Weekly Privacy & Compliance Digest: Shadow AI Risks, €7M GDPR Fine, and Public Sector Breaches

Welcome to this week's privacy roundup. From hefty GDPR regulatory penalties in Europe to shadow AI data leaks and large-scale public sector breaches, organizations face continuous compliance and data governance challenges. Here is a breakdown of the key data privacy developments web agencies, developers, and business owners need to know.

Enforcement & Litigation Settlements

• French Retailer Fnac Darty Fined €7M: Following a complaint brought by privacy rights group noyb, French electronics retailer Fnac Darty was hit with a €7 million fine for data protection non-compliance. The case underscores the operational and financial exposure companies face when privacy advocacy groups challenge data processing practices.
• Covenant Health Agrees to $2M Breach Settlement: Healthcare provider Covenant Health reached a $2 million settlement to resolve a class-action lawsuit stemming from a past security incident. The settlement highlights the persistent legal liabilities organizations incur following unauthorized data access.

AI Governance & Unsanctioned Data Processing

• Employee Uploads Health Records to Personal AI Chat: In a clear case of unauthorized personal AI usage ("shadow AI"), a RIZAP employee uploaded 726 individuals' health records into a personal AI chatbot. The event illustrates the urgent need for internal policies governing AI tool usage and automated data handling.
• DOJ Privacy Concerns Over Character.AI Data Sale: The U.S. Department of Justice raised privacy objections regarding the potential sale of user chat logs associated with Character.AI. As conversational AI platforms accumulate vast repositories of personal conversations, regulatory scrutiny over user data monetization continues to escalate.

High-Impact Public Sector & Healthcare Breaches

• Florida Education Breach Impacts 4.9M Individuals: The Florida Department of Education warned that approximately 4.9 million people had sensitive data—including Social Security numbers and Medicaid IDs—exposed following a breach linked to Frontline School Software.
• iRhythm Breach Toll Reaches 8.2M: Official filings with the U.S. Department of Health and Human Services (HHS) revealed that an ongoing data breach at medical technology firm iRhythm impacted 8.2 million individuals, making it one of the largest reported health data breaches in recent months.
• UNM Health and Ransomware Threats: UNM Health in New Mexico confirmed it is addressing a cybersecurity attack after a ransomware gang claimed responsibility for compromising system data.
• Homeland Security & Government Incidents: Over 41,000 U.S. Homeland Security officials had personal details exposed in a recent breach. Meanwhile, the President of Moldova convened an urgent national security meeting in response to a massive government-level data breach.

Retail Security & Data Governance Gaps

• Fashion Retailer Resolve Reports Card Breach: Apparel retailer Resolve disclosed a security breach in which unauthorized actors compromised payment card information, reminding online merchants of the critical importance of secure payment pathways and script integrity.
• UK Intelligence Agency Loses Track of Data Storage Devices: A regulatory watchdog reported that a British intelligence agency could not account for thousands of physical data storage media devices, demonstrating that physical asset tracking remains a crucial component of data governance.
• Global Law Enforcement Actions: On the law enforcement front, Australian authorities disrupted access to over 180,000 infected computers by compromising the command infrastructure of the Amadey malware, while a Syrian Electronic Army hacker received a prison sentence for cyberattacks directed at Western targets.

What This Means for You

Whether you manage e-commerce storefronts, SaaS applications, or corporate websites, managing data risk requires proactive oversight. Employees utilizing unauthorized AI tools or third-party web scripts running unnoticed can lead to severe regulatory liabilities under laws like GDPR or KVKK. Establishing strict data inventories (such as maintaining a GDPR Article 30 record) and implementing continuous oversight are crucial steps. Automated solutions like PrivaScan help organizations maintain control by performing automated pre-consent tracker scanning, detecting unintended cross-border data transfers, and auditing website compliance before issues arise.

Disclaimer: This article is provided for informational purposes only and does not constitute formal legal advice. Readers should consult qualified legal counsel to evaluate their specific compliance obligations.

Sources

• DOJ raises privacy concerns over potential sale of Character.AI chats — The Record
• Fashion retailer Resolve says hackers stole payment card information — The Record
• August 2026 Healthcare Data Breach Report - The HIPAA Journal — The HIPAA Journal
• Covenant Health reaches settlement in data breach lawsuit - WABI — WABI
• Florida warns that 4.9 million people had Social Security numbers leaked in financial aid site breach — The Record
• Covenant Health agrees to $2M data breach settlement - WGME — WGME
• Syrian Electronic Army hacker gets prison time for attacks on Western targets — The Record
• British spy agency cannot account for thousands of data storage devices, watchdog says — The Record
• Extent of Crime Stoppers data breach unknown: Sault Police chief — DataBreaches.net
• UNM Health addresses cyberattack in New Mexico after ransomware group claims responsibility — DataBreaches.net