United Kingdom
ICO investigates Police Scotland over Subject Access Request compliance
- The Information Commissioner’s Office has opened a formal investigation into Police Scotland to examine its compliance with data protection laws when handling Subject Access Requests.
- The inquiry is evaluating whether Police Scotland has failed, or is currently failing, to meet statutory duties under data protection law, particularly regarding response times.
- An ICO spokesperson stressed that SARs represent a fundamental right allowing individuals to know what personal data organisations hold about them and how that information is being processed.
Research reveals UK gambling websites use deceptive cookie banners and tracking
- A study by Swansea University revealed that 86% of UK-licensed online gambling websites operate in breach of data protection legislation.
- Researchers audited 615 gambling platforms and found that cookie consent banners routinely employ deceptive interface designs structured to steer visitors into accepting tracking cookies.
- The design most commonly used by gambling websites made participants three to four times more likely to accept tracking than a neutral alternative which allowed them to refuse with one click.
Ministry of Justice discovers high-risk data breach linked to Southport attack
- The Ministry of Justice launched an urgent inquiry after an internal review revealed courts staff improperly accessed sensitive files related to victims, survivors, and families of the 2024 Southport attack.
- The compromised personal data poses a high risk to the rights and freedoms of those targeted, though there is no evidence the information was shared externally.
- The MoJ reported the breach to the Information Commissioner’s Office, with the Prime Minister instructing the Lord Chancellor to directly oversee investigations by court and probation services.
- The incident follows separate investigations into improper record access, including nearly 50 hospital staff accessing victim medical files at Aintree Hospital and an ongoing investigation into North West Ambulance Service personnel.
United States
Teachers’ Union pressures Microsoft into adopting AI privacy rules in education
- Microsoft signed a binding agreement with the American Federation of Teachers, a large teacher union, banning the use of student or educator data for training AI models, selling, product development, or targeted advertising.
- Effective from 1 November, the rules prohibit AI tools designed to create emotional dependency, restrict processing of sensitive personal data, and mandate plain-language disclosures alongside third-party compliance audits.
- The deal follows one-year moratoriums on student AI use in New York City and Los Angeles, as educators demand stricter safeguards against data harvesting and screen time.
Florida sues Netflix over addictive features and minors’ privacy
- Florida Attorney General launched a lawsuit accusing Netflix of misleading subscribers by harvesting data from minors to build a global advertising business.
- Florida alleges features like autoplay were deliberately designed to encourage binge-watching and be addictive to children, violating state consumer laws by commercialising minors’ data without parental consent.
- Denying all claims, Netflix stated the lawsuit lacks merit, maintaining that it complies with the law, provides clear annual disclosures, and enforces strict dedicated safeguards and parental controls on kids’ profiles.
Europe
European Commission unveils strict online age restrictions in KIDS Act
- The European Commission introduced the “EU KIDS Act”, which proposes a ban for children under 13 from social media and AI chatbots, requires parent-supervised “mini-accounts” for ages 13-14, and allows full account creation only from age 15.
- According to the proposed legislation, tech platforms would need to prove their products are safe before launch, whilst banning addictive features like infinite scrolling, night-time push notifications, and profiling-based feeds for minors.
- The framework would establish a supervisory fee on tech firms to fund regulatory oversight and allows for financial penalties of up to 6% of global annual turnover for non-compliance.
Spain’s watchdog reports first data breach executed by autonomous AI agent
- Spain’s data protection authority received its first reported data breach allegedly executed by an autonomous AI agent.
- According to the affected organisation, the AI agent logged in, searched for application flaws, identified a vulnerability, and subsequently modified personal data while accessing private billing records.
- The regulator noted that this incident, alongside the other recently reported ones in different countries, indicates AI-driven cyberattacks are moving beyond theoretical risks into real-world data processing systems.
- The data protection authority warned that autonomous AI tools do not create entirely a new threat, but drastically increase the speed, scale, and adaptability of existing techniques.
International
Australia weighs ban on smart glasses in government workplaces
- Australia is considering becoming banning camera-equipped smart glasses in government workplaces due to heightened security and covert recording concerns.
- Minister for Public Service aims to establish clear rules on public servants using smart glasses on government premises.
- Prime Minister announced a workplace AI roundtable with major corporate employers to formulate broad workplace guidelines.
- The move reflects expanding restrictions on smart glasses, joining Oslo’s school ban, court prohibitions in England and Wales, and privacy-focused criminal complaints against Meta in Germany.
For the latest updates on autonomous AI agent data breaches, ICO investigation into Police Scotland, gambling websites breach of data protection legislation, Microsoft adopting AI privacy rules in education and other major data privacy news, visit out Data Protection News Hub.
