The Personal Information Protection Commission has opened a public consultation on an overhaul of the country’s privacy protection framework, a review prompted in part by the widening distance between rules built around consent and forms of data processing that have become considerably harder to explain, much less reduce to a series of yes-or-no decisions.
Pokémon Center is notifying customers in the United Kingdom and Germany that personal and order information may have been exposed in a cyberattack on CEVA Logistics, the third-party provider it uses to fulfill and ship orders in those markets.
For a long time, deleting data could feel strangely reckless. Storage was cheap, and information was potentially valuable. The cost of keeping another year of customer records, internal correspondence, transaction histories or old documents was difficult to see, while the cost of deleting the wrong thing was easy to imagine. So companies kept it. Some of it was retained for legal or operational reasons, some because nobody was quite sure whether it could safely be destroyed, and some because of the most durable retention policy in corporate life: we might need it someday.
Uber Freight says its logistics business is investigating a cybersecurity incident after the hacking and extortion group Helix claimed it had stolen data from the company, according to Reuters, which first reported the incident. An Uber Freight spokesperson told Reuters there had been no impact on business operations and that its systems were operating normally.
South Korea’s Personal Information Protection Commission has imposed a $37.4 million (KRW 53.979 billion) administrative fine on KT after concluding that failures in the telecom company’s security controls allowed attackers to reach its internal network and expose the personal information of 16,647 subscribers. The regulator also ordered KT to correct the deficiencies and publish the results of the sanctions, while recommending broader improvements to its privacy program.
The Information Commissioner's Office did not describe the Metropolitan Police Service's latest data protection failures as isolated mistakes. After investigating two unrelated disclosures of highly sensitive personal information, the regulator concluded that both pointed to the same underlying problem: basic safeguards had been allowed to weaken inside one of Britain's largest police forces.
Italy's data protection authority has fined telecommunications provider TIM €9.516 million, concluding that failures in the company's telemarketing operation extended well beyond nuisance calls. According to the regulator, unauthorized call centers funneled unlawfully obtained customer information into TIM's legitimate sales network, exposing weaknesses in the company's oversight of third-party partners and turning illegally obtained contacts into apparently valid customer contracts.