United Kingdom
Ruling opens data protection remedies for misleading news headlines
- The Court of Appeal ruled in Vince v Associated Newspapers Ltd that misleading editorial presentation can constitute unfair processing under the UK GDPR.
- The judgment breaks from the traditional defamation principle, establishing that data protection fairness is an autonomous concept; a publication can breach data protection law even if it is not legally libelous when read in its entirety.
- Associated Newspapers failed to rely on the journalistic public interest exemption by failing to take adequate care to avoid misleading casual readers who only view headlines and images.
- The ruling opens a new legal avenue for claimants and poses risks for digital publishers, influencers, and content creators who use thumbnails, previews, or headlines to drive clicks.
Cyberattack at Robert Burns Charity exposes personal contact data of members
- The Robert Burns Ellisland Trust, a charity managing the historic farm where poet Robert Burns lived, suffered a cyberattack that caused a data breach.
- Personal contact details of members were compromised, though the Trust confirmed no banking or financial information was accessed.
- Affected members have been urged to stay vigilant against targeted phishing attempts and potential scams attempting to exploit the stolen contact data.
- The charity is collaborating with IT and cybersecurity specialists to secure its databases, close vulnerabilities, and prevent future breaches.
United States
Music giants sue Anthropic over alleged copyright theft to train Claude AI
- Music giants Sony Publishing and Warner Chappell have launched a multibillion-dollar lawsuit in California against Anthropic.
- The publishers allege Anthropic carried out “one of the largest and most blatant ongoing thefts of intellectual property in history” by torrenting, scraping, and downloading tens of thousands of copyrighted song lyrics to train its Claude AI models.
- The lawsuit seeks statutory damages of up to $150,000 per infringed work, while Anthropic denies the allegations and intends to defend itself in court.
Flock Safety tightens surveillance controls following evidence of police misuse
- Surveillance tech firm Flock Safety has introduced mandatory safeguards for law enforcement, and lowering its default data retention period from thirty to seven days.
- The policy shift follows widespread reports of police officers using the technology for personal stalking and harassment, alongside recent security glitches that briefly exposed live camera feeds to the public.
- Privacy advocates and legal groups argue the measures fall short, maintaining that internal self-policing fails to eliminate mass surveillance risks without a legal warrant requirement.
Europe
Hackers attack Berlin IT systems and threaten public auction of stolen files
- Hackers are attempting to blackmail the city of Berlin after breaching municipal IT systems, stealing data, and demanding a ransom.
- The attackers, identified as the Rhysida group, demanded 30 Bitcoin (approximately €2m) and threatened to auction 5.79 terabytes of stolen data.
- Governing Mayor Kai Wegner firmly rejected the extortion attempt, declaring that “Berlin will not be blackmailed” while state and federal authorities investigate.
- The breach forced the shutdown of departmental networks, disrupting housing benefit payments, and compromising transport and environment department files.
French data protection authority fines hospital over massive data breach
- A cyberattack compromised the patient database at Hôpital Privé de la Loire, exposing records belonging to patients and designated trusted third parties.
- France’s data protection authority issued a €500,000 fine under GDPR, citing a lack of VPNs or multi-factor authentication, inadequate access controls that allowed a single login to view all patient records, and an absence of real-time intrusion monitoring.
- Regulators also noticed that the hospital directly notified affected patients but failed to inform the trusted third parties whose data was also stolen.
- Beyond the monetary penalty, the supervisory authority ordered the facility to complete cybersecurity upgrades.
International
Australia sets out next phase of Privacy Act changes
- Australia’s draft bill introduces an objective test requiring organisations to demonstrate that data collection and processing are fair and reasonable.
- Australians would gain a formal “right to erasure” to request the destruction of personal data, alongside the new IDLock framework to help citizens manage credential security following high-profile data breaches.
- The proposed bill aims to address complex data collection issues driven by advanced analytics, AI systems, and smart glasses, prioritising responsible underlying governance over single-technology bans.
- The Attorney-General’s Department is gathering feedback on the Privacy Amendment Bill 2026, marking the second major wave of updates following 2024’s enforcement reforms.
For the latest updates on Sony Publishing and Warner Chappell lawsuit against Anthropic, The Robert Burns Ellisland Trust cyberattack, Flock Safety surveillance controls, and Australia’s Privacy Act changes, visit out Data Protection News Hub.
