: Brussels, 19 March - The EDPB has launched its Coordinated Enforcement Framework (CEF) action for 2026*. Following a year-long coordinated action on the right to erasure in 2025 , the CEF's focus this year will shift to compliance with the obligations of transparency and information under the GDPR . The GDPR ensures that individuals are informed when their data is being processed (under Art. 12, 13 and 14). This right to be informed is a core element of transparency and ensures that individuals have more control over their data. Next steps During 2026, 25 Data Protection Authorities (DPAs) across Europe will take part in this initiative. They will look closely to assess the compliance of controllers with their transparency obligations under the GDPR. Participating DPAs will soon contact controllers from different sectors across Europe, either through enforcement actions or fact-finding exercises. In the latter case, they might also decide to undertake additional follow-up actions if needed. During the second[...]
: i-Dressup and a data security mess-up lfair April 24, 2019 | 3:08PM i-Dressup and a data security mess-up By Lesley Fair Kids love to play dress-up, but parents wouldn’t want them rummaging through the attic or climbing to the top shelf of the wardrobe without permission and proper supervision. The i-Dressup.com website offered users – including children – a virtual way to play dress-up and design clothes without those potential dangers. But according to an FTC complaint, Unixiz, Inc. , the company behind i-Dressup, violated the Children’s Online Privacy Protection Act in ways that created different kinds of risks. COPPA puts two separate sets of protections in place to help keep parents in control of personal information collected from their kids online. First, COPPA-covered companies must clearly disclose their information policies and get parental consent before collecting personal information from children under 13. Second, companies must provide reasonable and appropriate security for the data they coll[...]
: Background information Date of final decision: 15 May 2025 National case Controller: SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of 10 000 € per day overdue after a period of 9 months Key words: administrative fine, consent, unsolicited communication Summary of the Decision Origin of the case As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the cha[...]
: Background information Date of final decision: 15 May 2025 National case Controller: SOLOCAL MARKETING SERVICES Legal Reference(s): Article 7 (Conditions for consent), Article 6 (Lawfulness of processing) Decision: administrative fine and an order to cease electronic commercial prospecting in the absence of valid consent, together with a penalty of €10 000 per day overdue after a period of 9 months Key words: administrative fine, consent, unsolicited communication Summary of the Decision Origin of the case As the French Supervisory Authority (SA) made commercial prospecting a priority topic for investigations in 2022, it focused on the practices of professionals in the sector, particularly those who resell data, including the many intermediaries in this ecosystem known as data brokers. The French SA carried out investigations on SOLOCAL MARKETING SERVICES which got prospect data mainly from data brokers, publishers of game contests and product testing sites (these actors are the first links in the chai[...]
: Brussels, 18 February - The European Data Protection Board (EDPB) has adopted a report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR) . The Board selected this topic as it is one of the most frequently exercised GDPR rights and one about which DPAs frequently receive complaints from individuals. The main objectives of this coordinated action are to ensure that the right to erasure is effectively exercised by individuals in Europe and understand how controllers comply with this right in practice. In addition, the EDPB identified good practices and the most important related challenges, with the aim of providing further guidance on this topic. Throughout 2025, 32 DPAs across Europe took part in this initiative. More specifically, 9 DPAs have initiated new formal investigations or have continued ongoing ones, and 23 DPAs carried out a fact-finding exercise. A total of 764 controllers across Europe responded to the action, ranging from small and medium-sized[...]
: Le dossier thématique du troisième numéro de Balisages questionne les données au prisme du territoire. Mobiliser la notion de territoire numérique pour caractériser le cyberespace, défini comme un espace numérique construit par l’ensemble des systèmes d’information planétaires (Musso, 2008) et des données qui le constituent, ouvre la voie à de nombreuses hypothèses de recherche. Le territoire numérique a-t-il un potentiel heuristique pour étudier le cyberespace comme système de données ? Quels seraient les savoirs constitutifs du ou des territoires numériques ? Enfin, l’expérience du cyberespace, telle qu’elle est vécue par les cybernautes, structure-t-elle et détermine-t-elle la notion de territoire numérique ? The concept of digital landscape is mainly used to refer to town and country planning projects using digital networks and data collection and processing projects related to a geographical space (town, city, etc.). In other words, the digital landscape is often reduced to a digitally accompanied te[...]
: Keep FCRA in the foreground when the subject is background screening chundycz April 9, 2014 | 12:13AM Keep FCRA in the foreground when the subject is background screening By Lesley Fair When the talk turns to Big Data, part of the conversation is about all the public information available about people's lives – and how companies market it to prospective employers, landlords, etc. Two cases just announced by the FTC serve as a cautionary reminder to members of the industry that what they do may be subject to the long-standing consumer protections of the Fair Credit Reporting Act (FCRA) . InfoTrack, an Illinois company, and San Diego-based Instant Checkmate will be paying civil penalties to settle FTC lawsuits that they violated the FCRA. Is it time for an FCRA refresher at your business? Instant Checkmate marketed its reports as a way for prospective employers and landlords to investigate applicants. For example, the company advertised that one of the “GOOD REASONS to get instant criminal checks on anyo[...]
: The Federal Trade Commission’s initial findings from its surveillance pricing market study revealed that details like a person’s precise location or browser history can be frequently used to target individual consumers with different prices for the same goods and services. The staff perspective is based on an examination of documents obtained by FTC staff’s 6(b) orders sent to several companies in July aiming to better understand the shadowy market that third-party intermediaries use to set individualized prices for products and services based on consumers’ characteristics and behaviors, like location, demographics, browsing patterns and shopping history. Staff found that consumer behaviors ranging from mouse movements on a webpage to the type of products that consumers leave unpurchased in an online shopping cart can be tracked and used by retailers to tailor consumer pricing. “Initial staff findings show that retailers frequently use people’s personal information to set targeted, tailored prices for goods[...]
: The Federal Trade Commission is taking action against Illusory Systems Inc. for failing to implement adequate data security measures, leading to a major security breach in which hackers stole $186 million from consumers. Under a proposed order settling the FTC’s allegations, Utah-based Illusory, which does business as Nomad, will be required to implement an information security program to address numerous alleged security failures and to return recovered money to affected consumers. “The FTC Act requires companies to take reasonable security measures,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “It’s important that companies live up to their security promises to consumers.” In its complaint , the FTC alleged that Nomad prominently touted its security in its advertising, claiming that it offered “security-first” services. The FTC, however, alleged that the company failed to live up to these promises by failing to: use secure coding practices; implement processes for recei[...]
: Stick with Security: Require secure passwords and authentication lfair August 11, 2017 | 10:47AM Stick with Security: Require secure passwords and authentication By Thomas B. Pahl, Acting Director, FTC Bureau of Consumer Protection To make it harder for hackers to bluff their way onto a computer network, careful companies follow the advice of Start with Security and require strong authentication practices . We’ve considered FTC settlements, closed investigations, and the questions we get from businesses about implementing good authentication “hygiene.” Here are some tips on using effective authentication procedures to help safeguard your network. Insist on long, complex, and unique passwords. A password’s very reason for being is to be easy for a user to remember, but hard for a fraudster to figure out. Obvious choices like ABCABC, 121212, or qwerty are the digital equivalent of a “hack me” sign. Furthermore, experts have determined that passphrases or longer passwords are generally harder to crack. The smar[...]
: This article belongs to the debate » Thinking Machines, Thinking Lawyers14 October 2026The (Currently) Uneven Intelligence of AI in Comparative Constitutional Law From Years of Research to a Single Prompt? Artificial intelligence (AI) has the potential to accelerate and improve the quality of research. This potential has inspired numerous projects exploring how AI could help scholarship on constitutional law. For example, there is research using AI to interpret constitutions,1) apply constitutional principles,2) and predict court rulings.3) Even the question of whether AI could improve the process of constitution-making has been studied.4) AI’s potential is particularly significant for comparative constitutional research. Systematically comparing legal systems requires locating sources from different jurisdictions, which are often difficult to access and only available in local languages. The creation of comparative legal datasets has thus involved considerable personnel, time, and financial resources. AI ca[...]
: New data from the Federal Trade Commission reveal that people reported losing a staggering $3.5 billion to imposter scams in 2025, with reported losses increasing nearly three times since 2020. FTC data also show that people reported imposter scams more than any other fraud category in 2025—nearly one in three fraud reports were about imposter scams. These scams lured consumers through text, phone, email, social media, search engine results and other means. Some of the costliest impersonation scams start with a fake security alert, often from a bank. People are convinced to move money to “protect” it, with their losses often limited only by their available funds. Last year, people reported losing nearly $1 billion to business impersonators with the highest reported losses to bank impersonators—and about $920 million to government impersonators, up from $866 million and $789 million respectively in 2024. The FTC has seen a striking increase in reported fraud losses to all types of fraud—about $16 billion was [...]
: Practice Fusion case suggests 6 health privacy pointers lfair June 8, 2016 | 9:01AM Practice Fusion case suggests 6 health privacy pointers By Lesley Fair Combine two of the most talked-about consumer protection topics – health privacy and consumer-generated online content – and what do you get? A proposed FTC settlement with Practice Fusion, the largest cloud-based electronic health records company in the country, and six compliance tips for others in the industry. One of San Francisco-based Practice Fusion’s primary products is an electronic records system for outpatient providers. In 2009, the company launched “Patient Fusion,” an online portal where patients whose providers were already using Practice Fusion could view or download their health information or transmit it to another provider. Patient Fusion also let patients send and receive secure messages from their providers. Fast forward several years and the company decided to expand Patient Fusion to include a public directory where current and prosp[...]