Due chiavette Usb criptate, in una busta antieffrazione, in un armadio chiuso a chiave. Dentro c’è la posta di tre ex dipendenti di Michael Page, colosso della selezione del personale, usciti nel 2021 e passati a un concorrente. L’azienda ha tenuto in vita le loro caselle fino al 25 settembre 2023, per due di loro oltre due anni e mezzo. Dice di averle setacciate per parole chiave, ma il Garante non se la beve e annota che non ne ha dato prova. Ha girato ai vecchi capi le mail che continuavano ad arrivare, poi ha mandato dentro un consulente informatico forense. Niente risposta automatica, e il motivo l’azienda l’ha messo nero su bianco: altrimenti gli ex “si sarebbero accorti dell’inattività delle proprie caselle di posta elettronica e sarebbero riusciti ad occultare i propri comportamenti”. Per il Garante della privacy non si fa. Con il provvedimento n. 583 del 6 agosto 2026, pubblicato a inizio ottobre, ha inflitto a Michael Page International Italia una sanzione di 225 mila euro.
Il cuore della decisione sta in poche parole: la società ha conservato la posta e ci è entrata “a ritroso”, “a prescindere dal formarsi di qualunque sospetto”. I controlli difensivi ammessi dalla Cassazione valgono solo per i dati raccolti dopo che il sospetto è nato. Bocciate anche la conservazione delle mail per dieci anni e la regola che imponeva ai dipendenti di consegnare, su richiesta, la password al superiore. La posta, scrive l’Autorità, è corrispondenza “assistita da garanzie di segretezza tutelate anche costituzionalmente”. Chi può aprirla al posto del lavoratore “non può essere il superiore gerarchico né, più in generale, il datore di lavoro”. Michael Page aveva chiesto che il provvedimento non fosse pubblicato, perché i concorrenti avrebbero potuto usarlo per screditarla. Richiesta respinta. Davanti all’Autorità la società si era difesa parlando di indagini difensive contro la concorrenza sleale dell’ex personale; contro la multa può ricorrere al tribunale. Non è un caso isolato, è una linea.
I tre ex di Michael Page hanno presentato reclamo il 15 settembre 2022 e la decisione è arrivata quasi quattro anni dopo. L’articolo 143 del Codice privacy chiede di decidere entro nove mesi, dodici se servono approfondimenti. Per la LTL il reclamo era del 30 ottobre 2023: oltre due anni. Il Fatto ne aveva raccontato lo stallo a metà novembre 2025, e la sanzione è arrivata un mese dopo. La Cassazione, con la sentenza 22791 di quest’anno, ha stabilito che il ritardo non fa decadere il potere di sanzionare. Chi aspetta giustizia per la posta violata, però, aspetta lo stesso.
Gli uffici, del resto, lavorano sotto un Collegio ridotto a tre da gennaio, quando si è dimesso Guido Scorza per effetto delle inchieste di Report e del Fatto. Pasquale Stanzione, Ginevra Cerrina Feroni e Agostino Ghiglia sono rimasti al loro posto nonostante l’inchiesta della Procura di Roma che dovrebbe essere prossima a chiusura. Ed è qui che la frase sulle ricerche “a ritroso” fa un certo effetto. Il 4 novembre 2025, due giorni dopo una puntata di Report sull’Autorità, l’allora segretario generale Angelo Fanizza chiese al direttore dei sistemi informativi di estrarre “urgentemente” mail, accessi Vpn e cartelle condivise dei dipendenti del Garante, per trovare chi passava notizie al Fatto e a Report. Il direttore dei sistemi IT contestò la richiesta. Quando la vicenda divenne pubblica Fanizza si dimise, e il Collegio si dichiarò estraneo. Michael Page almeno frugava nella posta di tre persone. Al Garante si voleva frugare in quella di tutti.
Back in 1983, the Supreme Court declared that "a person traveling in an automobile on public thoroughfares has no reasonable expectation of privacy in his movements from one place to another." That increasingly doubtful proposition underpins a nationwide network of more than 144,000 AI-assisted cameras that track the travels of innocent motorists across the country billions of times each week.
So far, state and federal courts have almost uniformly rejected constitutional challenges to automated license plate readers (ALPRs) installed by companies such as Flock Safety. But in a decision that could signal a shift in the legal treatment of Flock cameras, a federal judge in Oklahoma recently recognized that they enable "a type of indiscriminate mass surveillance."
ALPRs are much more sophisticated than the technology that the Supreme Court considered in 1983, when it approved the warrantless use of a radio transmitter that helped police tail a suspected methamphetamine manufacturer's car. Three decades later, by contrast, the Court said police should have obtained a search warrant before attaching a GPS tracker to another drug suspect's car.
The majority opinion in the latter case emphasized the physical intrusion necessary to install the tracker. But five justices embraced an alternative rationale, saying GPS tracking impinges on reasonable expectations of privacy by revealing potentially sensitive information about the target's historical whereabouts.
That theory came to the fore in a 2018 case involving mobile-phone location data collected by cell sites, which the majority said implicated the Fourth Amendment because "individuals have a reasonable expectation of privacy in the whole of their physical movements." The Supreme Court reiterated that principle this year, extending it to data collected by Google's Location History feature.
"An individual has a reasonable expectation of privacy in records about his cell phone's location," Justice Elena Kagan said in the majority opinion, "and police intrude on that constitutionally protected interest when they demand the information." By similar logic, U.S. District Judge Sara E. Hill concluded this month in the Oklahoma case, people have a reasonable expectation of privacy in ALPR records, and police therefore generally need a warrant to search them.
Those databases include "information about all vehicles that pass by any network-connected camera at all times," which police can peruse "on demand," Hill noted. "Freedom from persistent, dragnet-style surveillance while in public is not a foreign concept in our society, and it is a reasonable expectation that society already accepts," as reflected in the Supreme Court's cellphone decisions.
Like cars, cellphones "move in public places where people can see you in plain view," Hill wrote. "But it becomes constitutionally problematic when law enforcement can indiscriminately and passively catalog your whereabouts over an extended period of time and then use that information for any purpose whenever convenient."
At this point, Hill's decision is an outlier. "It appears that nearly every court examining the issue to date has determined that ALPR technology use is not a search under the Fourth Amendment because people have no reasonable expectation of privacy in their movements on public streets," she noted.
Last month, for instance, a federal judge in California held that ALPR database searches are "clearly distinguishable from and less extensive than the 'near perfect surveillance' achievable" with cell-site or Location History data. And the day after Hill's ruling, a state judge in California rejected a challenge to San Jose's Flock camera network, saying "there is no reasonable expectation of privacy in license plate data collected from cameras directed solely at public streets."
A federal lawsuit involving the same city's ALPR system, which the Institute for Justice filed last April, is still pending. So are challenges to Flock cameras in cities such as Wichita, Kansas, and Norfolk, Virginia.
Even when they reject such lawsuits, courts commonly acknowledge that the legal picture could change as the number and capabilities of ALPRs multiply. If so, it seems likely that Hill will eventually be joined by other judges who recognize the perils of "indiscriminate mass surveillance."
Flock Safety, an Atlanta-based company worth more than $8 billion, manufactures automated license plate readers (ALPRs), cameras that capture images of license plates and store them in a database that police can search.
Recently, the company has been under intense scrutiny over concerns about privacy and the cameras' capacity for misuse, leading some cities to cancel their Flock contracts. But it turns out that getting rid of Flock is easier said than done.
"When Elgin Community College hired Flock Safety to install six surveillance cameras in April 2025, President Peggy Heinrich thought they would 'enhance the safety and security of students,'" Lisa Kurian Philip reported last week at the Chicago Sun-Times.
The Chicago-area school signed up for a one-year contract with the company. It was not alone: Five of Illinois' 12 public universities, plus four of its community colleges,
But Heinrich began to have second thoughts as she learned more about how the cameras can be used—for example, Flock allowed U.S. Immigration and Customs Enforcement (ICE) to access over 80,000 of its cameras. In September 2025, ICE arrested a student near Elgin's campus.
More than half of Elgin's students are Latino, Heinrich told the Sun-Times, and enrollment began to suffer.
"In August of 2025, Flock publicly announced it would no longer conduct pilot projects with federal agencies," according to the company.
Still, Heinrich said, the school chose to end its contract with Flock "out of an abundance of caution for our students."
"Elgin Community College staff notified Flock in October 2025 that they wanted to cancel their contract and have the cameras taken down," Philip wrote. "Within a day, Heinrich said, Flock rejected the request and refused to uninstall the equipment on the basis that the company had not breached their agreement."
The school reached out again in December, offering to pay out the rest of the contract, but according to Heinrich, Flock did not respond.
Since the school no longer wanted the cameras to operate, and Flock refused to remove or disable them, officials zip tied garbage bags over the cameras on campus. But in a peculiar twist, "workers in an unmarked vehicle, which Heinrich assumed belonged to Flock, repeatedly removed the coverings."
This continued until the school's contract expired in April, when Flock finally removed the cameras.
Granted, the situation is somewhat complicated by the fact that while Elgin is a public institution, Flock is a private company.
"Per Flock contract conditions, the company retains ownership of the products it sells to cities," Caroline Haskins reports at Wired. "This means that when people damage or destroy cameras, cities are on the hook for the cost." Covering cameras with garbage bags will apparently work until Flock comes and cuts them down, but removing or disabling the cameras without the company's permission will incur fees to replace them, even if the city has already said it doesn't want them anymore.
But since the product that Flock sells is a searchable database of license plate images compiled from its interconnected nationwide system of cameras, the reality is more complicated than that.
Indeed, while Flock saysrepeatedly that customers own all data that their cameras capture, that's little comfort when the information is also available to any other customer with access to Flock's database.
Between June 2024 and May 2025, police in Illinois searched the Flock database over 4,000 times for immigration-related reasons, even though a state law prohibits ALPRs' use for that exact purpose. This implies the searches were done at ICE's request, meaning federal immigration authorities could access not just the license plate data in those Illinois communities, but also the thousands of communities nationwide that use Flock cameras.
It's also particularly troubling that Flock would make it so difficult for customers to end their contracts. In that, Elgin Community College is not alone: Plenty of jurisdictions have kept using Flock even after supposedly canceling the service, though it's usually the police who fight the cancellations.
In June 2025, the Austin, Texas, City Council declined to renew its Flock contract. Though the city police department supported the program, officials cited concerns about the cameras' capacity to target vulnerable communities.
But in February of this year, public radio station KUT reported that at least two neighboring towns were sharing access to the Flock database with Austin police.
In July 2025, the Board of Lucas County Commissioners in Toledo, Ohio, voted 2–1 to approve 27 Flock license plate cameras across the county, costing $250,000 over four years. But a week later, one commissioner changed his mind, citing fears of how the data would be used, and the board voted again to rescind the previous approval.
In a letter to the Lucas County prosecutor the following day, Sheriff Michael J. Navarre said the commissioners "have a legal obligation to honor this contract" and alleged that the decision to rescind it was borne out of personal animus toward him.
"I cannot sit idly by and allow them to make decisions out of spite that negatively impact the safety of my deputies and the community they protect," he wrote. To be clear, what apparently put everyone at risk was the decision not to move forward with a series of license plate cameras.
County prosecutor Julia R. Bates wrote back to the sheriff in September 2025, stating that since he had already signed the contract from the original resolution, the rescission was "void."
Elgin Community College's experience is not quite the same—in that case it wasn't the police department, but Flock itself, that refused to take down the cameras. But it's still indicative of the widening rift between those who worry about our growing surveillance state and those who apparently see it as worth the tradeoffs.
Investigators also sought permission to use an invasive surveillance tool called a cell-site simulators against journalist Georgia Fort and a Minnesota state Senate candidate.
Ghana has rejected a proposed health compact with the United States that would have provided an estimated $109 million in US health funding over five years, with President John Dramani Mahama saying the agreement raised serious concerns over health data, financing obligations, and Ghana’s regulatory authority.
The decision places Ghana among a few African countries that have pushed back against new US health agreements introduced as Washington restructures its foreign assistance following the dismantling of USAID. Zimbabwe has also rejected a similar agreement, while Zambia has raised concerns over provisions in its negotiations with the United States.
Ghana raises concerns over health data
Speaking at the Council on Foreign Relations in New York on September 25, Mahama said the proposed compact was presented to Ghana as a replacement for health funding previously provided through USAID.
He said Ghana’s Ministry of Health reviewed the document before preparing a Cabinet Information Paper.
“Ghana is a sovereign nation, and we have our own processes. We are a democratic country,” Mahama said.
According to the President, the Cabinet identified several provisions that raised concerns, particularly those relating to Ghana’s health information.
“One, it says that we shall give the United States our pathogen profile,” he said, adding that the agreement also required Ghana to provide medical records.
“It also says we should give our medical records. I mean, who takes another country’s medical records? And so that was strange.”
Concerns over health-data sharing have been central to resistance to the new US health agreements in several African countries.
No FDA inspection
Mahama also raised concerns about the treatment of medicines and other medical products supplied under the proposed arrangement.
He said Ghana would have been required to contribute funding to the program while, according to his account of the compact, the country’s Food and Drugs Authority would not have been able to inspect medicines or other medical products entering Ghana under the program.
“And then it also says that any medications or any medical products that shall be brought into our country, our Food and Drugs Administration has absolutely no right to inspect,” Mahama said.
“I mean, it was humiliating.”
Ghanaian officials had previously cited concerns about the proposed handling of sensitive health information as a reason for rejecting the agreement. Reporting on the negotiations also indicated that the proposed arrangement would have required additional investment from Ghana alongside the US contribution.
Cabinet rejected the agreement
Mahama said the proposal was rejected after the Health Ministry presented its assessment to the Cabinet.
He described the decision as unusually swift.
“It was the compact that was thrown out in record time in our Cabinet. I’ve never seen anything thrown out as fast as that.”
He said the government subsequently instructed the Health Minister to communicate Ghana’s position to the US ambassador.
“And so, of course, we rejected it. And we asked the health minister to inform the US ambassador that we didn’t need it. We’ll manage ourselves.”
The proposed agreement would have provided Ghana with about $109 million in US health assistance over five years. The negotiations had begun in late 2025.
A wider concern over health sovereignty
Ghana’s decision comes as the United States seeks to shift its approach to global health cooperation. The new US strategy places greater emphasis on recipient countries taking responsibility for financing and delivering health programs, while Washington reduces its traditional aid commitments.
Kenya became the first African country to sign the agreement which was challenged in court, followed by similar arrangements with Rwanda, Liberia, Uganda, Lesotho and Eswatini, among other countries. Ravi Ram from the People’s Health Movement (PHM) East and South Africa, told BreakThrough News in December 2025, that “Bilateral agreements between the US and Kenya and other African countries are meant to limit the ability of any one ‘partner’ country to challenge the terms of implementing the agreement, due to the unequal power relations.”
The concerns among health activists and concerned Africans is the ability of African states to determine their own health priorities, regulate medicines, control sensitive health information, and collectively negotiate the terms of international health cooperation.
As AI-powered biometric identification is adopted by police, national authorities should go beyond legal requirements to build trust within the public, a watchdog report has advised.
“To build public trust, law enforcement should publish the results of their fundamental rights impact assessments, going beyond what the AI Act requires,” said the Fundamental Rights Agency (FRA), an EU branch which keeps tabs on citizens’ freedoms, in Vienna on Wednesday (30 September).
After collecting data from seven EU countries (France, Germany, Greece, Hungary, Italy, the Netherlands, and Ireland), the watchdog warned that several member states have yet to put necessary frameworks in place as they adopt automated systems to identify people.
Remote biometric identification is increasingly used to compare people’s profiles against databases or watch lists, but as the technology develops it could be rolled out for real-time use in public areas.
“With clear safeguards and independent oversight, remote biometric technologies can support policing without undermining the very freedoms it is meant to safeguard. Ultimately, it is about trust,” said FRA chief Sirpa Rautio.
Call for disclosure mechanisms
Effective implementation of the EU AI Act requires clear national laws and consistent safeguards to ensure that AI-powered technologies are not used to identify people taking part in peaceful demonstrations or public gatherings, the FRA says.
The body warns that automated identification of live data may affect people’s private lives and interfere with their right to protection of personal data.
In its survey, 37 percent of people said they fear their data could be used for unauthorised purposes.
And 29 percent of people surveyed by FRA said they would be less willing to take part in peaceful demonstrations or protests if facial recognition was used.
The FRA is worried that surveillance tech powered by AI could be used in exactly those scenarios.
In principle, the EU’s AI Act adopted in 2024 bans real-time remote biometric identification systems in public spaces. But exemptions exist for law enforcement authorities using the technology for finding victims or missing persons, to prevent threats to life or physical safety, stop a terror attack, or to find criminal suspects.
This article continues, but the full version is available only to EUobserver.com subscribers. Visit account.euobserver.com/membership
Login
