Compliance & Ethics

Article 30 of the GDPR requires organizations to maintain a record of processing activities, a running account of what personal data is collected, why, where it goes, and how long it is kept. In the spring of 2018, producing this record was urgent work, done under outside counsel's supervision and briefed to the board. Seven years on, in a great many organizations, it is a spreadsheet that gets copied forward each quarter by whoever currently holds the job, edited just enough to survive an audit, verified by almost no one, because verifying it would mean re-establishing, line by line, whether the data flows it describes still exist in the form it claims they do. Vendor relationships lapse and the row survives them. Systems get decommissioned and the row survives that too. The record persists not because it is accurate but because it is inherited, and inheriting a document is a different act from understanding it.

Australia’s Federal Court has now ordered Venture 5 Group, which trades as CashnGo, to pay about $2.5 million (AUD 3.5 million) over unfair terms that enabled those practices in its small amount credit contracts. The penalty follows proceedings brought by the Australian Securities and Investments Commission, or ASIC. CashnGo admitted the terms were unfair and consented to the orders sought by the regulator, including the penalty.

The Federal Trade Commission and a bipartisan coalition of 22 states have sued Amazon, accusing the company of secretly manipulating the auctions that determine advertising prices on its marketplace and extracting more than $20 billion from businesses that believed they were competing under a different set of rules.

The European Commission has added ChatGPT, Reddit and Roblox to the short list of digital services considered large enough to warrant the European Union’s highest level of scrutiny, giving the three companies until January to meet a more demanding set of obligations under the Digital Services Act.

Ohio State University has agreed to pay $2.1 million to resolve allegations that it failed to disclose employees’ ties to and financial support from the People’s Republic of China while seeking federal research funding, the Justice Department announced Monday.

The machinery meant to keep oily waste out of the ocean was aboard the MSC Samira III. So was the monitoring equipment meant to catch a violation. When those protections became inconvenient, senior crew members found ways around them. For months, oily bilge water was moved through the ship and discharged into the sea while the records meant to account for such discharges told a different story. On Friday, the companies responsible for the vessel pleaded guilty to federal pollution charges and were sentenced to pay a combined $1.75 million fine.

DermTech, the skin cancer testing company which filed for bankruptcy in 2024 and is now liquidating as DTech Liquidating, has agreed to resolve allegations that it violated the False Claims Act by knowingly submitting claims to Medicare for unreliable tests. Under the settlement announced Wednesday, the federal government received an allowed Class Three General Unsecured Claim of $5,038,011 in DermTech’s bankruptcy proceeding.