Get tomorrow's brief in your inbox
Today: Spain fined 23andMe €2.4 million ($2.7 million) for cybersecurity failures enabling a 2023 breach affecting 6.9 million users worldwide, citing lack of mandatory MFA and credential stuffing protections under GDPR. Apple faces a new BIPA class action over Face ID biometric collection, while a Florida federal judge found ICE violated over 116 court-ordered bond hearings by relocating detainees outside the Southern District. California and 11 states secured a 14-day restraining order blocking the $111 billion Paramount-Warner Bros merger on antitrust grounds.
Spain fines 23andMe €2.4 million for GDPR violations enabling 2023 data breach
Spain's Agencia Española de Protección de Datos (AEPD) levied a €2.4 million ($2.7 million) fine against 23andMe for cybersecurity failings that enabled an April 2023 credential stuffing attack affecting 6.9 million users worldwide, including over 2,600 Spanish residents. The regulator found 23andMe violated GDPR requirements by failing to implement mandatory multifactor authentication, failing to limit data access per IP address, and delaying breach notification to Spanish authorities by 12 days. The decision noted that 23andMe's own May 2023 fiscal report extensively cited ransomware and cybersecurity threats as material risks, yet the company's privacy policy included only one reference to password credentials with no strength requirements or periodic change mandates.
Florida federal judge finds ICE violated 116+ court orders by relocating detainees
U.S. District Judge Michael Moore found Immigration and Customs Enforcement violated at least 116 court orders by transferring detainees with pending habeas corpus petitions out of the Southern District of Florida without notifying the court. The violations came to light after brush fires in Miami-Dade County forced the evacuation of an ICE detention facility, initially revealing 47 violations. Following Judge Moore's order for a deeper review, DOJ attorneys reported the full scope included relocations occurring both before and after the wildfires, with some detainees removed from the United States entirely despite pending bond hearing orders. The violations occurred despite an Eleventh Circuit ruling two months prior mandating bond hearings for all detained migrants.
$1.8 million Serviceaide data breach class action settlement approved
A $1.8 million class action settlement received final approval for individuals affected by the Serviceaide data breach. The settlement provides cash payments to class members impacted by the security incident involving the IT service management company.
Apple faces BIPA class action over Face ID and Attention Features
A new class action lawsuit alleges Apple violated Illinois' Biometric Information Privacy Act (BIPA) by unlawfully collecting biometric data from customers using Face ID and Attention Features without proper consent and disclosures. The complaint claims Apple's facial recognition systems capture and store biometric identifiers without meeting BIPA's informed consent, retention policy, and data destruction requirements.
Supreme Court limits Roundup cancer lawsuits under federal pesticide law
The U.S. Supreme Court ruled 7-2 on June 25 that the Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA) preempts state tort lawsuits claiming Roundup weed killer causes cancer. The decision affects ongoing litigation against Monsanto and parent company Bayer by establishing that federal pesticide labeling law blocks state failure-to-warn claims, even as Bayer continues negotiating settlements with existing plaintiffs.
California blocks Paramount-Warner Bros merger with 14-day restraining order
Judge Araceli Martinez-Olguin granted a 14-day restraining order blocking consummation of the $111 billion Paramount-Warner Bros merger after California and 11 other states filed an antitrust lawsuit. The court found "serious questions going to the merits remain" regarding whether the consolidation would harm market competition, lead to layoffs, increase consumer prices, and reduce product quality as the merged entity attempts to manage substantial debt. Paramount faces a "ticking fee" of approximately $7 million per day owed to shareholders if the deal is not closed by September 30, creating significant financial pressure as antitrust litigation proceeds.
xAI sues user over Grok-generated CSAM under indemnification clause
xAI filed suit against user Terry Harwood in the Northern District of Texas (Wichita Falls Division) seeking indemnification for lawsuits filed by Harwood's victims after he allegedly used Grok to create over 7,000 child sexual abuse material images. The lawsuit invokes the terms of service indemnification clause while xAI simultaneously faces multiple lawsuits from victims alleging the company should be liable for non-consensual imagery generated by its AI tool. One victim's complaint alleges xAI submitted only the original authentic image to NCMEC, not the thousands of AI-generated derivatives, and failed to provide IP address information to law enforcement.
Senate Intelligence Committee approves DNI nominee Jay Clayton along party lines
The Senate Intelligence Committee voted 9-8 along party lines to advance Jay Clayton's nomination for Director of National Intelligence to the full Senate. Clayton, who chaired the Securities and Exchange Commission during the first Trump administration, testified he had no involvement with President Trump's recent primetime address claiming foreign election interference. Democrats expressed concerns about politicization of the intelligence community after Clayton refused to acknowledge Joe Biden's 2020 election victory. The confirmation could enable bipartisan legislation to renew Section 702 of the Foreign Intelligence Surveillance Act (FISA), which expired last month while acting director Bill Pulte remained in office without intelligence experience.
DHS offers $2,600 and free flights to TPS holders after Supreme Court ruling
Department of Homeland Security General Counsel James Percival urged Temporary Protected Status holders with expiring designations to accept $2,600 and free flights for voluntary departure before legal status officially lapses. The announcement follows the Supreme Court's June 25 decision in a TPS case holding that administration decisions to terminate the program are not subject to judicial review, clearing the way for the Trump administration to end removal protections for Syrian and Haitian nationals. Business organizations, labor unions, and immigrant advocacy groups warned the termination of work authorization for TPS holders will have sweeping economic consequences.
Taiwan to throttle mobile data during August civil defense drills
Taiwan's National Communications Commission announced mobile 4G and 5G data speeds will be reduced to approximately 1% of normal capacity for 30 minutes during August Urban Resilience Exercises in 14 northern and central cities and counties. The drill is designed to test alternative communication channels if mobile networks become unreliable during military conflict or natural disasters. Voice calls, text messages, emergency alerts, and calls to emergency services will continue functioning, while fixed broadband, WiFi, landlines, and military communications remain unaffected. Authorities advised residents to download offline maps, switch to WiFi for scheduled meetings, and establish backup family contact plans.
DHS plans to triple border surveillance towers to 2,300 by 2034
A Government Accounting Office report reveals the Department of Homeland Security plans to expand Customs and Border Protection's Integrated Surveillance Tower (IST) program from 830 to 2,300 towers by 2034 at a cost of over $1 billion from the 2025 "One Big Beautiful Act." The expansion includes autonomous surveillance towers using AI-based radar, thermal infrared, and optical systems to track targets over long distances, integrated fixed towers for foot and vehicle traffic, and remote video surveillance systems near border fences capable of monitoring homes on both sides of the U.S.-Mexico border. The surveillance infrastructure also encompasses drones, aerostats, ground sensors, game cameras, and license plate readers deployed by federal, state, and local law enforcement.
Flock Safety ends Distress Detection audio surveillance pilot
Flock Safety announced it will discontinue its "Distress Detection" feature after community consultation and civil liberties concerns raised by EFF and privacy advocates. The feature, originally marketed as searching for "screaming" (later amended to "distress"), would have used high-powered microphones in acoustic gunshot detection devices to identify signs of human distress. Flock's Audio Detection devices continue operating to detect gunshots and "community disruption" including car sideshows and fireworks, despite documented accuracy issues that have resulted in police shooting at children lighting fireworks in Chicago.
MIT deploying over 500 AI surveillance cameras across campus
MIT is spending over $3 million to install more than 500 AI surveillance cameras in academic buildings, residence halls, and outdoor areas along Memorial Drive. The Hanwha Wisenet AI cameras support resolutions from 2MP to 4K and use deep learning algorithms for real-time face and object classification, including detection of motion, loitering, crowds, face masks, and camera tampering. The system can automatically classify individuals by clothing color, gender, and age up to 35 feet away, with collected data retained up to 30 days unless exceptions are granted. The cameras will be monitored continuously with Ai-RGUS AI camera software and support wide-range pan, tilt, rotate, and zoom capabilities.
Federal Judicial Center withdraws climate science chapter from judges' manual
The Federal Judicial Center removed a climate science chapter from the updated "Reference Manual on Scientific Evidence" used by federal judges in cases involving complex scientific topics. The withdrawal followed President Trump's Truth Social demand for review of the manual, which he claimed was influenced by "Political Fraud and False Science on Climate." During congressional testimony, Justice Elena Kagan, who wrote the manual's foreword, stated she had not read the withdrawn chapter and that the judge managing the project is working with Congress to improve Federal Judicial Center processes to prevent similar situations.
Supreme Court reinforces Bruen history-and-tradition test in Wolford v. Lopez
The Supreme Court in Wolford v. Lopez struck down Hawaii's law requiring licensed gun carriers to obtain property owner permission before bringing firearms onto private property open to the public. Justice Samuel Alito's 6-3 majority opinion held the law "unquestionably imposed a new and significant burden" on Second Amendment rights and rejected Hawaii's reliance on an 1865 Louisiana Black Code as a historical analog, calling it a "tainted artifact" whose invocation "cannot be taken seriously." Justice Amy Coney Barrett's concurrence confirmed that courts should not "smuggle additional limits" into the plain-text stage of Bruen's analysis, while Justice Ketanji Brown Jackson's dissent (joined by Justice Sonia Sotomayor) charged the majority with "cavalierly pick[ing] and choose[ing] which parts of the historical record count."
Organizations subject to GDPR handling sensitive personal data must implement mandatory multifactor authentication, rate-limit data access by IP address, and notify supervisory authorities within 72 hours of breach discovery. Review and strengthen password policies with documented requirements.
Employers should audit workforce for TPS holders whose work authorization may expire following the Supreme Court's June 25 decision allowing termination of the program. Consult immigration counsel on I-9 reverification timelines and obligations.
Companies deploying facial recognition or biometric authentication in Illinois must comply with BIPA's written consent, retention schedule disclosure, and public policy publication requirements under 740 ILCS 14/15 before collecting biometric identifiers.
Federal agencies and contractors subject to court jurisdiction must establish notification procedures when relocating individuals with pending litigation and audit compliance with jurisdictional restrictions following the Southern District of Florida's findings of 116+ violations.
Educational institutions and organizations deploying AI-powered surveillance systems should conduct privacy impact assessments, establish and publish data retention policies, and evaluate compliance with state biometric privacy laws and applicable student/employee privacy regulations.