Privacy
Privacy in Jeopardy: EU Data Deals, Surveillance Laws, and App Risks
From EU biometric data sharing to Bangladesh's new surveillance law – today's top privacy stories.
EU Near Deal to Share Biometric Data with US for Visa-Free Travel
The European Commission is finalizing the Enhanced Border Security Partnership (EBSP) Framework Agreement with the Trump administration, which would allow US border control to screen EU travellers against biometric databases. A leaked draft shows the Commission accepted US demands for broad information access, including systematic transfers of biometric data and subjective risk indications from European national databases. EDRi warns the agreement lacks protections against discrimination based on political opinions, potentially targeting dissent. The negotiations began in 2022 but the Council only gave an official mandate in December 2025; a revised draft was leaked in May 2026. The text largely departs from EU member states’ mandate and likely violates EU data protection law, according to EDRi’s analysis.
Euki App Praised for Privacy in Period-Tracking Audit
The Mozilla Foundation’s privacy audit of six top period-tracking apps found serious flaws in five, but held up Euki as the best for privacy. Euki stores all data locally on the user’s phone and requires no account or registration. It offers a PIN and a fake PIN that hides data behind a technical difficulties message. Users can delete previous data with a button or on a schedule. The audit highlighted that police have used app data to prosecute people for alleged abortions, making privacy crucial. Euki is free with no in-app purchases and collects no data according to the Apple App Store.
This Period-Tracking App Actually Keeps Your Data Private →
California Expands Data Broker Compliance with SB-361
California’s SB-361 expands the Delete Act, requiring registered data brokers to regularly check the state’s DROP database to process consumer deletion requests. Starting August 1, 2026, data brokers must access DROP at least every 45 days and delete requested information within 45 days. The law defines data brokers broadly, including businesses that sell third-party PI even if they have a direct relationship with the consumer. Failure to comply risks $200 daily penalties. The CPPA is set to begin active investigations and enforcement actions. There are currently no private rights of action for violations.
California Data Brokers Must Build a New Compliance Playbook →
Bangladesh Gambling Law Raises Privacy Concerns with DPI Surveillance
Bangladesh’s Gambling Prevention Act 2026 replaces the colonial-era law and includes Section 44, which permits AI-based monitoring, Deep Packet Inspection (DPI), and transaction monitoring to prevent online gambling. DPI allows the government to inspect the actual data content of all internet users, potentially exposing sensitive communications. This provision conflicts with Article 43(b) of the constitution guaranteeing privacy of correspondence, and Article 36(1)/(2) allows warrantless arrest and device seizure based on suspicion. Legal experts argue these powers threaten constitutional rights to free speech and expression. Without clear rules and judicial oversight, the surveillance tools could be misused beyond their intended purpose.
Could the new gambling law threaten citizens’ privacy? →
Flock License Plate Data Exposed; Journalists Host AMA
Investigative reporters Jason Koebler and Joseph Cox of 404 Media broke the story that Flock, the automatic license plate reader company, exposed license plate searches and reasons via DuckDuckGo and Bing. They are hosting a live AMA on July 21 from 12-1 PM ET, organized by the PWN Community, to discuss the leak, ALPR surveillance, and their reporting methods. Koebler is former editor-in-chief of Motherboard; Cox’s work has triggered fines and privacy legislation. The AMA invites questions about the Flock leak and running an independent newsroom.
They Broke the Story on Flock Leaking Cops’ License Plate Searches. Ask Them Anything. →