Privacy and Cybersecurity Roundup: AI Act Changes, New Privacy Laws and CISA Patch Rules
Summary
The roundup covers EU AI Act amendments, proposed Canadian privacy legislation, new Vermont privacy laws, CISA’s risk-based federal remediation directive, and the FTC’s final order following Illuminate Education’s student-data breach.
Key points
- The European Parliament approved AI Act amendments delaying some high-risk AI and watermarking obligations and restricting systems used to create non-consensual intimate imagery or child sexual abuse material; Council adoption is still required.
- Canada’s Bill C-36 would replace PIPEDA’s private-sector privacy regime with new oversight, breach reporting, privacy impact assessment, and data-protection requirements; it remains at first reading.
- Vermont enacted new rules for direct-to-consumer genetic testing companies, including express-consent, consumer access and deletion, data security, and transfer requirements.
- Vermont Act 138 adds data-broker breach notifications and registration requirements, including a 45-day deadline to notify affected consumers and a 14-business-day deadline to notify the Attorney General.
- CISA’s BOD 26-04 replaces two federal remediation directives with a risk-based framework; some publicly exposed, exploitable KEV vulnerabilities must be fixed within three days.
- The FTC finalized an order requiring Illuminate Education to strengthen security and retention practices after a breach exposed information on more than 10.1 million students; the attacker used credentials tied to a former employee.
Article Details
- Event Type
- Privacy and cybersecurity regulatory developments, including legislative changes, federal remediation requirements, and an FTC consent order following a student-data breach.
- Impact
- The FTC says a breach at Illuminate Education exposed personal information of more than 10.1 million students and involved exfiltration of 787 SQL server backups. The final order requires data-retention and security-program changes, including encryption, phishing-resistant MFA, and recurring testing and assessments. Separately, CISA’s directive sets risk-based vulnerability-remediation deadlines for federal agencies, including three-day deadlines for certain publicly exposed, automatable KEV vulnerabilities. The other measures described would create or change privacy, data-broker, genetic-testing, and educational-technology obligations, but several are not yet in force or have future effective dates.
Vendors
Amazon Web ServicesAccording to the FTC, the incident began when a threat actor accessed Illuminate’s AWS environment using access credentials associated with a former employee who had left the company in April 2018. The credentials hadIlluminate Education🇺🇸 FTC Finalizes Illuminate Education Order After Student Data Breach
Countries
Canada🇨🇦Canada Introduces Bill C-36 to Replace PIPEDA’s Private-Sector Privacy RegimeUnited Statesor designated as foreign adversaries under 15 C.F.R. § 7.4(a). Transfer or storage outside the United States requires express consumer consent. Direct-to-consumer genetic testing companies are also prohibited
Industries
Data brokerageEducation🇺🇸 FTC Finalizes Illuminate Education Order After Student Data BreachEducational technologyGovernor on 16 June 2026, after passing both chambers in late May. The principal data broker and educational technology provisions will take effect on 1 January 2027. The provisions on the study of a future deletionGenetic testing🇺🇸 Vermont Enacts Genetic Information Privacy Act for Direct-to-Consumer Genetic Testing