GoKawiil
Tech News
Ireland's Data Protection Commission concluded a five-year inquiry into how Google Ireland handled location data across Web & App Activity, Location History and Location Accuracy features between 2018 and 2020. The regulator found multiple GDPR violations spanning lawfulness, transparency, accountability and data retention, and has fined the company €403 million while giving it six months to fix its practices.
Ireland's Data Protection Commission fined Google €403 million ($463 million) after a multi-year investigation into how it handled location data through Web & App Activity, Location History, and Location Accuracy features between 2018 and 2020. Regulators found Google failed to meet GDPR transparency and lawfulness requirements and violated data retention rules for two of the three features. Google must bring its location data practices into compliance within six months and says it has already updated its policies since 2019.
Ireland's Data Protection Commission has imposed a €403 million ($463M) fine on Google following a probe into three features—Web & App Activity, Location History, and Location Accuracy—that operated during the GDPR's early enforcement window from May 2018 to February 2020. The regulator concluded Google failed to properly justify its processing of location data and kept that data longer than necessary, while also falling short on transparency requirements across all three tools.
Waymo has started manually driving and mapping all regions of Singapore around the clock, gathering data it needs to seek approval from the Land Transport Authority for autonomous operations by 2027. Initial runs will use human specialists behind the wheel, with the company promising public notice before shifting to autonomous-specialist and eventually fully driverless operations. Data collected will be handled under Singapore's Personal Data Protection Act and Waymo's own privacy policy.
Apple appeared before a UK court seeking to overturn secrecy rules that bar it from confirming whether the government has ordered access to encrypted iCloud data. The case follows reports that Britain had secretly demanded a backdoor into encrypted iCloud content, a demand Apple responded to by pulling Advanced Data Protection for new UK users rather than weakening encryption globally. After the U.S. government pushed back, Britain narrowed its original worldwide request but later issued a fresh notice aimed specifically at UK-based Apple users.
Spain's Data Protection Agency (AEPD) has received its first notification of a breach allegedly executed by an autonomous AI agent built on a large language model. According to the report, the agent found system vulnerabilities, logged in, probed connected applications, then altered personal data and accessed financial records. The AEPD has not yet verified the claims but says the case demonstrates that AI-driven breaches have moved from theory to practice.
Senator Ron Wyden and Congressman Warren Davidson sent a letter to Britain's Investigatory Powers Tribunal demanding it stop concealing details of Apple's dispute with the UK government over encrypted iCloud data. The case began when the Home Office ordered Apple to build backdoor access to encrypted backups worldwide, prompting Apple to pull its Advanced Data Protection feature for UK users; the tribunal later dismissed Apple's challenge after the UK narrowed its demand to British users only.
A developer found that copying the login.keychain-db file from one Mac to another no longer works on macOS Tahoe when the destination Mac has a Secure Enclave chip. Previously, users could transfer this SQLite-based keychain file and unlock it on a new machine simply by entering the correct password, but that method now fails.
A commentary argues that the widespread criticism of GDPR, especially over cookie consent banners, misreads what's happening. The author contends that companies deliberately designed those banners as confusing dark patterns to frustrate users into clicking 'accept,' not because the regulation demanded it, and that this design choice is being unfairly blamed on the law itself.
As sleep monitoring devices become more widespread and sleep-enhancement technology moves from treating disorders to optimizing rest, employers and institutions are gaining new tools to measure and potentially demand better sleep from workers. A 2016 Dutch Data Protection Authority ruling already found that companies tracking employees' sleep via wearable devices violated privacy law, since such data counts as sensitive health information and consent from employees can't be truly voluntary given workplace power imbalances.
The Dutch Data Protection Authority fined Uber roughly $966 million after finding that between 2018 and 2022 the company suspended European drivers using automated systems without meaningful human review, violating GDPR's Article 22 protections against purely automated decisions with significant consequences. The case stemmed from a 2020 complaint filed with France's CNIL by La Ligue des droits de l'Homme on behalf of over 170 drivers, and was handled by Dutch authorities since Uber's main EU base is in Amsterdam. Uber plans to appeal, arguing that fraud suspensions were brief, permanent deactivations always involved human review, and drivers had appeal options.
The Dutch Data Protection Authority has fined Uber roughly $966 million for deactivating driver accounts through automated systems without adequate human review or warning, marking one of the largest penalties issued under GDPR. The investigation stemmed from complaints, including one from former French Uber driver Brahim Ben Ali, who gathered testimony from 170 other drivers alleging similar treatment. Uber disputes the regulator's findings and plans to appeal the fine.