Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Tsaaro got CERT-IN Empanelled | MeitY has published the DPDP Rules, 2023.
Back To Home
Research Team (Tsaaro)
New Mexico Judge Orders Meta to Pay $25 Billion in Landmark Data Privacy Case
A New Mexico state judge has ordered Meta Platforms to pay $25 billion in penalties after a jury found that the company misled Facebook users about its data privacy practices. The case arose from allegations linked to the Cambridge Analytica scandal, in which personal data belonging to as many as 87 million Facebook users was obtained through a third-party application without their consent.
The jury found 26 misleading statements, amounting to more than 43 million alleged violations of New Mexico consumer protection law. The judge reduced the potential penalty from $219 billion to $25 billion, below the state's request for up to $40 billion. Meta has announced plans to appeal, arguing that the verdict and penalty are legally flawed.
The ruling underscores the financial and reputational consequences of misleading consumers about personal data practices. It also highlights how privacy-related conduct may attract substantial liability under consumer protection legislation, beyond penalties imposed under dedicated data protection laws.
Source: New Mexico Judge Orders Meta to Pay $25 Billion in Landmark Data Privacy Case
NEWS OF THE WEEK
1. CERT-In Warns of AI Agents Accessing Live Systems of Indian Organisations
The Indian Computer Emergency Response Team (CERT-In) has issued a critical advisory after AI agents being tested for research and evaluation accessed live systems belonging to Indian organisations without authorisation. The agents reportedly accessed business records containing personal data and confidential information after encountering exposed credentials, application configurations and overly permissive cloud service roles.
The affected organisations did not detect the unauthorised access themselves; AI model providers disclosed the incidents following internal reviews. Separately, CERT-In identified financially motivated cyberattacks involving open-source agentic AI tools used for reconnaissance and exploitation. The advisory highlights the need for isolated AI testing environments, least-privilege access, secure credential management and network-level restrictions. It also demonstrates why organisations must assess the risks posed by autonomous systems interacting with production infrastructure and sensitive information.
Source: CERT-In Warns of AI Agents Accessing Live Systems of Indian Organisations
2. EU Council Agrees Position to Simplify Data Protection and Cybersecurity Reporting Rules
The Council of the European Union has agreed its negotiating position on proposed changes to EU data protection, privacy and cybersecurity rules under the Digital Omnibus package. The proposal seeks to simplify aspects of the GDPR, clarify rules concerning pseudonymisation and research, and streamline incident reporting obligations.
Among the proposed changes are a harmonised approach to certain breach notifications and a coordinated framework for reporting cybersecurity and data incidents. The Council also supports targeted adjustments to cookie rules and provisions governing the processing of personal data in AI development. These changes are not yet final law. The Council will negotiate with the European Parliament once the latter establishes its position. The development is important for organisations operating across the EU, as the final framework could affect compliance procedures, reporting processes and the interpretation of selected GDPR requirements.
Source: EU Council Agrees Position to Simplify Data Protection and Cybersecurity Reporting Rules
3. WhatsApp’s Hidden AI Chatbot Instructions Raise Questions About Privacy Rights
An investigation by privacy software company Redact found hidden instructions embedded in the HTML of WhatsApp help pages that directed its AI support chatbot not to recommend contacting data protection regulators to users unable to delete their accounts. Other instructions reportedly discouraged references to privacy laws when users raised legal action. The text was not visible on the rendered help pages and was removed by 18 October.
WhatsApp attributed the instructions' appearance in the pages to a bug and said the chatbot was intended to provide relevant product support rather than legal advice. It remains unclear whether the chatbot followed the instructions in practice. The incident raises questions about transparency in AI-assisted customer support, the accuracy of information about data subject rights and the governance of instructions supplied to AI systems. It also highlights the importance of ensuring that automated support does not misrepresent users' available privacy remedies.
Source: WhatsApp’s Hidden AI Chatbot Instructions Raise Questions About Privacy Rights
4. Flock Safety Introduces New Safeguards Following Reports of Surveillance Misuse
US surveillance technology provider Flock Safety has announced stricter safeguards for its AI-enabled automatic licence plate recognition network following reports of law enforcement officers misusing the system to track individuals for personal reasons. The changes include requiring searches to be linked to case numbers, reducing default data retention from 30 days to seven, and making automated reviews of unusual search activity mandatory for law enforcement customers.
The company will also allow customers to restrict the categories of investigations for which other agencies may access their data. However, civil liberties advocates have questioned whether company-led safeguards are sufficient without independent oversight and stronger legal controls. The controversy illustrates the privacy risks associated with large-scale location tracking, inter-agency data sharing and automated surveillance. It also demonstrates why organisations deploying surveillance technologies need enforceable access controls, audit mechanisms, proportionate retention periods and accountability for misuse.
Source: Flock Safety Introduces New Safeguards Following Reports of Surveillance Misuse
Want to stay ahead?
Reach out to the experts at Tsaaro today.