Privacy
Court: OPM broke privacy law giving DOGE federal employee records
A New York federal court ruled OPM unlawfully handed millions of federal employee records to DOGE, while Telegram and AI data brokers face new scrutiny.
This edition was produced with artificial intelligence. Text and voice are generated automatically.
Judge rules OPM unlawfully disclosed federal employee records to DOGE
A federal court in New York ruled that the Office of Personnel Management violated the Privacy Act by disclosing millions of federal employee records to DOGE agents. In a summary judgment issued October 20, 2026, Judge Denise Cote found OPM breached two provisions: one limiting inter-agency disclosure of personal records and another requiring agencies to protect their security and confidentiality. She wrote that OPM offered no support for the claim that a modernization agenda justified granting sweeping, expedited access to a score of DOGE agents. OPM holds sensitive data on tens of millions of employees, retirees and applicants, and began disclosing it in January 2025 to the U.S. DOGE Service led by Elon Musk. The Electronic Frontier Foundation sued on behalf of federal unions and employees. The court will decide the remedy later.
Victory! Court Rules OPM’s Disclosure of Personal Records to DOGE is Unlawful →
Court filing shows Telegram gave US investigators a user’s phone number and IP
Court records in a federal criminal case in the Western District of Louisiana show Telegram provided US investigators with a user’s phone number, numeric account ID and IP address. A two-page Telegram letter dated September 4, 2026, filed as Exhibit B on October 15, identifies an account under the name Mahmoud Almohtadi and supplies a single IP address timestamped October 8, 2025. Telegram says it discloses phone numbers and IP addresses after reviewing valid judicial orders tied to suspected criminal activity, and describes its response as voluntary while reserving legal positions. The exhibit contains account and connection data but no message content. Telegram fulfilled 900 US law enforcement requests affecting 2,253 users in 2024, up sharply from 14 requests and 108 users through September of the prior year.
Court filing reveals the user data Telegram is handing over to US authorities | CyberInsider →
Topics: Messaging apps privacy
Companies are selling employee Slack messages and emails to train AI
Companies are licensing workplace emails, Slack messages and internal documents to AI developers, with businesses receiving six-figure offers and sometimes 48 hours to decide. Dan Novaes, chief executive of data broker Mode.Inc., said demand is astronomical. OpenAI, Anthropic and Meta are seeking real-world workplace records to train AI agents, and Gartner’s September 2026 forecast projects worldwide spending on AI data reaching $6.48 billion in 2027. Employees may receive no share of proceeds. Google’s proposed $10 million purchase of internal Spirit Airlines data drew concern from former employees and lawmakers; more than 120 US lawmakers led by Senator Elizabeth Warren and Representative Steven Horsford urged Google and Spirit to protect former employees’ privacy. Meta suspended a project collecting employee keystrokes and mouse movements after data became more widely accessible than intended.
Topics: Workplace surveillance and employee monitoring
California to receive $6 million in 23andMe breach settlement
California Attorney General Rob Bonta announced the state will receive a $6 million settlement payment in 23andMe’s bankruptcy, resolving California’s legal claims related to a 2023 data breach that exposed 6.9 million customers’ genetic and personal information.
California Settles 23andMe Data Breach Claims for $6 Million →
Topics: Data breach fines and settlements
DHS bans DeepSeek from civilian federal agencies over security concerns
The Department of Homeland Security has banned DeepSeek use by civilian federal agencies, citing security concerns. The ban covers any technology built with the aid of DeepSeek’s AI models and applies to agencies including the Treasury Department, the State Department and the Department of Justice, plus prime contractors and subcontractors serving federal agencies. It also bars DeepSeek from future procurements and requires agencies to remove versions installed before the ban. The primary concern is that DeepSeek servers sit in the PRC, where government cyber and intelligence operations legally have broad authority to access private company infrastructure. DHS warns the models themselves may contain malware or vulnerabilities, and open source research found multiple critical flaws in the DeepSeek iOS app. The ban follows the release of DeepSeek’s V4.1-Flash-1017 model.