Coupang hit with $466M privacy fine as Elgin College bags Flock cameras

Coupang fined record $466M over breach exposing 37.5 million people

South Korea’s Personal Information Protection Commission imposed a 624.7 billion won fine, about $466 million, on Coupang on June 11, 2026, following a November 2025 breach in which a former employee used a stolen cryptographic authentication signing key to access roughly 4,500 accounts before data on 37.5 million people was exposed, including more than 33 million registered members. Regulators cited poor key management and weak access controls. The penalty, split across Coupang Corp., affiliate CPLB and Coupang Eats, is nearly five times South Korea’s previous data-protection record. Coupang appealed to the Seoul Administrative Court, calling the fine disproportionate and denying wrongdoing, and disclosed a $410 million litigation reserve. Separately, the National Assembly summoned executive Joo Seong-won to testify on October 12, 2026, amid a fight over refused antitrust inspections.

Coupang Data Breach Fine Reaches Record $466M: National Assembly Summons Executive Over Stolen Key →

Topics: South Korea data breaches and enforcementData breach fines and settlements

EDPB calls for smart glasses to signal clearly when recording

The European Data Protection Board issued a non-binding recommendation on Tuesday urging smart glasses to clearly signal when they are recording, saying bystanders have the right to know when they are being filmed. Chair Anu Talus said the devices should use bright LED lights, audio signals or voice activation cues, privacy-friendly smartphone notifications, or distinctive designs, and that warnings must be reliable, hard to ignore and always up to date. The board flagged heightened risks in schools, hospitals and on beaches, and for children. The advisory follows campaigns in several European countries: Norway wants a temporary ban in certain public places, Oslo has banned camera-equipped glasses in schools, French prosecutors opened a criminal probe over harassment videos, and a UK and Ireland petition passed 10,000 signatures.

EU watchdog urges smart glasses to clearly signal when recording →

Topics: Smart devices privacy

Polish prosecutors say Pegasus data reached Israeli producer NSO

Polish prosecutors have revealed that data harvested from phones by Polish authorities using Pegasus spyware was transmitted outside Poland and was accessible to the tool’s Israeli producer, NSO Group. Analysis by Internal Security Agency experts found the Central Anti-Corruption Bureau lacked full control over the system: it had no passwords for some administrative accounts, and the server module that infected devices stayed under NSO’s exclusive control, with data routed through servers worldwide. Prime Minister Donald Tusk called the case one of the biggest scandals since the fall of communism and a crime against the state. Poland bought Pegasus in 2017 under the Law and Justice government and used it against hundreds of targets, including political opponents. Former officials face charges.

Israeli producer had access to data harvested by Poland using Pegasus spyware, say prosecutors | Notes From Poland →

Topics: Spyware

Illinois college covered Flock cameras after removal request refused

Elgin Community College installed six Flock safety cameras in April 2025, but by September 2025 administrators worried the company was sharing data with Customs and Border Protection, that feeds were not properly secured, and that law enforcement and company employees were abusing data access. In October 2025 the college asked Flock to remove the cameras; Flock refused, saying it had not violated its contract. A December request, including an offer to pay the remaining five months, met silence. Staff then covered the cameras with black trash bags and zip ties, and workers in an unmarked vehicle repeatedly removed the coverings when servicing them, according to President Peggy Heinrich. The standoff lasted until April 2026, when the contract expired and Flock removed the cameras.

A college in Illinois tried to cancel its Flock contract and it refused | The Verge →

Topics: Flock SafetyLicense plate readers (ALPR)

India’s data protection law takes effect in 2027 with broad state exemptions

India’s Digital Personal Data Protection Act of 2023 takes full effect on May 13, 2027, covering 1.4 billion people. It mirrors GDPR structure but diverges sharply on state power: Section 17(1)(c) removes rights, collector duties and cross-border limits for processing tied to prevention, detection, investigation or prosecution of any offense, with no notification or necessity showing. Section 17(2)(a) lets the government exempt any agency by notification, and Section 17(5) grants a five-year power to disapply any provision. Section 44(3) amends the Right to Information Act to exempt personal information without a public-interest test. Transparency activist Venkatesh Nayak petitioned the Supreme Court in February 2026, arguing the exemptions conflict with the 2017 Puttaswamy ruling making privacy a fundamental right.

India’s GDPR-Inspired Privacy Law Leaves State Power Unchecked →