OneTrust DataGuidance

🛣️ GM agreed to a $220M multistate settlement over allegations it sold identifiable driver data. Terms require affirmative consent, less data collection, and an independently assessed privacy program. bit.ly/3U2CV52

🚗 Lyft will pay $1.8M to settle AG allegations over CCPA opt-out barriers. The deal requires an in-app opt-out and consumer notices. The AG alleged users had to visit an external site and re-enter credentials. bit.ly/4ioVlGx

EDPS breach FAQs: ⏱️ Assess when reasonably certain 📝 Document low-risk breaches 📨 Use phased reports as facts emerge 📣 Notify people promptly if risk is high 👤 Controllers remain responsible bit.ly/4e2n25o

📊 FTC ordered nine airlines, rideshare, and delivery companies to disclose how data shapes prices and worker pay. They have 45 days to provide the inputs, methods, and criteria used. bit.ly/3W3ojmz

🔐 NIST’s post-quantum guidance urges cryptographic inventories, supply-chain reviews, and phased migration. Federal systems: 2035 migration deadline, with earlier dates for key establishment and signatures. bit.ly/3TYUXoM

🇪🇸 AEPD guidance for AI assistants and agents: 🔐 Grant only task-needed access 🙋 Confirm before purchases or sharing 🧠 Review retained memory and data use ⏹️ Use clear stop controls and activity history bit.ly/48jvzNL

⚖️ OpenAI petitioned the BC Supreme Court over an OIPC order for records tied to the Tumbler Ridge shooting. The inquiry concerns ChatGPT’s personal-data processing and OIPC jurisdiction under PIPA. bit.ly/4yRaTaF

🇵🇱 Poland updated DDoS guidance for ISPs: 📡 Monitor traffic; tailor filtering and rate limits 🧭 Prepare continuity plans and independent network access 🚨 Report incidents through required channels bit.ly/4zeljT2

🇨🇦 Loblaw committed to notify people affected by a cyberattack, assess safeguards, and report progress to Canada’s OPC. The letter isn’t a liability admission or PIPEDA finding; the inquiry remains open. bit.ly/4zRAd1d

🇸🇮 Slovenia’s IP treats outdoor storage as workplaces when staff work there. 📹 Cameras only if necessary, with no less-invasive option 📝 Document grounds before use 📣 Notify staff; consult worker reps bit.ly/4z7D71W

⚠️ Texas AG sued OpenAI, alleging deceptive AI practices and failures to protect children, including inadequate age checks and risk disclosures. The AG seeks injunctions and civil penalties. bit.ly/4igRVnM

🍁 Canada’s OPC’s AI transparency submission calls for clear information on: 🤖 AI-generated content and interactions 🧩 Systems and incidents 🕵️ AI agents bit.ly/4jGDwUn

🇪🇺 Council’s proposed GDPR Article 88bis would allow AI data processing on legitimate-interest grounds, with safeguards. noyb warns of an advantage for major tech developers. Trilogues are still ahead. bit.ly/4iGcWtl

⚖️ A New Mexico court ordered Meta to pay $25B over deceptive data practices linked to Cambridge Analytica. The judgment cites 43.9M state-law violations, with interest accruing at 15% annually. bit.ly/4dWzXFL

🇨🇦 Canada’s OPC launched a Children’s Privacy Code. 👪 Parental consent under 13 ⚙️ Privacy by default 🚫 No commercial profiling or AI decisions for minors 💬 Comments open until Jan. 20, 2027 bit.ly/4z3QH6l

🇪🇺 EU Council agreed its negotiating position on the Digital Omnibus proposal. It would clarify GDPR, AI data-processing, cookie, and incident-reporting rules. Final law is still pending. bit.ly/4jD1EqP

🇨🇳 China’s CAC launched recognition for platforms influential among minors. Platforms with 10M+ registered or 1M+ active minor users must submit applications and self-assessments within 20 working days. bit.ly/4zF6OHw

🇧🇷 Brazil’s ANPD gave Meta five business days to explain account suspensions and content removals across its platforms. It cited unclear criteria, weak explanations, and improper blocks under Brazilian rules. bit.ly/47y5kmA

🇸🇪 Sweden’s PTS supports the proposed EU Cloud and AI Act’s capacity goals. ⚠️ It warns of higher costs and urges market analysis plus recognition of domestic cloud services. bit.ly/3U5q5Ty

🧬 HHS reached a $700K HIPAA settlement with Ambry Genetics after phishing exposed PHI of 225,370 people. The two-year plan covers risk analysis, access controls, policy updates, and workforce training. bit.ly/4BhVzGG