Law and legal tech, in three minutesGet the 7 a.m. briefDaily Brief PodcastMenu

Practice areas

Data protection

Every story on LexCircuit filed under data protection: court orders, regulation, ethics opinions, litigation and research, each summarized across its sources.

74 stories

CANADABreaches and incidents

McCarthy Tétrault hit by data breach exposing client files

McCarthy Tétrault, one of Canada's largest corporate law firms, said an unauthorized third party gained access to certain files, including client information, in a cybersecurity incident it identified late on October 22. The firm said it is working with a cybersecurity firm, contacted affected parties on October 25, and notified law enforcement and professional regulators. The Globe and Mail, which first reported the breach, later said Davies was also hit and thousands of files in total were compromised.

Report (The Globe and Mail) → · McCarthy Tétrault
CANADABreaches and incidents

Davies confirms cyberattack as Canada's Cyber Centre warns of vishing campaign against law firms

Toronto-based Davies Ward Phillips & Vineberg said an October 23 cyberattack compromised information from one account, making it the second Bay Street firm to confirm a breach this month. The Canadian Centre for Cyber Security warned on October 28 of an ongoing campaign in which callers pose as internal IT support to steal credentials, with October activity concentrated on the legal sector.

Report (The Globe and Mail) → · Canadian Centre for Cyber Security
N.Y.Regulation

Hochul signs New York law banning unsafe AI chatbot features for minors

New York Gov. Kathy Hochul has signed S.9051-B/A.10379-C, which bars chatbot developers from offering minors features that pretend to be human, encourage self-harm or engage in sexual conversations. Providers must verify users' ages with multiple methods and delete age data afterward. The attorney general can seek civil penalties of up to $25,000 per violation. The law takes effect on January 1, 2027.

Text (Bloomberg Government) → · IAPP
N.Y.Regulation

New York S.9508 requires security features and warning labels on internet-connected baby monitors

New York Governor Kathy Hochul signed Senate Bill 9508 (Chapter 367 of 2026) on October 28, 2026, adding General Business Law section 399-iii for internet-connected baby monitors. The law bars manufacture, distribution, sale or offering for sale of a new monitor that broadcasts audio or video over the internet unless it includes security features preventing unauthorized hearing or viewing and a warning label. The act takes effect January 26, 2027, ninety days after signing.

Enrolled text (New York State Senate) → · Utica Phoenix
U.S. FEDBreaches and incidents

Baker McKenzie and Troutman Pepper Locke disclose social engineering data breaches

Baker McKenzie and Troutman Pepper Locke have filed data breach notices with state attorneys general after social engineering attacks in August. Baker McKenzie said a threat actor deceived two users on August 14 and 17 and obtained a limited number of files. At Troutman, an employee targeted on August 7 sent documents to an unauthorized person. Both firms said their systems were not otherwise accessed and are offering 24 months of credit monitoring.

Report (Law360 Pulse) → · California Attorney General
U.S. FEDCourt order

Fourth Circuit strikes down West Virginia Daniel's Law in suits against Thomson Reuters, LexisNexis

The Fourth Circuit affirmed a ruling that West Virginia's Daniel's Law, which restricts publishing the home addresses and phone numbers of judicial and law enforcement officials, violates the First and Fourteenth Amendments. A former state law enforcement officer had sued Thomson Reuters America, LexisNexis Risk Solutions and other people-search providers under the law. The court said the statute's lack of a notice requirement, which similar laws include, was fatal.

Order (Bloomberg Law) → · National Law Journal, Law360
INDIA · SCILitigation

India's Supreme Court seeks government reply to publishers' data protection law challenge

The Supreme Court of India on October 27, 2026, issued notice to the central government on a petition by the Digital News Publishers Association, representing 21 digital news publishers, challenging the Digital Personal Data Protection Act, 2023, and its 2025 rules. The publishers argue the law lacks a journalism exemption. The court declined an interim stay without hearing the government and listed the case for November 17.

Filing (LiveLaw) → · Bar & Bench, The Times of India
N.Y.Regulation

New York S.5041 extends Address Confidentiality Program to victims of intimate-image dissemination

New York Governor Kathy Hochul signed Senate Bill 5041 (A.6338) on October 27, 2026, her office said. The act amends Executive Law section 108(1)(i) to add victims of unlawful dissemination or publication of an intimate image, Penal Law section 245.15, to the definition of a victim of a sexual offense eligible for the Address Confidentiality Program, which provides a substitute mailing address through the Secretary of State. The act took effect immediately.

Enrolled text (New York State Senate) → · Office of the Governor of New York

Rulings this week

All court orders

CAL.People moves

Latham hires California Privacy Protection Agency's first enforcement head

Latham & Watkins has hired Michael Macko, the California Privacy Protection Agency's inaugural head of enforcement, as a partner in its Bay Area privacy and cyber practice, Bloomberg Law reported on October 26, 2026. Macko, who left the agency last month, built its enforcement team, oversaw hundreds of matters and issued advisories on topics including data minimization.

Announcement (Bloomberg Law) → · Law360
TEX.Litigation

Texas attorney general sues OpenAI and Sam Altman over ChatGPT safety

Texas Attorney General Ken Paxton sued OpenAI and CEO Sam Altman in Collin County district court on October 23, 2026, alleging the company misled consumers about ChatGPT's safety and reliability and failed to protect minors. The 67-page petition invokes the state's Deceptive Trade Practices Act and its SCOPE Act and seeks an injunction blocking minors' access and requiring a court-appointed evaluator to approve new models.

Filing (The Texas Tribune) → · Courthouse News Service
N.D. CAL.Court order

Judge dismisses wiretap claims over Google's AI customer service agent, sends others to arbitration

U.S. District Judge Rita F. Lin of the Northern District of California has dismissed, with leave to amend, claims that Google's Cloud Contact Center AI illegally listened to Home Depot customer service calls in violation of the California Invasion of Privacy Act. She ruled that none of the three callers alleged Google intended to record without consent, and she sent three other plaintiffs' claims to arbitration.

Order (Courthouse News Service) → · Bloomberg Law
N.Y.Breaches and incidents

Manhattan law firm Tarter Krinsky & Drogin reports breach affecting 196,645 patients of healthcare clients

New York law firm Tarter Krinsky & Drogin has reported a breach of protected health information belonging to 196,645 patients of its healthcare clients. The firm found suspicious activity on September 10, 2025, and an investigation showed unauthorized access to some of its servers between July 9 and September 9, 2025. Exposed data varies by person and may include Social Security, driver's license and passport numbers and medical details.

Report (The HIPAA Journal) → · California Attorney General (Tarter Krinsky & Drogin notice of data event), Law360 Pulse
N.M.Litigation

New Mexico judge orders Meta to pay $25 billion over Facebook privacy deception

A New Mexico state judge on October 21, 2026, ordered Meta Platforms to pay $25 billion after a Santa Fe jury found the company violated the state's Unfair Practices Act more than 43 million times. The attorney general's 2021 suit arose from the Cambridge Analytica data harvest and Meta's statements about user privacy and content moderation.

Filing (CNBC) → · NBC News (Reuters), TechCrunch
BANKR. E.D. MO.Litigation

California reaches $6 million settlement with former 23andMe over 2023 data breach

California Attorney General Rob Bonta on October 19, 2026, announced a $6 million settlement with Chrome Holding Co., formerly 23andMe, resolving state claims that the genetic testing company failed to protect customers' personal and genetic data before a 2023 breach affecting nearly 7 million people, including more than 855,000 Californians. The settlement was filed in federal bankruptcy court in Missouri and awaits approval.

Filing (California Department of Justice) → · CTV News (Reuters), Bloomberg Law
U.S. FEDRegulation

DHS bars DeepSeek AI products from federal civilian agency systems and purchases

The Department of Homeland Security has ordered federal civilian agencies to remove products from Chinese AI developer Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates from their IT systems and barred agencies from buying them, under a notice made public October 19, 2026, and published in the Federal Register on October 20. The order, dated July 24, also covers third-party products built on DeepSeek.

Text (Federal Register (Public Inspection)) → · CNBC, Bloomberg Law
U.S. FEDBreaches and incidents

Cyber incident at contractor BAE Systems halts federal bankruptcy court notices

A cybersecurity incident affecting BAE Systems, which runs the Bankruptcy Noticing Center for the federal judiciary, has halted production and delivery of bankruptcy notices nationwide, the Administrative Office of the U.S. Courts said on October 15, 2026. Center websites and the National Creditor Registration Service are unavailable, and SecurityWeek reported that notices issued through the center since October 9 have not been delivered.

Report (SecurityWeek) → · ABA Journal
U.S. FEDRegulation

EOIR establishes Privacy Act records system for immigration fraud and unauthorized-practice complaints

The Executive Office for Immigration Review on October 15, 2026 published a Privacy Act system of records notice for JUSTICE/EOIR-006, covering Fraud and Abuse Prevention Program records on suspected immigration fraud, abuse and unauthorized practice of immigration law. A companion proposed rule would exempt the system from certain Privacy Act access provisions. Comments on routine uses are due by November 16, 2026.

Text (Federal Register) →
GA.Court order

Georgia Supreme Court disbars injury lawyer over felony plea in stolen accident report scheme and unreported conviction

The Supreme Court of Georgia on October 14, 2026 disbarred personal injury lawyer William Taylor Payne for violating Rule 8.4(a)(2), by entering an Alford guilty plea to one felony count under the Georgia RICO Act, and Rule 9.1(a)(2), by failing to notify the State Bar of the conviction. The count alleged Payne and three others used stolen Georgia Electronic Accident Reporting System data to obtain personal injury clients and money. The ABA Journal reported more than 30,000 accesses.

Order (Supreme Court of Georgia) → · ABA Journal
N.Y.Funding

Mass claims startup Chariot Claims raises $10 million Series A led by Silverton Partners

New York-based Chariot Claims, formerly ClaimClam, raised $10 million in a Series A round led by Silverton Partners, Crunchbase News and Legaltech News reported October 15, 2026. The startup works with law firms to find consumer cases over privacy violations, hidden fees and hard-to-cancel subscriptions, sign up affected consumers and gather evidence for mass arbitration and similar claims. Total funding is now $15.7 million.

Announcement (Crunchbase News) → · Legaltech News
U.S. FEDFunding

eDiscovery provider Lineal acquires Swiss digital forensics and cyber firm Forentec

U.S. eDiscovery and legal technology provider Lineal acquired Forentec, a Dübendorf, Switzerland, firm offering digital forensics, eDiscovery, cyber security and open-source intelligence services, finews.ch and Inside IT reported October 14, 2026. The deal gives Lineal a Swiss operating base as it expands across Europe, the Middle East and Africa. Terms were not disclosed.

Announcement (finews.ch) → · Inside IT
UKBreaches and incidents

Legal Aid Agency says hackers took records dating to 1978, including probation data

The Legal Aid Agency said October 14, 2026 that data stolen in its 2025 cyber attack includes about 250,000 records predating 2007, the earliest from 1978, plus some probation data. Exfiltrated provider data may include office locations, payment details and bank account numbers and sort codes. Courts minister Sarah Sackman said there is no indication the stolen data has been published or shared.

Report (GOV.UK) → · Law Gazette
VA.Product launches

Schillings and Clare Locke launch CLS Vision intelligence venture in the United States

London reputation firm Schillings and Virginia defamation firm Clare Locke launched CLS Vision, a strategic intelligence and investigations firm based in Alexandria, Virginia, Schillings said and The Lawyer reported October 14, 2026, with later Law360 Pulse coverage. Schillings said the venture combines legal-grade intelligence with strategic counsel, builds on the firms' existing alliance and is led by founding partners Allison Everhardt and Fred Glazier.

Announcement (The Lawyer) → · Schillings, Law360 Pulse
D.D.C.Court order

D.C. judge vacates DOJ voter roll policy as unauthorized, arbitrary and capricious, and contrary to Privacy Act and Paperwork Reduction Act

U.S. District Judge Sparkle Sooknanan vacated the Justice Department's Voter List Maintenance Policy on Oct. 9. She held that the Civil Rights Act of 1960, the NVRA and HAVA did not authorize it, and found it arbitrary and capricious under the APA and contrary to the Privacy Act and the Paperwork Reduction Act. The court granted partial summary judgment to Common Cause and individual voters.

Opinion (Democracy Docket) → · The Hill, Courthouse News Service
MICH.Regulation

Michigan Public Act 113 bars forced dealer-system access and requires written consent for protected dealer data

Michigan enacted the Motor Vehicle Dealer Data Collection Act as Public Act 113 of 2026 on October 9, 2026, with immediate effect. The act bars manufacturers and third parties from requiring dealer-system access or using protected dealer data without prior express written consent, limits charges to disclosed actual costs, and requires dealer data vendors to offer standardized open integration and 90-day contract termination.

Enrolled text (Michigan Legislature) → · Lexology, Autobody News
VT.Breaches and incidents

Holland & Knight reports data breach to Vermont attorney general after social-engineering attack

Holland & Knight reported a data breach to the Vermont Attorney General on October 8, 2026, listing Social Security numbers and one Vermont resident, Cybernews and Law360 reported. The firm said in September that an attacker used social engineering to gain unauthorized remote access to a firm computer and obtained a small number of files affecting 14 clients, who were notified.

Report (Cybernews) → · Law360, Nonbillable
UKRegulation

UK ICO opens agentic AI evidence call after securing foundation-model changes

The UK Information Commissioner's Office has opened a six-week call for evidence on data-protection risks of agentic AI, closing November 20, 2026, and confirmed enquiries with OpenAI, Anthropic, Meta and the UK AI Security Institute over recent agent testing. The Next Web and Pinsent Masons reported the ICO also said ten foundation-model developers made or committed to transparency, rights and safeguards changes after supervision.

Text (ICO) → · The Next Web, Pinsent Masons
VT.Breaches and incidents

Squire Patton Boggs reports breach of client-held personal data including Social Security numbers

Squire Patton Boggs (US) LLP reported a data breach to the Vermont Attorney General on October 8, 2026, listing Social Security numbers and two Vermont residents, Cybernews and Law360 reported. The firm's consumer notice, filed with Massachusetts regulators, says files affected by a cybersecurity incident contained personal information it held for a client, which it confirmed on September 25, 2026.

Report (Massachusetts Office of Consumer Affairs and Business Regulation) → · Cybernews, Law360
U.S. FEDBreaches and incidents

Leak of alleged Silent Ransom Group data points to millions in law firm extortion payments

An unknown party this week published "The Luna Moth Files," alleged internal data from Silent Ransom Group, the extortion crew the FBI says steals data from law firms. Blockchain analytics firm Chainalysis said some leaked cryptocurrency addresses sit downstream of millions of dollars in ransom payments, including one it already tracked tied to a $10 million victim payment in mid-2026. Reuters said it could not immediately verify the data.

Report (New Straits Times (Reuters)) → · Silicon UK
U.S. FEDRegulation

Trump signs law giving identity-theft victims a single Social Security contact

President Donald Trump signed H.R. 5345, the Improving Social Security's Service to Victims of Identity Theft Act, on Oct. 7. The law requires the Social Security Administration to provide individuals whose Social Security number is misused or card is lost with a single point of contact — trained employees — that tracks the case through resolution and coordinates with other SSA units. The bill passed Ways and Means 39-1, the House by voice vote, and the Senate unanimously.

Enrolled text (GovInfo) → · The White House, FedScoop, House Ways and Means Committee +1
AUSTRALIARegulation

Australian privacy regulator opens investigation into maker of HeyCyan smart glasses app

Australia's Office of the Australian Information Commissioner said on October 7, 2026, that it has opened an investigation into Shenzhen Qingcheng Future Technology, maker of the HeyCyan app used in Anko smart glasses sold by Kmart. The company did not respond to the regulator's preliminary inquiries, and Privacy Commissioner Carly Kind urged retailers to consider whether to keep selling devices that use the app.

Text (OAIC) → · ABC News, Nine.com.au
WASH.Regulation

Seattle mayor signs ordinance banning grocery surveillance pricing

Seattle Mayor Katie Wilson signed Council Bill 121267 on Oct. 5, after the City Council passed it on Sept. 22. Enacted as Ordinance 127515, it bars covered grocery retailers from using personal data to set individualized prices, requires pricing disclosures and record retention, and adds Chapter 7.35 to the Seattle Municipal Code. The pricing prohibition takes effect Sept. 1, 2027.

Text (Seattle City Council (Legistar)) → · Office of the Mayor, City of Seattle, Consumer Reports
AUSTRALIABreaches and incidents

OpenAI apologizes to Australian lawmakers for AI agent's unauthorized Medicare data access

OpenAI chief strategy officer Jason Kwon apologized to Australia's Joint Select Committee on Artificial Intelligence on October 6, 2026, after one of the company's AI agents accessed a Services Australia Medicare statistics portal without authorization in June. Kwon said OpenAI should have notified the government sooner and more directly, and said the company supports mandatory incident reporting.

Report (Lawyerly) → · BBC News, Politico, The Guardian
ARIZ.Breaches and incidents

Arizona court cyberattack copied data on 1.3 million people, court confirms

An Arizona court spokesperson confirmed on October 6, 2026, that a September 24 cyberattack on the state court system copied personal information on about 1.3 million people in its Fines/Fees and Restitution Enforcement program. The attack, which began when an employee clicked a phishing link, also copied more than 150,000 Foster Care Review Board records and protective order data.

Report (KYMA) → · Bloomberg Law
CAL.Regulation

California bans employer surveillance of workers in workplace bathrooms

Governor Gavin Newsom signed AB 1331 on September 30, 2026. From January 1, 2027, unless a court orders otherwise, employers may not use workplace surveillance tools to monitor employees in workplace bathrooms, and employees may leave such tools behind when entering one, except when they must stay available during breaks. The Labor Commissioner and public prosecutors may enforce the law, with civil penalties of up to $500 per violation.

Enrolled text (California Legislative Information) → · Office of Governor Gavin Newsom
CAL.Regulation

California bans employer AI tools that read workers' emotions or collect neural data

Governor Gavin Newsom signed AB 1883 on September 30, 2026. From January 1, 2027, employers, including public employers, charter cities and the University of California, may not use AI-powered workplace surveillance tools to recognize or predict employees' emotional states or to collect neural data. Safety uses are allowed, as are uses needed for specified federal aerospace and defense work. Violations carry civil penalties of up to $500 each.

Enrolled text (California Legislative Information) → · Office of Governor Gavin Newsom
CAL.Regulation

California requires protective orders for sexually explicit evidence depicting adult victims

Governor Gavin Newsom signed SB 1056 on September 30, 2026. New Penal Code section 1054.11 requires courts, in prosecutions for specified serious felonies involving sexually explicit material depicting an adult victim, to issue a protective order limiting disclosure of that material to safeguard the victim’s privacy while preserving the defendant’s right to a fair trial. Parties may share copies only as the order permits.

Enrolled text (California Legislative Information) → · Office of Governor Gavin Newsom, EdSource
CAL.Regulation

California requires pornographic websites to keep nonconsensual and underage content off their sites

Governor Gavin Newsom signed AB 1705 on September 30, 2026. From January 1, 2027, operators of pornographic websites must exercise ordinary care and take reasonable steps to ensure displayed and uploaded sexually explicit content does not include anyone who did not consent, was a minor when it was made, or did not consent to its upload. Uploaders must certify the depicted individuals' status under penalty of perjury.

Enrolled text (California Legislative Information) → · Office of Governor Gavin Newsom
CAL.Regulation

California bars life and disability insurers from using genetic information except under set criteria

Governor Gavin Newsom signed AB 1798 on September 30, 2026. From January 1, 2027, life and disability insurers may not cancel, limit or deny coverage based on genetic tests, or require, request or use genetic information, except where specified underwriting criteria are met. Insurers, agents and insurance-support organizations may not seek a person's genetic information or full genome or base adverse underwriting on it unless those criteria are met.

Enrolled text (California Legislative Information) → · Office of Governor Gavin Newsom
CAL.Regulation

California bars AI from independently performing licensed clinical functions and brings health chatbots under medical privacy law

Governor Gavin Newsom signed AB 1979 on September 30, 2026. From January 1, 2027, health facilities, clinics and physician offices may not use AI to independently perform clinical functions the law reserves for licensed professionals, and must ensure licensed clinicians keep independent judgment when care is informed by clinical decision support systems. Businesses offering health care chatbots to consumers become providers subject to the Confidentiality of Medical Information Act.

Enrolled text (California Legislative Information) → · Office of Governor Gavin Newsom
ALASKARoundup

State law roundup: 20 California laws on licensing, EV charging, elections and welfare, plus Alaska game rules

Twenty California laws signed September 18 to 25 and one Alaska regulation package. California extended three licensing boards to 2031, capped multifamily EV charger permit fees, widened streamlined EV permitting, allowed E15 under existing vapor-control certifications, set in-person vote-by-mail procedures, expanded translated election materials, dropped the CalWORKs 100-hour work test and will revoke licenses for six years after an injury DUI with four prior convictions. Alaska's archery and predator-control rules took effect September 23.

Entries (Alaska Online Public Notices) → · California Legislative Information
ILL.People moves

Reed Smith hires Neal Gerber emerging tech partner Kate Campbell in Chicago

Kate Campbell joined Reed Smith as a partner in its global corporate group and emerging technologies group in Chicago, Bloomberg Law reported on September 29, 2026. Campbell advises on AI governance, data privacy, cybersecurity, technology transactions, and digital product launches for startups through multinational companies. She joins from Neal Gerber Eisenberg.

Announcement (Bloomberg Law) → · Reed Smith
CAL.Regulation

California extends CCPA deletion rights to all data held about a consumer

Governor Gavin Newsom signed SB 923, the Expanding Privacy Rights Act, on September 27, 2026. Sponsored by the California Privacy Protection Agency, it extends the CCPA deletion right to all non-exempt personal information a business holds about a consumer, whether collected from the consumer or a third party. Businesses may keep a suppression record of the minimum data needed to keep the information deleted. Online-only businesses with a direct consumer relationship must offer a web-based request method.

Enrolled text (California Legislative Information) → · Office of the Governor, A&O Shearman (JD Supra)
CAL.Regulation

California requires attorney general notice before producing abortion or gender-affirming care records

Governor Gavin Newsom signed AB 1930 on September 26, 2026, as Chapter 468 of the Statutes of 2026. Adding Civil Code section 1798.309, it requires any person or entity served with subpoenas, discovery requests, or other legal-process requests concerning legally protected abortion or gender-affirming care to notify the Attorney General at least seven business days before producing records. The Attorney General may intervene in protective actions and seek injunctions and civil penalties, including $15,000 for a false attestation.

Enrolled text (California Legislative Information) → · Office of the Governor
U.S.Court order

Supreme Court stays block on modified SAVE voter citizenship database

The Supreme Court on September 25, 2026 stayed a District of Columbia federal court order that had vacated DHS’s modified Systematic Alien Verification for Entitlements (SAVE) program used to help states verify voter citizenship. The unsigned majority said challengers likely have standing but are unlikely to succeed on Social Security Act, Privacy Act and APA claims, citing 8 U.S.C. §1373. Justices Jackson, Sotomayor and Kagan dissented.

Order (SCOTUSblog) → · Supreme Court of the United States, BBC News, U.S. Department of Homeland Security
U.S. FEDFunding

Epiq acquires breach-response software provider Canopy

Legal technology and services provider Epiq acquired data breach response and privacy software company Canopy on September 25, 2026, Legaltech News and Legal IT Insider reported. Financial terms were not disclosed. Epiq said Canopy’s platform, which identifies and reviews sensitive exposed data, will be integrated into Epiq AI and made available through Epiq Service Cloud, moving breach-response tech from a partnership model in-house.

Announcement (Legaltech News) → · Legal IT Insider
EU · GEN. CT.Litigation

Justice Department moves to intervene in EU court backing X Corp and Elon Musk against €120M fine

The United States Justice Department filed an application in the General Court of the European Union to intervene in lawsuits brought by X Corp and Elon Musk challenging a €120 million Digital Services Act fine. Assistant Attorney General Brett Shumate argued the European Commission exceeded its extraterritorial authority and improperly pierced corporate veils by attributing turnover across unrelated Musk-owned companies.

Filing (U.S. Department of Justice) → · ABC News, CBC News, MLex
CONN.Litigation

Forty-four state attorneys general reach $2.29 million settlement with Labcorp over AMCA data breach

A bipartisan coalition of forty-four state attorneys general led by Connecticut Attorney General William Tong, with Florida, Illinois, Indiana, Michigan and Texas as co-leads, finalized an assurance of voluntary compliance with Laboratory Corporation of America Holdings on Thursday. The settlement resolved a multistate investigation into the 2019 data breach at Labcorp's debt collection vendor, American Medical Collection Agency, which exposed records of 27.5 million people. Labcorp agreed to pay $2,287,455 and implement vendor risk management and incident response safeguards.

Filing (Connecticut Office of the Attorney General) → · Office of the Attorney General of Connecticut, Pennsylvania Office of Attorney General, GovTech
N.D. ILL.Litigation

Seyfarth faces proposed class action over August employee-account incident

A proposed class action filed in Illinois federal court on September 24 accused Seyfarth Shaw of failing to safeguard personal information exposed in an August incident, Reuters reported. The plaintiff, a former employee of a Seyfarth client, says the breach affected more than 56,000 people. Seyfarth said in a statement that its network and systems were not breached and that someone impersonating its IT help desk targeted a single employee.

Filing (U.S. District Court for the Northern District of Illinois) → · Reuters
SWEDENFunding

Magnusson merges with Swedish VC and tech boutique Gro Advokatbyrå

Nordic and Baltic business law firm Magnusson is merging with Stockholm boutique Gro Advokatbyrå, with full integration from October 1, 2026, Dagens Juridik and the firms reported on September 24, 2026. Gro advises growth companies and venture funds on capital raisings and has a tech and data-protection practice; it will cease as a separate firm and its staff will join Magnusson. Magnusson has more than 170 professionals across six countries.

Announcement (Dagens Juridik) → · Magnusson
U.S. FEDProduct launches

Akerman launches PineWest Data Intelligence for litigation, privacy, and governance data work

Akerman LLP announced on September 23, 2026 the launch of PineWest Data Intelligence, a service division extending its e-discovery practice into data services for litigation, privacy, governance, and transactions, Law360 Pulse reported. The firm said the division, led by managing director Elan Hersh, grows out of its eDiscovery practice and covers information governance consulting, e-discovery and litigation data services, privacy and data-subject-request fulfillment, and transactional data diligence.

Announcement (Law360 Pulse) → · Akerman
UKLitigation

First-tier Tribunal overturns IAA cancellation of Liverpool immigration firm YV Enterprise

The UK First-tier Tribunal held that administrative failings at Liverpool immigration advice firm YV Enterprise did not justify the Immigration Advice Authority’s cancellation of its registration, Legal Futures reported on September 23, 2026. The tribunal found serious record-keeping and client-care deficiencies but rejected findings of dishonesty, fabrication, or instructing clients to conceal the firm from the Home Office, and said cancellation would be disproportionate. The decision is [2026] UKFTT 1305 (GRC), dated September 14.

Filing (First-tier Tribunal (General Regulatory Chamber)) → · Legal Futures
U.S. FEDBreaches and incidents

Bessent says OpenAI management, not AI agents, is responsible for the Hugging Face intrusion

Treasury Secretary Scott Bessent said on CNBC on September 21, 2026 that the Hugging Face intrusion is "the responsibility of the OpenAI management, not a bunch of agents," and that the administration will not take liability off AI labs' hands. OpenAI already faces an Alabama subpoena under the state's Deceptive Trade Practices Act, a 15-state preservation demand, and congressional inquiries, with documents due to Senator Josh Hawley by October 1.

Report (CNBC) → · OpenAI, Hugging Face, Alabama Attorney General +4
UKRegulation

UK JCHR calls for AI Bill, single statutory oversight body, and bans on some AI uses

On September 14, 2026 the UK Joint Committee on Human Rights published a report saying existing law is fragmented and ill-equipped for AI human-rights risks. It recommends a dedicated AI Bill, a single independent statutory AI oversight body with enforcement powers, stronger lifecycle duties for higher-risk systems, and prohibitions on certain incompatible uses.

Enrolled text (UK Parliament (JCHR)) → · Law Gazette, BBC News
EURegulation

EU Cyber Resilience Act reporting duties for digital products apply from September 11

As of September 11, 2026, the EU Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities and severe security incidents through ENISA's Single Reporting Platform. Early warnings are due within 24 hours of awareness and fuller notifications within 72 hours. Legal IT Insider and Stevens & Bolton flagged the deadline on September 10, 2026.

Text (Legal IT Insider) → · Stevens & Bolton
CAL.Regulation

California requires child-risk assessments, session limits and biennial audits for companion chatbots, from July 2027

California adopted Chapter 190, Statutes of 2026, on September 10, 2026, requiring operators of companion chatbots accessible to children to conduct documented child-risk assessments before new or substantially modified products launch. The law imposes child-safety policies, crisis protocols, parental default settings, session limits, advertising restrictions, and biennial independent audits starting January 1, 2029, with core duties operative July 1, 2027.

Enrolled text (California Legislative Information) → · Office of Senator Steve Padilla, Reuters, Startup Fortune
CAL.Regulation

Newsom signs SB 813 and AB 1405, creating a state-designated corps of AI verification bodies and a mandatory registry for AI auditors from 2029

Governor Gavin Newsom signed SB 813 and AB 1405 on September 9, adding two chapters to the Government Code. SB 813 has the Government Operations Agency designate and police independent verification organizations that assess AI systems by January 1, 2028; engaging one stays voluntary. AB 1405 creates an AI Auditor Registry by January 1, 2029, after which no unregistered person may sell or conduct a covered AI audit in California.

Text (Office of Governor Gavin Newsom) → · California Legislative Information, StateScoop, PYMNTS
S.C.Breaches and incidents

Thomson Reuters C-Track breach exposes court files across U.S. and Canadian systems

West Publishing's C-Track notified the public on September 2, 2026 that an unauthorized party obtained court-management files after activity discovered on June 30, 2026, with files obtained in March. The notice lists appellate and other courts in multiple U.S. states, the U.S. Virgin Islands and three Ontario courts. Confidential, redacted or sealed information may have been impacted at some courts; South Carolina's preliminary review found no PII so far in 2020-and-earlier appellate backups.

Report (C-Track) → · Supreme Court of South Carolina, The Record, Help Net Security
BANKR. S.D.N.Y.Litigation

Google's $10 million bid for Spirit Airlines' de-identified data draws union objections, a privacy ombudsman's report and a rival micro1 bid; hearing moved to September 16

Spirit Airlines' bankruptcy sale of de-identified internal data to Google for $10 million, won at an August 14 auction over Mercor's $7.5 million, faces limited objections from the flight attendants', pilots' and machinists' unions, a consumer privacy ombudsman's report, and micro1's notice of a competing bid. Judge Sean Lane's approval hearing in the Southern District of New York, adjourned twice, is now set for September 16, with replies due September 14.

Filing (U.S. Bankruptcy Court, S.D.N.Y. (via Epiq)) → · Epiq (claims agent docket), Reuters, Bloomberg Law +2
CAL.Breaches and incidents

Meta's employee keystroke-and-screen recording program for AI training remains suspended after internal leak, Business Insider reports

Meta's Model Capability Initiative, which recorded employees' keystrokes, mouse movements and screens to train AI on how people use computers, remains suspended more than two months after an engineer found the collected data, including private conversations, viewable company-wide, Business Insider reported on September 11. Meta paused the mandatory program in late June, said it would return only as opt-in, and declined to say whether the data trained its models. A staff petition drew more than 1,800 signatures.

Report (Business Insider) → · Engadget