Enforcement Archives

EU Commission Sends Preliminary Findings to X for DSA Violations

DSA, Enforcement, EU law, X | July 29, 2024

The EU Commission has notified X of its preliminary findings regarding breaches of the Digital Services Act (DSA), focusing on dark patterns, advertising transparency, and data access for researchers. X’s practices around “verified accounts” mislead users, its ad repository lacks transparency, and it restricts researcher access to public data. These findings result from an in-depth investigation involving internal documents and expert interviews. If confirmed, X could face fines up to 6% of its global annual turnover and enhanced supervision to ensure compliance.

EU Commission Sends Preliminary Findings to X for DSA Violations Read More »

Open Rights Group Complains to ICO About Meta’s AI Data Use

AI, Enforcement, Meta | July 29, 2024

The Open Rights Group (ORG) has filed a complaint with the Information Commissioner’s Office (ICO) against Meta’s plans to use user data from Facebook and Instagram to develop AI, claiming “legitimate interests” as the legal basis. ORG argues that Meta’s approach violates UK GDPR by failing to guarantee users’ right to object and not providing clear, specific purposes for the data use. Despite Meta pausing these plans on 14 June after a GDPR complaint by noyb, ORG insists on a binding decision to protect the data of over 50 million UK residents.

Open Rights Group Complains to ICO About Meta’s AI Data Use Read More »

FTC Bans Avast from Selling Web Data and Fines $16.5 Million

data breach, Enforcement, FTC, United States | July 7, 2024

The Federal Trade Commission (FTC) has finalized an order against Avast Limited, banning the company from selling or licensing web browsing data for advertising. This decision follows allegations that Avast, through its subsidiary Jumpshot, sold consumer browsing data without proper notice or consent, despite claims of protecting privacy. Avast is required to pay $16.5 million, which will go towards consumer redress. The FTC also mandates Avast to delete collected data, notify affected consumers, and implement a comprehensive privacy program.

FTC Bans Avast from Selling Web Data and Fines $16.5 Million Read More »

Arkansas AG Sues Temu for Data Theft and Privacy Violations

apps, cybersecurity, Enforcement, United States | July 7, 2024

Arkansas Attorney General Tim Griffin sued Chinese e-commerce company Temu for violating the Arkansas Deceptive Trade Practices Act and the Arkansas Personal Information Protection Act. Griffin described Temu as a data-theft business disguised as an online marketplace, alleging it illegally accessed users’ personal information and monetized the data without authorization. The lawsuit targets Temu’s parent companies, PDD Holdings Inc. and WhaleCo Inc., seeking to halt their deceptive practices, impose civil penalties, and provide monetary and equitable relief to affected Arkansas residents.

Arkansas AG Sues Temu for Data Theft and Privacy Violations Read More »

The Court of Justice of the European Union (CJEU) ruled in Case C-590/22 PS, determining that mere infringement of GDPR is insufficient for compensation under Article 82(1). Claimants must demonstrate actual non-material damage, though it need not reach a specific severity. Fear of data disclosure can justify compensation if proven. The criteria for fines in Article 83 do not apply to damage awards, and compensation does not need to consider national law breaches not specifying GDPR rules.

CJEU Ruling on Compensation for Non-Material Damages based on fear [Case C-590/22 PS]

CJEU, Enforcement, EU law, GDPR | July 1, 2024

The Court of Justice of the European Union (CJEU) ruled in Case C-590/22 PS, determining that mere infringement of GDPR is insufficient for compensation under Article 82(1). Claimants must demonstrate actual non-material damage, though it need not reach a specific severity. Fear of data disclosure can justify compensation if proven. The criteria for fines in Article 83 do not apply to damage awards, and compensation does not need to consider national law breaches not specifying GDPR rules.

CJEU Ruling on Compensation for Non-Material Damages based on fear [Case C-590/22 PS] Read More »