All news with #privacy engineering tag

📝 This article explains how to use AI as a safe copy editor when preparing a resume, while avoiding handing over sensitive personal data. It outlines privacy risks with chatbots, recommends removing identifiers before sharing text, and suggests running models locally if you handle confidential information. The piece also covers applicant tracking systems (ATS), practical resume structure and phrasing advice, and a tested prompt to help improve resumes without making them sound machine-generated.

🔍 Norway’s Data Protection Authority fined Microsoft-owned advertising company Xandr NOK 92 million ($9.6M) for unlawfully processing and sharing sensitive Grindr user data. The authority found that between July 2018 and April 2020 Xandr ran real-time ad auctions that exposed sexual orientation and other profiling data to thousands of advertisers without verifying valid consent. The decision, the largest fine issued by Datatilsynet, was praised by privacy groups and Xandr has three weeks to appeal.

🔍 Four more U.S. states—Florida, Iowa, Montana and Nebraska—filed suits on October 6 accusing TP‑Link Systems of misleading customers about router security and its separateness from China; Texas had sued in February. The complaints cite device flaws, end‑of‑life models, and privacy concerns tied to Chinese intelligence law, while TP‑Link denies the allegations and vows to contest them. Researchers disclosed technical details of five ISP‑supplied device flaws on October 8, and 21 state attorneys general have written the FCC about TP‑Link's pending approvals.

🛡️ ISACA is introducing an AI governance certification, currently in beta applications, slated for early 2027 to complement its existing AI credentials. The move follows research showing only 32% of digital trust professionals believe their organizations adequately address AI risks such as privacy, bias and security. ISACA’s broader AI credential suite already includes AAIA, AAISM and AAIR, and uptake has been strongest in Europe, the US and Asia according to recent polls.

🔒 Italy's Data Protection Authority fined IQVIA €7 million over insufficient anonymization and data-processing practices affecting about one million patient records. The GPDP found that pseudonymous codes plus detailed health and location data could enable re-identification, and that some records included full personal identifiers. Authorities also cited lack of legal basis, failure to inform patients, and missing retention policies, ordering compliance within 120 days.

🔒 The Technical University of Denmark (DTU) reports that hackers used compromised credentials to access its identity and access management system, DTUBasen, potentially exposing information of up to 200,000 people. The breach may include Danish civil registration numbers (CPR), names, addresses, profile pictures, work emails, job titles, and next-of-kin contact details for active users. DTU is notifying affected current and former employees via e-Boks and urging caution against phishing and identity fraud.

🛡️ Researchers from Northeastern University and Consumer Reports examined how modern vehicles collect and share driver data by reviewing automaker privacy policies, regulatory filings, and industry practices. They found that consent is often obtained via infotainment systems or mobile apps at setup, where many users accept terms without reading them. Data recipients include insurers, lenders, telematics exchanges, data brokers, and government agencies, meaning manufacturers can continuously monitor and monetize driving behavior.

🔍 Flock Safety's networked license-plate readers and cameras can aid serious investigations but also log vast sensitive location data searchable across agencies. The company faces documented misuse and must move quickly to embed effective controls like short retention defaults, case-bound access, multifactor authentication and anomaly detection. Graduated retention, verified case tokens, tighter sharing defaults and independent audit are recommended to balance public safety and privacy.

📌 Ireland’s Data Protection Commission fined Google €403 million for GDPR breaches tied to processing users’ location data. The investigation, opened in February 2020, reviewed three features — Web & App Activity, Location History, and Location Accuracy — active during May 25, 2018 to February 4, 2020. The DPC found failures in transparency, lawful processing, and retention practices, and ordered compliance within six months. Google says it has since updated policies and added user controls for location data.

📺 Xicoia's viral AI character "Talking Tilly" now requires an automated face scan and age check before calls connect, using Spain-based Didit for age estimation with ID fallback. During calls the system analyses camera and voice to infer mood, and recordings are transcribed, stored, and processed by US providers with responses generated by Google's Gemini via Tavus. The service uses legitimate interest as its legal basis and enforces automated safety filters; calls may be withheld or deleted, and the paid service expires permanently on September 27.

📹 Xicoia's viral AI character Tilly Norwood now requires an automated age check via a video selfie analyzed by Spain-based Didit before callers connect. The service also monitors camera and audio during calls to infer emotion, records and transcribes conversations processed by US providers, and uses Google's Gemini through Tavus for responses. Calls are free for five minutes then paid, and the service will shut down on September 27, with transcripts retained and some automated moderation errors reported.

🔍 Nudify apps use generative AI to alter photos of clothed people so they appear nude, a practice that can enable non-consensual intimate imagery (NCII) and is increasingly weaponized by fraudsters and abusers. Legal responses vary: the US lacks a federal ban on the apps themselves but has laws and proposals addressing distribution of NCII, while the EU is moving toward criminalizing such images under a new directive. The article advises reducing public photo exposure, tightening account security, educating children, and using removal and reporting services if victimized.

🛡️ Microsoft’s chief legal officer argued that secrecy orders accompanying government subpoenas should be the exception, not the rule. LinkedIn, owned by Microsoft, is challenging broad government demands that bar notifying customers when their data is sought, urging courts to impose meaningful limits and oversight. The company acknowledged law enforcement needs while asserting providers and users deserve adversarial review and notice. Legislative reforms in the House aim to constrain secrecy orders and strengthen notice protections.

📰 A New Jersey judge ordered radaris.com and more than a dozen related domains transferred to plaintiffs after finding the data broker repeatedly ignored removal requests under Daniel’s Law. Atlas Data Privacy Corp sued Radaris in 2024, alleging the company published personal data for state law enforcement and other officials and employed evasive shell-company tactics. The transfer follows extensive litigation, investigative reporting and documentary evidence tying multiple sites to a common operator.

📝 This essay, coauthored with Cindy Cohn and first published in Lawfare, traces the post-9/11 shift from targeted warrants to widespread mass surveillance by government and private actors. It outlines how data brokers, corporate tracking, and programs like the NSA’s Upstream and Section 702 collections have expanded governmental access to Americans’ communications. The authors argue these practices undermine Fourth and First Amendment protections and call for reassessment.

🎧 Smashing Security episode 484 features Graham Cluley with guest Danny Palmer discussing how websites can track users through silent audio activity and other stealthy techniques. The episode also covers guidance from cyber intelligence agencies urging firms to avoid vague PR language after cyberattacks, and touches on recent incidents like ransomware and token theft. The hosts mix news with a light-hearted sound-identification segment before exploring the privacy implications of modern web tracking.

🔒 Branches of the US military have disabled advertising IDs on government-issued phones and computers after concerns that commercially available location data was being used to target American forces. Senator Ron Wyden and Representative Pat Harrigan pushed the Pentagon for action and sought an inspector general investigation into how location data risks were handled. The move follows warnings about adversary exploitation of commercial location data and broader guidance urging personnel to limit personal device sharing and clean up social media.

🛡️ Anthropic introduced Enterprise Frontier Safeguards (EFS), a framework that combines zero data retention (ZDR) privacy with automated misuse detection while keeping monitoring data in customer-controlled cloud storage. The phased rollout begins this fall and will cover multiple Claude and third-party platforms, with interim ZDR on Fable 5 and 5.1 models. EFS automates detection and routes alerts to customer teams with no Anthropic human review, shifting operational triage and retention responsibilities to enterprises. The feature is free, though standard cloud storage costs apply.

📡 Comcast has rolled out a WiFi-based motion detection feature on its routers that notifies users when motion is detected near connected devices and provides live activity feeds. The feature includes modes for Home, Sleep, and Away, and its effectiveness varies with home layout, materials, and device placement. Comcast warns it does not guarantee detection performance and notes the system has limitations. The company’s support documentation also states that motion data may be shared with third parties under certain circumstances.

📧 Brave 1.94 adds an Email Aliases feature that generates disposable addresses for signups, keeping users' real emails hidden while forwarding messages. The feature requires a free Brave Account and stores primary and alias addresses encrypted; forwarded messages are delivered then deleted from Brave servers within seconds. Up to five aliases are free, with a paid Premium tier planned, and forwarded mail may initially hit spam folders.