[{"description":"Amazon will pay $2.25 million in civil penalties to settle Federal Trade Commission allegations that the online retail giant knowingly violated the Fair Credit Reporting Act (FCRA) by refusing to provide transaction records to consumers whose personal information was used by identity thieves to commit fraud. The complaint , filed by the Department of Justice upon notification and referral from the FTC, alleged that in numerous instances, Amazon.com Inc. failed to comply with Section 609(e) of the FCRA, which requires companies to, within 30 days of a consumer’s request, provide victims of identity theft with application and business transaction records about fraudulent transactions made in their names. According to the complaint, Amazon had no written policy to respond to Section 609(e) requests until early 2025, after it learned of the FTC’s investigation, despite prior outreach from FTC staff advising the company to review its compliance with Section 609(e). “Amazon often put identity theft victims through a Kafkaesque ordeal by demanding they identify the thief who stole their information before Amazon would release the records the law entitles them to—records that could help victims protect themselves and recover from the fraudulent conduct,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “The FTC will not allow companies to simply ignore their legal obligations, especially those designed to support and protect identity theft victims.” Many consumers who contacted Amazon to report fraud were told by its customer service agents that they could not provide the requested records for “security” or “privacy” reasons, the complaint alleged. For example, one consumer reported that when they contacted Amazon seeking business records related to unauthorized charges stemming from a fraudulent account, a company representative said they could not share details about the other account that had used the consumer’s credit card for “security reasons” unless the consumer guessed the name on the account (the name used by the identity thief), which the consumer was unable to do after making 30 attempts. The complaint alleged that in other instances, Amazon agents told consumers they were not able to access the requested records. Amazon even refused to provide application and business transaction records to law enforcement agencies who had been authorized to, and who did, submit requests to Amazon on behalf of consumers who were victims of identity theft. Some frustrated consumers resorted to sending copies of the FCRA and FTC guidance to Amazon in hopes of receiving the requested records, but Amazon still failed to comply with the law. The complaint also alleged that in some cases where Amazon ultimately provided requested records, it failed to respond to consumers within the 30-day timeframe required by the FCRA. In addition to the $2.25 million civil penalty—a record for a Section 609(e) violation—the proposed order will prohibit Amazon from failing to comply with Section 609(e) of the FCRA, requiring the company to provide the records lawfully requested by identity theft victims and law enforcement agencies acting on their behalf. The order also requires Amazon to provide notice to consumers about how identity theft victims can request records under the FCRA. The company must also contact consumers who had requested records since April 2024 from Amazon but did not receive them to inform these consumers that it may have additional records and that the consumers may request those records from Amazon. This is the second case the FTC has brought using its authority under Section 609(e) of the FCRA. The FTC announced its first case involving a violation of Section 609(e) of the FCRA in 2020 against Kohl’s Department Stores Inc . The Commission voted 2-0 to authorize the staff to refer the complaint to the DOJ and to approve the proposed stipulated order. The DOJ filed the complaint and final","id":2997627,"source":"Federal Trade Commission - Protecting America's Consumers","url":"https://www.ftc.gov/news-events/news/press-releases/2026/06/ftc-requires-amazon-pay-225-million-resolve-charges-it-knowingly-violated-fair-credit-reporting-act","titre":"FTC Requires Amazon to Pay $2.25 Million to Resolve Charges It Knowingly Violated the Fair Credit Reporting Act","pubDate":"Wed, 01 Jul 2026 08:09:43 +0200"},{"source":"ANJ","description":"UEFA European Football Championship and sports betting: the French Gambling Authority (ANJ) gathers operators and announces a dynamic and structuring action plan admin lun 13/09/2021 - 16:45 On 20 July 2021, the French Gambling Authority (ANJ) gathered sports betting’s operators in order to make the overview of the European Football Championship that has been scarred by some abuses. Resulting from a constructive exchange, these operators have agreed on the necessity to proceed at a rebalancing of their practices in order to preserve the recreational model of the French gambling market. As such, the ANJ introduced an action plan that seeks to reinforce operators’ compliance, to adapt and complete existing tools and, where required, to use sanctioning procedures. English Questionable practices highlighted during the European Football Championship UEFA European Football Championship 2021 confirmed the growing place of sports bets in France with EUR 434 million of online stakes. The French team matches have aroused a strong popularity by totalling EUR 88 million of online bets, which means an average of EUR 22 million per match. This competition has underlined the existence of questionable practices around sports betting, such as the media hype, the targeting of young people or the excessive stimulation of the game. For the first time, the public debate has seized this very subject and has relayed serious concerns coming from various circles. According to a Harris Interactive inquiry* conducted for the ANJ during the European Football Championship, more than half of those who had seen sports betting ads feel that they are too many of them and close to eight out of ten French people who had seen these ads consider that they can contain a risk of addiction. *Inquiry conducted by Harris Interactive online from the 6 to the 8 July 2021 for the ANJ with a cross section of 1038 French population aged over 18 years old. The ANJ has brought gambling operators together in order to learn from the European Football Championship After having drew the attention of operators on several critical points since June, the ANJ has gathered them on the 20 July in order to do the review of the European Football Championship and to address them the following messages: A yellow line has been crossed in terms of advertising pressure during this competition, which leads to question the model of regulation in place for the past 10 years; it is important to drastically and immediately reduce the sports betting’s advertising pressure. The commercial communications targeting young adults and keeping the illusion of easy money are particularly problematic. As a result of these discussions, which took place in a constructive atmosphere, gambling operators have decided that they collectively share the concerns expressed by the regulator and are prepared to work alongside it in order to propose some improvements and to limit these commercial communications. The ANJ establish an action plan for games offer to remain recreational and well-balanced Given the shared objective of recovery practices between regulator and operators, the ANJ has announced the launch of 5 projects to fight the observed abuses and to clarify or complete the legal framework. These projects should be over by the end of the year.   Regarding advertisement: The ANJ","id":2847428,"url":"https://anj.fr/uefa-european-football-championship-and-sports-betting-french-gambling-authority-anj","titre":"UEFA European Football Championship and sports betting: the French Gambling Authority (ANJ) gathers operators and announces a dynamic and structuring action plan","pubDate":"Sat, 25 Apr 2026 08:02:05 +0200"},{"id":2170441,"description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a €900 000 fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •  Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •  Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","source":"EDPB News","pubDate":"Tue, 10 Jun 2025 09:51:20 +0200","url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-eu900-000_en","titre":"The French SA fines SOLOCAL €900 000"},{"id":2130472,"description":"Background information Date of final decision: 15 May 2025 National case Controller:  SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months Key words: administrative fine, consent,  unsolicited communication   Summary of the Decision Origin of the case   As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chain, the primary collectors, who are responsible for collecting prospect data). SOLOCAL MARKETING SERVICES used this data to operate commercial prospecting by SMS or e-mail to individuals concerned, on behalf of its advertiser customer. It may also pass on some of this data to its customers, so that they can carry out their own commercial prospecting by telephone or post. Key Findings  Failure to comply with the obligation to obtain the consent of individuals to receive commercial prospecting by electronic means (Article L.34-5 of the French Post and Electronic Communications Code): The restricted committee considered that the misleading appearance of the forms used by data brokers made it impossible to obtain free and unambiguous consent, in compliance with the requirements of the GDPR, which would have formed the basis for the prospecting operations carried out by the company. Failure to demonstrate that the data subject has consented to processing of his or her personal data (Article 7 of the GDPR): The company failed to provide the French SA with proof of consent from individuals whose data has been transferred to it by one of its main suppliers. As a result, the French SA was unable to examine the collection forms used by this supplier and, therefore, the validity of the consent of the data subjects.   Decision  Based on the findings of the inspection, the restricted committee – the French SA body responsible for issuing sanctions – considered that the company had failed to comply with obligations under the French Post and Electronic Communications Code (CPCE) and the General Data Protection Regulation (GDPR) regarding the collection and proof of consent.  It imposed on SOLOCAL MARKETING SERVICES:  a 900 000 € fine which was made public; and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months.  The amount of this fine takes into account the very large number of people concerned (several million), the company's historical position on the market, the financial benefit derived from the breaches, and the measures taken by the company to comply with some of its obligations since the checks were carried out. For further information:  •   Courtiers en données : sanction de 900 000 euros à l’encontre de la société SOLOCAL MARKETING SERVICES (French) •   Data brokers: SOLOCAL MARKETING SERVICES fined €900,000  (English)","source":"EDPB News","pubDate":"Wed, 21 May 2025 15:52:14 +0200","titre":"The French SA fines SOLOCAL 900 000 €","url":"https://www.edpb.europa.eu/news/news/2025/french-sa-fines-solocal-900-000-eu_en"},{"url":"https://www.edpb.europa.eu/news/news/2025/european-patent-organisation-and-extension-adequacy-decisions-uk-edpb-adopts_en","titre":"European Patent Organisation and extension of adequacy decisions for the UK: EDPB adopts opinions","pubDate":"Tue, 06 May 2025 15:51:59 +0200","source":"EDPB News","description":"Brussels, 06 May - During its latest plenary, the European Data Protection Board (EDPB) adopted an opinion on the European Commission’s draft adequacy decision under the GDPR concerning the European Patent Organisation (EPO) . In addition, the Board adopted an opinion on the European Commission’s proposal to extend the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive (LED) . Finally, the EDPB agreed to grant the status of observer to the Personal Data Protection Agency of Bosnia and Herzegovina.   Adequate protection of personal data by the EPO At the European Commission’s request, the Board adopted an opinion on the Commission’s draft adequacy decision regarding the European Patent Organisation (EPO). Once formally adopted by the Commission, this will be the first adequacy decision concerning an international organisation and not a country or a region. An adequacy decision is a key-mechanism in EU data protection legislation which allows the European Commission to determine whether a third country or an international organisation offers an adequate level of data protection. The effect of such a decision is that personal data can flow freely from Europe to that third country or international organisation. EDPB Chair, Anu Talus, said: “The EDPB welcomes the Commission’s initiative to work on the first adequacy decision concerning an international organisation. This decision shows how the legal framework of such organisations can be recognised as ensuring an adequate level of protection on the basis of Art.45 GDPR. The EDPB underlines the importance of ongoing dialogue between the Commission and international organisations, with a view to developing this category of adequacy decisions in addition to those relating to third countries.” In its opinion, the Board positively notes that the EPO data protection framework is largely aligned with the European Union data protection framework, including on data protection rights and principles. This shows that the GDPR and, in particular, its transfer provisions, can facilitate safe data flows from Europe to international organisations, while taking into account their status.   Six-month extension of the UK adequacy decisions The EDPB opinion, requested by the European Commission, addresses the proposed extension of the two UK adequacy decisions under the GDPR and the LED, which are set to expire on 27 June 2025. The opinion only concerns the proposed 6-month extension of these adequacy decisions and does not address the level of protection for personal data afforded in the UK, which will be examined by the EDPB following the Commission’s assessment, and if the renewal of the UK adequacy decisions is proposed. Since the UK‘s data protection reform is still pending in the UK parliament, the EDPB recognises the need for a technical and time-limited extension of the adequacy decisions until 27 December 2025.This will give the European Commission sufficient time to evaluate the updated UK legal framework once it has been adopted.   The EDPB stresses that this extension is exceptional and is due to the ongoing legislative developments in the UK. It should not, in principle, be further prolonged. The Board recalls the validity of its opinions 14/2021 and 15/2021 on the two UK adequacy decisions, adopted in April 2021, and invites the European Commission to take them into account in its future assessments.  The Board also recalls the Commission’s obligation to monitor all relevant developments in the UK during the extension period.   New observer to the EDPB’s activities Finally, EDPB members agreed to grant observer status to the EDPB’s activities to the Bosnia and Herzegovina Data Protection Authority, in line with Art. 8 EDPB Rules of Procedure .","id":2099053},{"id":1792119,"description":"Brussels, 18 December - The European Data Protection Board (EDPB) has adopted an opinion* on the use of personal data for the development and deployment of AI models . This opinion looks at 1) when and how AI models can be considered anonymous, 2) whether and how legitimate interest can be used as a legal basis for developing or using AI models, and 3) what happens if an AI model is developed using personal data that was processed unlawfully. It also considers the use of first and third party data. The opinion was requested by the Irish Data Protection Authority (DPA) with a view to seeking Europe-wide regulatory harmonisation. To gather input for this opinion, which deals with fast-moving technologies that have an important impact on society, the EDPB organised a stakeholders’ event and had an exchange with the EU AI Office. EDPB Chair Talus said: “AI technologies may bring many opportunities and benefits to different industries and areas of life. We need to ensure these innovations are done ethically, safely, and in a way that benefits everyone. The EDPB wants to support responsible AI innovation by ensuring personal data are protected and in full respect of the General Data Protection Regulation (GDPR).” Regarding anonymity , the opinion says that whether an AI model is anonymous should be assessed  on a case by case basis by the DPAs. For a model to be anonymous, it should be very unlikely (1) to directly or indirectly identify individuals whose data was used to create the model, and (2) to extract such personal data from the model through queries. The opinion provides a non-prescriptive and non-exhaustive list of methods to demonstrate anonymity. With respect to legitimate interest , the opinion provides general considerations that DPAs should take into account when they assess if legitimate interest is an appropriate legal basis for processing personal data for the development and the deployment of AI models. A three-step test helps assess the use of legitimate interest as a legal basis. The EDPB gives the examples of a conversational agent to assist users, and the use of AI to improve cybersecurity. These services can be beneficial for individuals and can rely on legitimate interest as a legal basis, but only if the processing is shown to be strictly necessary and the balancing of rights is respected. The opinion also includes a number of criteria to help DPAs assess if individuals may reasonably expect certain uses of their personal data. These criteria include: whether or not the personal data was publicly available, the nature of the relationship between the individual and the controller, the nature of the service, the context in which the personal data was collected, the source from which the data was collected, the potential further uses of the model, and whether individuals are actually aware that their personal data is online. If the balancing test shows that the processing should not take place because of the negative impact on individuals, mitigating measures may limit this negative impact. The opinion includes a non-exhaustive list of examples of such mitigating measures, which can be technical in nature, or make it easier for individuals to exercise their rights or increase transparency. Finally, when an AI model was developed with unlawfully processed personal data, this could have an impact on the lawfulness of its deployment, unless the model has been duly anonymised. Considering the scope of the request from the Irish DPA, the vast diversity of AI models and their rapid evolution, the opinion aims to give guidance on various elements that can be used for conducting a case by case analysis. In addition, the EDPB is currently developing guidelines covering more specific questions, such as web scraping. Note to editors: *An Article 64(2) opinion addresses a matter of general application or produces effects in more than one Member","source":"EDPB News","pubDate":"Wed, 18 Dec 2024 15:47:16 +0100","url":"https://www.edpb.europa.eu/news/news/2024/edpb-opinion-ai-models-gdpr-principles-support-responsible-ai_en","titre":"EDPB opinion on AI models: GDPR principles support responsible AI"},{"pubDate":"Sun, 28 May 2023 19:23:47 +0200","url":"http://anj.fr/uefa-european-football-championship-and-sports-betting-french-gambling-authority-anj","titre":"UEFA European Football Championship and sports betting: the French Gambling Authority (ANJ) gathers operators and announces a dynamic and structuring action plan","id":719780,"description":"UEFA European Football Championship and sports betting: the French Gambling Authority (ANJ) gathers operators and announces a dynamic and structuring action plan admin lun 13/09/2021 - 16:45 On 20 July 2021, the French Gambling Authority (ANJ) gathered sports betting’s operators in order to make the overview of the European Football Championship that has been scarred by some abuses. Resulting from a constructive exchange, these operators have agreed on the necessity to proceed at a rebalancing of their practices in order to preserve the recreational model of the French gambling market. As such, the ANJ introduced an action plan that seeks to reinforce operators’ compliance, to adapt and complete existing tools and, where required, to use sanctioning procedures. English Questionable practices highlighted during the European Football Championship UEFA European Football Championship 2021 confirmed the growing place of sports bets in France with EUR 434 million of online stakes. The French team matches have aroused a strong popularity by totalling EUR 88 million of online bets, which means an average of EUR 22 million per match. This competition has underlined the existence of questionable practices around sports betting, such as the media hype, the targeting of young people or the excessive stimulation of the game. For the first time, the public debate has seized this very subject and has relayed serious concerns coming from various circles. According to a Harris Interactive inquiry* conducted for the ANJ during the European Football Championship, more than half of those who had seen sports betting ads feel that they are too many of them and close to eight out of ten French people who had seen these ads consider that they can contain a risk of addiction. *Inquiry conducted by Harris Interactive online from the 6 to the 8 July 2021 for the ANJ with a cross section of 1038 French population aged over 18 years old. The ANJ has brought gambling operators together in order to learn from the European Football Championship After having drew the attention of operators on several critical points since June, the ANJ has gathered them on the 20 July in order to do the review of the European Football Championship and to address them the following messages: A yellow line has been crossed in terms of advertising pressure during this competition, which leads to question the model of regulation in place for the past 10 years; it is important to drastically and immediately reduce the sports betting’s advertising pressure. The commercial communications targeting young adults and keeping the illusion of easy money are particularly problematic. As a result of these discussions, which took place in a constructive atmosphere, gambling operators have decided that they collectively share the concerns expressed by the regulator and are prepared to work alongside it in order to propose some improvements and to limit these commercial communications. The ANJ establish an action plan for games offer to remain recreational and well-balanced Given the shared objective of recovery practices between regulator and operators, the ANJ has announced the launch of 5 projects to fight the observed abuses and to clarify or complete the legal framework. These projects should be over by the end of the year. Regarding advertisement: The ANJ has asked operators for a mid-term review of implementation of their promotional strategies as approved by the ANJ’s Board in January 2021 and reserves the right, after examination of these reviews, to initiate sanctions procedures in the event of noncompliance. The ANJ will launch a consultation of stakeholders on advertising in September. This will allow the ANJ to address recommendations to these stakeholders, and if necessary, to propose new tools of intervention. A partnership is initiated with the ARPP (Self-Regulatory Body of Advertising Professionals) in order to decline regulatory restrictions into concrete recommendations for operators. The objective is to issue precise and operational","source":"ANJ"}]