Data processing begins even before the data is received. A recent ruling of the Supreme Court of Spain clarifies the scope of GDPR obligations and the implications extend to the United States as well.
In STS 1590/2026 (Judgment No. 390/2026,
Latest from Privacy Compliance & Data Security - Page 2
When AI Meets the FCRA: What the Eightfold Class Action Means for Employers and HR Technology Providers
An estimated 87% of companies now using AI-driven tools in their recruitment processes, and that figure has nearly doubled in just two years. AI-powered platforms can ingest millions of candidate profiles, enrich them with publicly available data, and deliver algorithmically
Employee Privacy Rights Under CCPA: CalPrivacy Calls for Comments
Among US states, California is the only one that treats employees as full “consumers,” providing them the right to an employee notice and an applicant notice and employee rights. While California enforcement has not yet focused squarely on employer practices,
Your Website’s Pixels May Be Wiretaps: 10 Questions Every Business Should Ask About CIPA
The plaintiffs’ bar has been ramping up lawsuits under the California Invasion of Privacy Act (CIPA) and federal and state wiretapping statutes for years, and the wave is not receding. Tens of thousands of claims have been filed since 2022,
Your Cookie Banner Might Be Working Against You: Two Compliance Traps to Avoid
The plaintiffs’ bar has been ramping up lawsuits for alleged violations of state and federal wiretapping laws (e.g., California CIPA, Florida SCA, Federal ECPA) for many months now. Historically, the main issue has been that the defendant did not get
For Whom the Discovery Tolls: Your Privacy Notice May Help Time-Bar Website Wiretapping Claims
In a recent decision out of the Northern District of California, the court held that a website operator’s privacy policy, even one presented in a passive, browse wrap-style hyperlink, can defeat the delayed discovery doctrine and render claims under the
Platform liability after Russmedia: Italian DPA Fines Platform for Allowing Phone Number in Sex Work Ads Without Consent
By Odia Kagan
How far does a platform’s responsibility extend when a user posts someone else’s personal data in a classified ad, especially one involving sensitive subject matter like sex work? The Italian Data Protection Authority (Garante) recently fined online
Court Allows Sharing of Medical Information Claim to Proceed Under ECPA
A new federal court decision denied a motion to dismiss in a case alleging Federal Electronic Communications Privacy Act (ECPA) claims arising from the sharing of health information through a website’s online tracking technology. What does this case teach and
FTC’s New Strategic Plan: Reports of the Death of FTC Privacy Enforcement Have Been Greatly Exaggerated
The FTC just published its Strategic Plan for FY 2026–2030. What does it actually mean for privacy compliance? Quite a lot, as it turns out. Here’s a breakdown.
Telemarketing
Still a top priority. The plan doubles down on unlawful
What Hospitality HR, Operations and Leadership Need to Know About Data Privacy and AI
As hospitality businesses increasingly rely on digital tools, automation, biometrics, and AI‑enabled services, their collection and use of personal data has expanded significantly. With that expansion comes a corresponding rise in legal and regulatory obligations – and risks.
Below are