authority would not have been able to inspect medicines or other medical products entering Ghana under the program.

“And then it also says that any medications or any medical products that shall be brought into our country, our Food and Drugs Administration has absolutely no right to inspect,” Mahama said.

“I mean, it was humiliating.”

Ghanaian officials had previously cited concerns about the proposed handling of sensitive health information as a reason for rejecting the agreement. Reporting on the negotiations also indicated that the proposed arrangement would have required additional investment from Ghana alongside the US contribution.

Cabinet rejected the agreement

Mahama said the proposal was rejected after the Health Ministry presented its assessment to the Cabinet.

He described the decision as unusually swift.

“It was the compact that was thrown out in record time in our Cabinet. I’ve never seen anything thrown out as fast as that.”

He said the government subsequently instructed the Health Minister to communicate Ghana’s position to the US ambassador.

“And so, of course, we rejected it. And we asked the health minister to inform the US ambassador that we didn’t need it. We’ll manage ourselves.”

The proposed agreement would have provided Ghana with about $109 million in US health assistance over five years. The negotiations had begun in late 2025.

A wider concern over health sovereignty

Ghana’s decision comes as the United States seeks to shift its approach to global health cooperation. The new US strategy places greater emphasis on recipient countries taking responsibility for financing and delivering health programs, while Washington reduces its traditional aid commitments.

Kenya became the first African country to sign the agreement which was challenged in court, followed by similar arrangements with Rwanda, Liberia, Uganda, Lesotho and Eswatini, among other countries. Ravi Ram from the People’s Health Movement (PHM) East and South Africa, told BreakThrough News in December 2025, that  “Bilateral agreements between the US and Kenya and other African countries are meant to limit the ability of any one ‘partner’ country to challenge the terms of implementing the agreement, due to the unequal power relations.”

The concerns among health activists and concerned Africans is the ability of African states to determine their own health priorities, regulate medicines, control sensitive health information, and collectively negotiate the terms of international health cooperation.

EU states urged to ‘go beyond’ AI Act to protect people from abusive surveillance

30 September 2026 at 05:00

As AI-powered biometric identification is adopted by police, national authorities should go beyond legal requirements to build trust within the public, a watchdog report has advised.

“To build public trust, law enforcement should publish the results of their fundamental rights impact assessments, going beyond what the AI Act requires,” said the Fundamental Rights Agency (FRA), an EU branch which keeps tabs on citizens’ freedoms, in Vienna on Wednesday (30 September).

After collecting data from seven EU countries (France, Germany, Greece, Hungary, Italy, the Netherlands, and Ireland), the watchdog warned that several member states have yet to put necessary frameworks in place as they adopt automated systems to identify people.

Remote biometric identification is increasingly used to compare people’s profiles against databases or watch lists, but as the technology develops it could be rolled out for real-time use in public areas. 

“With clear safeguards and independent oversight, remote biometric technologies can support policing without undermining the very freedoms it is meant to safeguard. Ultimately, it is about trust,” said FRA chief Sirpa Rautio.

Call for disclosure mechanisms 

Effective implementation of the EU AI Act requires clear national laws and consistent safeguards to ensure that AI-powered technologies are not used to identify people taking part in peaceful demonstrations or public gatherings, the FRA says.

The body warns that automated identification of live data may affect people’s private lives and interfere with their right to protection of personal data.

In its survey, 37 percent of people said they fear their data could be used for unauthorised purposes. 

And 29 percent of people surveyed by FRA said they would be less willing to take part in peaceful demonstrations or protests if facial recognition was used.

The FRA is worried that surveillance tech powered by AI could be used in exactly those scenarios.

In principle, the EU’s AI Act adopted in 2024 bans real-time remote biometric identification systems in public spaces. But exemptions exist for law enforcement authorities using the technology for finding victims or missing persons, to prevent threats to life or physical safety, stop a terror attack, or to find criminal suspects.

This article continues, but the full version is available only to EUobserver.com subscribers. Visit account.euobserver.com/membership

❌