Carfax, Inc. faced an early loss in a closely-watched privacy case under the federal Driver’s Privacy Protection Act (DPPA), after a judge in Maryland refused to throw out a proposed class action alleging the company sold drivers’ personal information sourced from crash and vehicle records. The plaintiff alleges that Carfax obtained his DPPA-protected personal information
third-party vendors
Extraterritorial Scope of the EU AI Act
By Daniel Lass on
Posted in Artificial Intelligence
Given its extraterritorial reach, companies outside Europe should start preparing for the EU AI Act now. In general, the Act will apply to companies that develop high-risk AI systems used in the EU and that provide outputs from those systems, even if the companies have no physical presence in Europe.
Ahead of August 2026, companies…
Adidas and UChicago Sued Over Data Breaches Caused by Third-Party Vendors
By Kathryn Rattigan on
Posted in Enforcement + Litigation
What do a global sportswear giant and a prestigious medical center have in common? Apparently, a shared struggle defending data breach lawsuits for breaches of sensitive personal information caused by third-party vendors.
This week, Adidas America and the University of Chicago Medical Center found themselves on the receiving end of data breach lawsuits. The plaintiffs…
AI Service Provider Faces Class Actions Over Catholic Health Data Breach
By Kathryn Rattigan on
Posted in Artificial Intelligence
AI service provider Serviceaide Inc. faces two proposed class action lawsuits from a data breach tied to Catholic Health System Inc., a nonprofit hospital network in Buffalo, New York. The breach reportedly exposed the personal information of over 480,000 individuals, including patients and employees.
Filed in the U.S. District Court for the Northern District of…