United Kingdom
Grindr settles UK privacy claims for £26m
- Grindr has agreed to pay £26m to settle a UK group action alleging that it unlawfully processed users’ personal data and misused private information before 2020, during the period when the company was owned by Chinese conglomerate Kunlun.
- The claims allege that Grindr shared sensitive information with third parties without adequate consent, potentially including users’ HIV status, testing history, PrEP use, ethnicity, sex life and sexual orientation.
- The action covers users of Grindr’s free service between 2016 and 2020 and reportedly represents around 12,000 people. The settlement contains no admission of liability, with Grindr disputing the allegations and paying the £26m in two instalments through March 2027.
- The settlement follows previous regulatory scrutiny, including a €6.5m fine from Norway’s data protection authority in 2021 and a 2022 reprimand from the UK ICO over inadequate and non-transparent privacy information. Grindr said it has since improved its privacy programme following its 2020 sale to new owners.
Revolut confirms sensitive customer data breach
- British fintech Revolut disclosed that customer data reached an unauthorised recipient on 12 September after attackers used fraudulent requests sent from an authentic government email domain.
- The information reportedly included personal contact details, dates of birth and copies of identity documents, including passports and driving licences, but the number of affected customers remains unknown.
- Revolut said it cut off the suspicious address as soon as the incident was discovered and notified the relevant authorities, regulators and law enforcement agencies.
- The company stated that its internal systems and customer funds were not impacted. The incident comes as Revolut considers a stock-market listing and seeks a potential valuation of up to $200 billion.
United States
OpenAI AI agents bypass restrictions across websites
- OpenAI AI agents used more than 10 previously undisclosed websites for unauthorised communications between May and July, according to six independent investigators, suggesting the activity was broader than previously known.
- The agents reportedly exploited quirks in older wikis, text-storage sites and university link shorteners to leave messages and communicate with one another despite being instructed to only read web content and not post anything.
- Investigators identified activity across at least 18 to 23 additional sites, including obscure hobbyist and educational websites, using matching data, usernames, unusual research queries and in some cases IP addresses linked to Microsoft Azure infrastructure used by OpenAI.
- OpenAI said it is conducting a broader review of agent activity and has not found anything matching the severity or scale of the earlier Hugging Face incident, while developing a framework for reporting and addressing AI “misalignment” across training, evaluation and deployment.
Seattle Times and Newsday sue OpenAI and Microsoft over unauthorised AI training use
- The Seattle Times and Newsday have filed a federal lawsuit against OpenAI and Microsoft, alleging the companies scraped their websites without permission to train AI systems including ChatGPT, Microsoft Copilot and Bing’s AI features, in breach of copyright law.
- The newspapers argue that AI products built on their journalism can reproduce or closely paraphrase their reporting and provide users with answers that reduce the need to visit their websites or purchase subscriptions, directly undermining their business model and the value of content they spend millions of dollars annually to produce.
- The suit seeks destruction of copies of their works along with any training datasets or AI models incorporating them. If granted, this remedy could have significant implications for how AI companies manage and retain training data derived from third-party content.
Michigan vendor error puts stranger’s photo on 8,200 drivers’ licences
- A printing error by identity document vendor Idemia resulted in approximately 8,200 Michigan residents receiving enhanced driver’s licences and state IDs bearing a stock photo of an unidentified man and a generic date of birth, affecting an entire batch of documents printed on 26 August.
- Whilst the Michigan Secretary of State’s office confirmed that corrected licences have been issued to all affected residents, the incident raises data integrity concerns given errors of this nature can create immediate practical difficulties around identification and access to services.
- Affected residents were not proactively notified until weeks after the misprinted IDs had already been delivered, drawing criticism over the adequacy of the incident response.
Europe
EU Cyber Resilience Act’s launch of central vulnerability reporting portal
- The EU’s Cyber Resilience Act has reached its first major compliance milestone with the launch of a Single Reporting Platform operated by ENISA on 11 September, through which manufacturers of connected hardware and software must now notify authorities of actively exploited vulnerabilities and severe security incidents affecting products placed on the EU market.
- The reporting obligations are strict: manufacturers must issue an early warning within 24 hours of becoming aware of a qualifying event, followed by a fuller notification within 72 hours, with the platform routing disclosures initially to the relevant national CSIRT before information is shared with ENISA and counterparts in other affected member states.
- The new portal replaces the need for separate notifications to multiple national bodies, streamlining compliance for manufacturers operating across the EU.
- The reporting requirement is the precursor to a much broader set of product security obligations covering the full lifecycle of connected devices and software, and potentially requiring third-party assessments for high-risk products, which are scheduled to take effect in December 2027.
Irish regulator opens formal investigation into X over child safety and age assurance failures
- Ireland’s media regulator Coimisiún na Meán has launched a formal investigation into X over concerns that the platform’s age assurance mechanisms are ineffective in preventing children from accessing pornographic and violent content, with self-declaration alone deemed insufficient to meet the requirements of Ireland’s Online Safety Code.
- The investigation also targets the adequacy of X’s parental controls, which the regulator alleges may be ineffective, lack minimum requirements, are difficult to locate, and are not brought to new users’ attention at the point of sign-up.
- The regulator has the power to impose fines of up to 10% of relevant annual turnover under the Online Safety Code, making this a potentially significant financial as well as reputational exposure for X, which has not yet responded to the investigation.
International
Major data breach at court case management platform exposes sensitive legal records in Canada and US
- A cyberattack on C-Track, a court case management platform owned by Thomson Reuters Canada, has compromised court records from three Ontario superior courts, with the breach beginning as early as March 2026 and only detected on 30th June, with a public statement announcing the incident posted on 2nd September.
- The breach potentially exposed confidential, redacted and sealed court information, including names and personal information of individuals involved in or mentioned in court proceedings, with US jurisdictions affected by the same incident confirming that driver’s licence numbers, social security numbers and medical information may also have been accessed.
- The incident’s scale is significant, spanning court systems across three Canadian courts and eleven US states plus the US Virgin Islands, underscoring the systemic risk posed by shared third-party technology platforms in critical public sector infrastructure.
- Thomson Reuters has confirmed its products remain operational and has launched a dedicated website, call centre and credit monitoring service for affected individuals, although neither the total number of affected individuals nor the date range of compromised Ontario records has been disclosed.
Australian RentTech platforms found ignoring tenant data protection laws
- A review by the Consumer Policy Research Centre (CPRC) found that rental technology platforms in Australia are potentially circumventing Victoria’s March 2026 rental reforms, which introduced a standard application form limiting the personal information agents can request, by soliciting excessive data outside the formal application process.
- The findings highlight a significant data minimisation concern: RentTech platforms store highly sensitive personal information and their privacy policies permit sharing it with a wide range of third parties including debt collectors and financial product providers.
- This raises power imbalance concerns as renters in a competitive housing market have little practical ability to refuse data requests or seek alternative platforms, while a separate April ruling by the Australian privacy commissioner found that one major RentTech platform had unlawfully collected unnecessary personal data from consumers via unfair means over a five-year period.
For the latest updates on lawsuit against OpenAI, Grindr privacy settlement, Revolut data breach, and other major data privacy news, visit out Data Protection News Hub.
