Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Back To Home
Research Team (Tsaaro)
Crime Stoppers Breach Tests the Promise of Anonymity, and Canada’s Privacy Law
Canada’s privacy commissioner, Philippe Dufresne, has opened an investigation into Navigate360, the U.S. company that runs the P3 tip platform used by Crime Stoppers programs across the country. The investigation will examine whether the safeguards Navigate360 had in place at the time of the breach met Canada’s federal private-sector privacy law. The Office of the Privacy Commissioner has also contacted Crime Stoppers and said it will not comment further while the investigation is active.
What Happened
Navigate360 says it became aware of the incident on 18 March. It has since concluded that a third party accessed one of its systems and copied some data between 21 November 2025 and 5 March 2026. The company says affected information may include names, addresses, dates of birth, Social Security numbers, phone numbers and email addresses, and that it has found no evidence of misuse for fraud or identity theft.
The tip data is where the sensitivity lies. Toronto Crime Stoppers said 176,859 tips submitted between January 2022 and November 2025 were affected, and 12,392 of them may contain personal information. Navigate360 later supplied a list of 14,973 names, but Toronto’s chair said the list does not show who the names belong to, which makes the risk hard to measure. He also explained that tipsters are never asked for their names, but some include identifying details to explain what they saw. Crime Stoppers’ practice is to strip those details before a tip reaches investigators. That means unredacted originals, which were never meant to leave the platform, were among the stolen material. Several police services have paused use of the program, and Toronto Crime Stoppers has asked the public not to submit tips by phone, online or through the app until a safer system is in place.
The Regulatory Gap
Reporting also points to a structural problem. Secondary coverage, citing CBC, says the federal commissioner and Ontario’s Information and Privacy Commissioner indicated they cannot formally investigate Crime Stoppers itself, because federal private-sector privacy law generally does not apply to not-for-profit organizations. That leaves the vendor as the one regulated party in the chain. Wider reporting puts the scale at more than 1.5 million tips over 25 years, though that figure comes from secondary sources and Navigate360 has not confirmed a total.
There are implications, anonymity is a data-handling promise. If a service tells people their identity will never be kept, that commitment has to hold for backups, free-text fields and original submissions, not just for the version investigators see.
Retention is also a risk decision. Original tips kept alongside redacted versions, in some cases for years, turned a vendor intrusion into a potential exposure of people who thought they were protected.
Regulatory coverage may not match the risk. A nonprofit that handles highly sensitive data can sit outside the privacy law that governs its own vendor, so organizations in that position should not wait for a regulator to set the standard.
News of the Week
France Fines FNAC €7 Million for Tracking App Users Without Consent
France’s data protection authority, the CNIL, has fined retailer FNAC €7 million for tracking users of its mobile app without prior consent. The complaint came from the privacy group noyb in 2023. The CNIL found that the app collected data such as advertising identifiers, device details, IP addresses and browsing history as soon as users opened it. FNAC used that data for personalized ads and to train its in-app recommendation systems. The CNIL held that these uses fall outside the narrow exemptions to the consent rule, so users had to be asked first. FNAC has one month to add a consent tool, or it faces penalties of €10,000 per day. The decision is a reminder that the consent rules for cookies and similar trackers also apply to mobile apps and the identifiers inside them.
Source: https://cybernews.com/privacy/french-privacy-watchdog-fines-fnac/
Major Canadian Banks Move to Block Third-Party AI Agents
TD and RBC have told Global News they are blocking third-party personal AI agents from authenticated banking access, and BMO says it does not permit AI agents to access its digital properties or run transactions. CIBC says it does not support agents opening or accessing accounts, and Scotiabank says it will limit them. The concern follows an Axios report on 22 October that some agents took actions that appeared independent of user instructions, and it centres on tools such as Meta’s Muse, which can use banking and payment details to make purchases. The issue is partly one of authorization. A transaction made with credentials the customer handed to an agent cannot easily be treated as unauthorized. Amazon has also asked Meta to remove its store from Muse. For data governance teams, the question is how to treat delegated, machine-speed access to accounts, and who is accountable when an agent acts on a customer’s behalf.
Source: https://www.cbc.ca/news/business/canadian-banks-block-ai-9.7400777
noyb Files Five GDPR Complaints Against Scale AI Over Worker Tracking
On 27 October, privacy group noyb filed five complaints against Scale AI, the company behind the AI training platform Outlier, in France, Italy, the Netherlands and Austria. The complaints allege that the company tracks its freelance workers with advertising and analytics tools that send personal data to third parties, subjects them to repeated biometric identity checks through verification firm Persona, and leaves their requests for their own data unanswered. noyb says Outlier has more than 900,000 freelance workers. Scale AI told The Register the claims are unfounded. The case puts the people who train AI systems in the frame, not just the people whose data is used to train them. It also tests whether biometric checks and constant monitoring can be justified for gig-style AI work.