Get tomorrow's brief in your inbox
Today: Complete Payroll Solutions settles a 2024 data breach for $2.6 million with Massachusetts courts approving payouts up to $5,000 for documented losses. The UK's ICO orders a hospital trust to clear its 95-request backlog after compliance dropped to 26%. Federal judges have ruled more than 7,000 times that ICE illegally detained individuals without bond hearings, overwhelming DOJ lawyers who now routinely concede cases without mounting a defense.
ICO Orders UK Hospital to Clear Freedom of Information Backlog
The UK Information Commissioner's Office issued an enforcement notice to Queen Elizabeth Hospital King's Lynn NHS Foundation Trust after its Freedom of Information compliance rate dropped to 26%, leaving 95 requests unanswered beyond the statutory 20-working-day deadline. The enforcement notice under Section 52 of the Freedom of Information Act requires the hospital to respond to all outstanding requests and publish an action plan to prevent future delays. Failure to comply may result in certification to the High Court under Section 54 FOIA, with the possibility of the controller being held in contempt of court.
Italian DPA Fines Classified Ad Platform €5,000 for Unauthorized Personal Data Publication
Italy's Garante per la protezione dei dati personali fined the operator of an online classifieds board €5,000 after an unknown user published another person's phone number in ads for sex work without consent. The DPA found violations of Articles 5, 6, 9, 24, 25, and 32 GDPR. The controller argued its privacy notice prohibited users from posting third-party data without consent, but the DPA ruled this disclaimer does not waive GDPR obligations. The phone number constituted sensitive data under Article 9 GDPR due to the sexual nature of the ad, and inaccurate data may still be sensitive. The DPA ordered the controller to implement measures preventing users from non-consensually disclosing contact details in sexual ads.
Icelandic DPA Reprimands Trade Union Over Unauthorized Salary Data Processing
Persónuvernd (Iceland's DPA) reprimanded a trade union and prohibited it from using an individual's pension contribution data to examine salaries during collective bargaining. The union received an email from a workplace employee containing contribution data for all employees, including non-union members, and incorporated it into a salary analysis table shared with management, the board, and five external recipients. The DPA held the processing violated Article 5(1)(a) GDPR, Article 6(1) GDPR, and Articles 8-9 of Iceland's Data Protection Act. While the union could process member data based on legitimate interest, this interest did not outweigh the data subject's rights. The union also failed to inform the data subject of the processing, its purpose, or recipients.
$2.6M Complete Payroll Solutions Data Breach Settlement (Case No. 1:25-cv-30045-LTS)
Complete Payroll Solutions agreed to a $2.6 million class action settlement to resolve claims it failed to prevent a March 2024 data breach that compromised Social Security numbers, driver's license numbers, financial data, and health insurance information. Under the settlement in Dunn, et al. v. Complete Payroll Solutions LLC in the U.S. District Court for the District of Massachusetts, class members can receive up to $5,000 for documented monetary losses including out-of-pocket credit monitoring costs, unreimbursed fraud or identity theft losses, bank fees, communication charges, and mileage. Each claimant is estimated to receive $100, though amounts may vary by claim volume. All class members receive three years of credit monitoring with one-bureau monitoring, dark web monitoring, $1 million identity theft insurance, and managed identity recovery services.
Supreme Court Sympathetic to Death Row Inmate's Batson Challenge (Pitchford v. Cain)
The Supreme Court heard oral arguments in Pitchford v. Cain, a Mississippi death penalty case examining whether a state supreme court ruling constituted an "objectively unreasonable" application of Batson v. Kentucky regarding racial discrimination in jury selection. Prosecutor Doug Evans eliminated four Black potential jurors at Terry Pitchford's 2004 trial, resulting in a jury with only one Black member in a county that is 40% Black. The Mississippi Supreme Court held Pitchford waived his Batson challenge by not countering the prosecutor's race-neutral explanations at trial. Justice Brett Kavanaugh signaled support for U.S. District Judge Michael Mills' ruling that found no waiver and Batson violations, noting Mills is "a very experienced district judge" who was a former Mississippi Supreme Court justice. Evans previously appeared before the Supreme Court in 2019 when his jury strike prompted reversal of Curtis Flowers' conviction.
Supreme Court Skeptical of Trump Birthright Citizenship Order (Trump v. Barbara)
Multiple news outlets reported the Supreme Court appeared skeptical of the Trump administration's executive order restricting birthright citizenship during April 1 oral arguments. Headlines uniformly described justices as "skeptical" or "doubtful" of the order's constitutional basis. The case tests whether the executive can reinterpret the Fourteenth Amendment's citizenship clause without congressional action.
Federal Judges Issue 7,000+ Rulings Against Illegal ICE Detentions
Federal judges have ruled more than 7,000 times in recent months that ICE illegally detained individuals without providing bond hearings, overwhelming DOJ lawyers who now routinely concede cases. In dozens of cases over several weeks, Justice Department attorneys declined to oppose detainees' release claims, telling judges they "do not have an opposition argument to present" or cannot assemble enough information to mount a defense. DOJ has admitted arrests in immigration courts were illegal. The mass deportation effort combined with mass detention has strained the justice system beyond capacity. While ICE receives billions in new funding, DOJ operates with skeleton crews unable to keep pace with rights violations.
EFF Successfully Defends Web Host Against Baseless Copyright Claim
EFF represented May First Movement Technology after Higbee & Associates and Agence France-Presse demanded payment for a photograph posted by one of May First's member organizations, a Mexico-based human rights group. May First provides web hosting to social justice groups but did not post the image. After May First ensured the member removed the image, Higbee continued demanding payment. EFF explained that service providers lack "volitional conduct" and are not direct infringers when they merely store material at user direction. Higbee withdrew the claim after EFF's response. The case demonstrates how statutory damages up to $150,000 per work incentivize mass demand letters seeking quick settlements even when claims lack merit.
Overstock Class Action Alleges Misleading Email Subject Lines (Case No. 25-2-02400-37)
Four consumers filed a class action in Washington state court alleging Beyond Inc. (doing business as Overstock.com) sends marketing emails with false or misleading subject lines in violation of Washington's Commercial Electronic Mail Act and Consumer Protection Act. The complaint in Crouch, et al. v. Beyond Inc. claims subject lines promise unqualified discounts like "15% off your entire order" without disclosing material exclusions revealed only in the email body. Plaintiffs also allege Overstock falsely states sale durations with phrases like "ends today" or "ends tonight" when offers last longer, then sends additional emails claiming "sale extensions" to inflate inboxes with spam.
Amazon Class Action Alleges Overcharging Florida Consumers on Tax-Exempt Items (Case No. 2:26-cv-00930)
Two Florida residents filed a class action in Washington federal court alleging Amazon unlawfully charged 7% sales tax on purchases of tax-exempt items including baby and toddler products. Florida law exempts cribs, strollers, safety gates, monitors, and clothing for children aged 5 and younger from sales tax. The complaint in Hopkins, et al. v. Amazon.com Inc., et al. argues Amazon adds sales tax charges during checkout despite state prohibitions, misrepresenting to consumers that tax is owed. Plaintiffs allege Amazon's practice violates the Florida Deceptive and Unfair Trade Practices Act and seek damages for fraudulent misrepresentation, unjust enrichment, breach of contract, unconscionability, conversion, negligence, and negligent misrepresentation.
Trump Executive Order Seeks Federal Control Over State Election Administration
President Trump signed an executive order seeking to create federal voter eligibility lists that could restrict mail-in ballots, claiming the measure is "foolproof." The order likely violates the Constitution, which explicitly gives states and Congress, not the White House, power over elections. Top election officials in Arizona and Oregon vowed to challenge the order in court, and voting rights groups plan legal action. The order seeks to expand federal control over state-run elections by imposing federal verification requirements on mail-in ballot eligibility.
FCC Bans Foreign-Made Consumer Routers, Requires Pre-Approval for Imports
The FCC determined foreign-produced routers introduce supply chain vulnerabilities that could disrupt the U.S. economy, critical infrastructure, and national defense, and pose severe cybersecurity risks. Any new router manufactured outside the U.S. now requires FCC approval before import, marketing, or sale. Companies must apply for conditional approval, disclosing foreign investors or influence and submitting a plan to bring manufacturing to the U.S. Routers may be exempted if the Department of Defense or Department of Homeland Security deems them acceptable, but neither agency has added routers to exception lists. Netgear, a U.S. company manufacturing all products abroad, and other popular brands are affected. Starlink WiFi routers manufactured by Elon Musk's SpaceX are U.S.-made exceptions. The policy will increase router costs as U.S. production replaces Chinese and Taiwanese manufacturing.
Merit Systems Protection Board Strips Immigration Judges of Tenure Protections
The Merit Systems Protection Board reclassified immigration court judges as inferior officers subject to at-will removal, eliminating tenure protections. The board concluded immigration judges are inferior officers under the Appointments Clause and their duties are sufficiently significant that Congress may not insulate them from at-will presidential removal. Legal experts argue the decision misreads Supreme Court precedents and overlooks the supervisory framework justifying tenure protections for inferior officers. If upheld, the approach could strip tenure protections from a wide range of career employees.
Trump Administration Undermines Nuclear Regulatory Commission Independence
The Trump administration is rewriting nuclear energy regulations to increase AI data center power capacity, forcing a "move fast and break things" Silicon Valley ethos on the Nuclear Regulatory Commission. President Trump fired NRC Commissioner Christopher Hanson in June 2025 after Hanson spoke out about agency independence, marking the first time an NRC commissioner has been fired. Seth Cohen, a 31-year-old lawyer with no significant nuclear experience who entered government through Elon Musk's Department of Government Efficiency team, told Department of Energy staff to "assume the NRC is going to do whatever we tell the NRC to do." Over 400 NRC staff have left since Trump took office, with losses concentrated in reactor safety, nuclear materials safety, and veteran staff with 10+ years experience. Hiring of new staff has slowed dramatically. Career experts warn the regulatory independence standard is threatened and safety culture is at risk.
Belgian DPA Dismisses Invoice Mailing Complaint Due to Destroyed Evidence (Decision 72/2026)
The Belgian DPA (APD/GBA) dismissed a complaint regarding transmission of third-party invoices after the complainant destroyed the invoices. A customer filed a complaint claiming a company sent them unpaid invoices pertaining to other customers via postal mail. The DPA held that without the invoices, it could not verify if the complainant actually received invoices intended for others or whether those invoices related to natural persons, making it impossible to determine if Article 2(1) GDPR applied. The DPA accepted the controller's claim that this was a one-time human error with no evidence of recurring issues.
French Senate Passes Social Media Ban for Children Under 15
The French Senate voted to ban children under age 15 from social media, positioning France as potentially the first European nation to follow Australia's model. The Senate bill differs from the National Assembly's January legislation by creating two platform categories. One category covers platforms believed to cause physical, mental, or moral harm to children and faces an outright ban. The second category covers less detrimental platforms that children under 15 may use with parental consent. The bill exempts online encyclopedias and educational platforms. The European Parliament proposed a non-binding resolution in November recommending children under 16 not access social media, AI companions, or video-sharing platforms without parental consent, with an outright ban for those under 13. Spain, the Netherlands, and the UK are pursuing similar age restrictions.
State Legislators Propose 3D Printer "Print Blocker" Mandates
Multiple U.S. states are proposing laws requiring "print blockers" on 3D printers to prevent firearm part manufacturing. The mandates would require manufacturers to ensure printers only work with proprietary software implementing firearm detection algorithms using maintained databases of existing models. The requirements extend to CNC machines in some bills and apply to all 3D printing technologies including concrete, resin, metal, and chocolate printers. The proposals would lock users into vendor software, impose ongoing costs on vendors and users, and create a 3D-print censorship platform. Technical experts argue the mandates are unenforceable because 3D printers follow basic G-Code text file instructions with no overall idea of what they print, making detection algorithms ineffective.
Meta Agrees to Reduce PG-13 References After MPAA Dispute
Meta agreed to "substantially reduce" references to PG-13 in Instagram Teen Accounts and add a disclaimer stating the Motion Picture Association did not work with Meta, is not rating Instagram content, and is not endorsing or approving content settings. The MPA issued a cease-and-desist letter and Washington Post op-ed after Meta announced in October that Teen Accounts would feature content moderation "guided by the PG-13 rating." The formal resolution includes a disclaimer noting "lots of differences between social media and movies" and clarifying Meta's content moderation systems are not the same as movie ratings boards. Meta maintains it will continue applying the same content policies but will change how it describes them.
EFF and Google Criticized for Inaction on Project Nimbus Human Rights Risks
EFF submitted evidence that Google and Amazon have failed to address human rights risks posed by Project Nimbus, their cloud computing contract with Israel's Ministry of Defense and Israeli Security Agency. Google's internal assessments warned of risks before the contract was signed, and reporting indicates Google provides advanced cloud and AI services including large-scale data storage, image and video analysis, and AI model development tools. Despite internal warnings and multiple reports about human rights abuses by Israeli government agencies using the services, both companies continue operating without public explanation. Google claims Project Nimbus is "not directed at highly sensitive, classified, or military workloads," but reporting revealed conflicting representations suggesting the Israeli government may use any services in Google's cloud catalog for any purpose. Amazon has completely ignored EFF's letters. Microsoft required a public leak before investigating and confirming the Israeli government misused its services in violation of human rights commitments.
EFF Submits to UN on Digital Threats to Human Rights Defenders
EFF submitted evidence to the United Nations Office of the High Commissioner for Human Rights documenting how cybercrime and national security laws are being applied to prosecute lawful expression, restrict information access, and expand state surveillance of human rights defenders. The UK's Online Safety Act has contributed to global diffusion of "duty of care" frameworks adopted in other jurisdictions with fewer protections, including provisions criminalizing broadly defined speech categories and requiring user identification. Internet shutdowns, throttling, and geo-blocking continue affecting human rights defenders' ability to communicate, document abuses, and access support networks. Spyware and biometric monitoring systems have been deployed against activists and journalists across national borders. Content moderation systems relying on broadly defined policies, automated enforcement, and limited transparency result in removal or suppression of human rights documentation, disproportionately affecting marginalized communities.
Wall Street Journal: Trump Antitrust Enforcers Ousted by Lobbyist Mike Davis
The Wall Street Journal reported that corporate lobbyist Mike Davis ousted the few antitrust reformers in the Trump administration (Gail Slater and Mark Hamer) by pushing DOJ antitrust officials to approve his deals and going over their heads when they refused. DOJ employees, lobbyists, and lawyers report Davis has little antitrust law experience but is "the best fixer in Washington" who knows "the people," "the process," and "pressure points." Current and former antitrust officials report mergers now receive approval or mild settlements based on political ties rather than public interest, casting a shadow over DOJ integrity. Most Lina Khan era DOJ cases have been sabotaged and scuttled, including the Ticketmaster settlement that left state antitrust enforcers stranded.
File Complete Payroll Solutions claims by June 18, 2026. Class members can receive up to $5,000 for documented losses from the March 2024 breach. Deadline for exclusion and objection is May 19, 2026. Final approval hearing is June 25, 2026.
Audit FOIA response times immediately if your organization is a public authority. The UK ICO's enforcement action against Queen Elizabeth Hospital demonstrates that falling below statutory 20-working-day deadlines will trigger regulatory intervention and potential contempt of court proceedings.
Platforms hosting user-generated content must implement technical controls to prevent unauthorized disclosure of third-party contact information. Italy's €5,000 fine against a classifieds board operator demonstrates privacy notice disclaimers do not satisfy Article 24 GDPR accountability obligations when users post sensitive data without consent.
Organizations with detained individuals should file bond hearing petitions immediately. Federal judges have ruled more than 7,000 times that ICE detentions are illegal, and DOJ now routinely concedes cases without opposition. Success rates for habeas petitions are exceptionally high.
Verify FCC approval status for new networking equipment purchases and budget for increased router costs. The foreign-made router ban requires pre-approval for all imports, and U.S. manufacturing will increase equipment prices. Existing routers do not require replacement.