Data Privacy

A reported upload of volunteer PII to a consumer chatbot underscores a broader data-egress risk and growing demand for approved enterprise AI, DLP, and secure-access controls. Procurement teams should assess retention, input-training, identity, and integration requirements while organizations review provider terms and consult privacy staff after an exposure.

Connecticut, New Jersey, New York, and Michigan reached a settlement with Perry Johnson Companies after a 2023 breach exposed records belonging to more than 13 million people. The company must pay $300,000 and implement specified security reforms, with a potential additional $9.7 million payment for failure to comply—a procurement risk signal for contractors handling health data.

A researcher reported that a publicly accessible CitySourced database contained more than 42 million documents and nearly 450,000 files with residents’ personal information and complaint records. Granicus said the issue was resolved in August, affected customers were notified, and it found no evidence of access by another party—prompting local-government buyers to review vendor security and breach-response requirements.

Frontline Education said attackers accessed part of its environment on August 14–15, 2026, by exploiting a vulnerability in third-party software, exposing employee and student information used by school systems nationwide. The incident gives districts and education agencies a reason to review vendor security controls, data-handling practices, and incident-notification terms, but no solicitation or contract award was identified.

An Oklahoma Senate interim study examined the legal, privacy, and public-safety implications of Flock automated license plate reader cameras. Speakers cited state-law limits on ALPR use and questioned data access and warrants, signaling potential policy and contract-implementation changes—but no new procurement, award, or funding opportunity.

Quest Diagnostics said unauthorized access to its Quantum Lab Services Manager system may have exposed patient records, though the number affected is unknown. The incident is a healthcare cybersecurity and third-party-risk signal for government buyers and contractors; the company reports services and operations remain unaffected, and no procurement opportunity was announced.

Two Marines filed a proposed class-action lawsuit alleging that a Defense Manpower Data Center file-sharing vulnerability exposed unencrypted personal records for about 3.05 million military-connected people over roughly nine months. The case raises cybersecurity, privacy, and incident-notification concerns for contractors supporting DoD systems, but no procurement action or new requirement has been announced.

A review tracking 49 federal privacy proposals through September 2026 spans consumer data, AI, children’s information, health and location data, employee monitoring, and data brokers; two measures have become law, though the source does not identify them or their requirements. Contractors should monitor the policy landscape and assess privacy and AI-governance readiness, while treating pending proposals as potential future requirements—not current mandates or procurement opportunities.

U.S. federal agencies may purchase sensitive consumer information from commercial data brokers, while AI can combine location and other digital records into detailed profiles. The signal identifies no specific solicitation, award, or contract value, but highlights procurement needs around data governance, privacy safeguards, and controls on AI-enabled analysis.

ICE is planning the ERO ONE requirement, estimated at more than $100 million, for about 142 intelligence analysts and two project managers across 24 field areas and three national centers. DHS forecasts a December 10, 2026 solicitation and a second-quarter FY2027 award; the opportunity has not been released, and an industry day is considered unlikely.

Hays County invests $4.5 million over ten years in Axon's AI Era technology to enhance local law enforcement operations. The contract prioritizes data oversight and privacy, amidst discussions on the implications of such long-term agreements.

Washington State Attorney General Nick Brown has successfully prevented access to sensitive data for 17 million drivers. This preliminary injunction sets a precedent for state control over personal information and may affect data-sharing practices across federal agencies.

Governor Mike Kehoe has signed Executive Order 26-18, establishing rigorous regulations on the use of Automated License Plate Reader (ALPR) technology in Missouri. Vendors must adapt to new compliance requirements regarding data retention and usage, impacting future procurement opportunities.

Oregon House Democrats, led by Rep. Nathan Sosa, propose legislation to address corporate price manipulation and protect consumer data. This initiative may impact contractors involved in pricing analytics and consumer data services, suggesting new compliance requirements.

South Dublin County Council has approved the use of Microsoft Copilot AI for specific business functions, while emphasizing the need for stringent governance over personal data. Concerns raised by Councillor Daniel Loftus could lead to increased scrutiny on how local councils engage with AI solutions in sensitive areas.

The Wylie City Council has voted unanimously to end its contract with Flock Safety due to rising privacy concerns. This growing focus on surveillance technology may lead to more stringent regulations and contract requirements in Texas and similar areas.

Fort Wayne, Indiana, and Pflugerville, Texas have unanimously terminated contracts with Flock Safety due to privacy and data security concerns. As local governments increasingly focus on balancing public safety with civil liberties, procurement opportunities for surveillance technology may become more challenging for vendors that do not prioritize data governance.

Bipartisan negotiations in Congress over child online safety and data privacy face key disagreements. The final legislation will impose significant compliance obligations on technology contractors and might shift dramatically following upcoming elections, creating potential new procurement opportunities in compliance technologies.

A recent court ruling reinforces Nevada's ability to protect voter data privacy, dismissing a DOJ lawsuit. This outcome emphasizes the need for compliance with stringent data standards in election-related procurements, impacting vendors and procurement practices in similar jurisdictions.

Washington and Oregon are leading a lawsuit against a new federal policy allowing broader access to sensitive data of TANF recipients. This initiative raises concerns about data privacy and may reshape procurement strategies for states handling federally funded assistance programs.

Anoka County Sheriff's Office has initiated a one-year pilot program with Flock Safety, expanding surveillance through up to 75 ALPR cameras and drones for $174,999. This strategic contract circumvents County Board approval, raising concerns over transparency and data privacy.

Multiple states, including **California**, **Virginia**, and **Colorado**, are enforcing website privacy laws that significantly affect both government and private procurement activities. These laws demand rigorous compliance measures, indicating a rising need for privacy technology solutions to manage consent and ensure transparency.

The U.S. Department of Commerce has revised its data privacy policy, emphasizing advanced statistical methods to enhance privacy in federal data products. Contractors in data analytics must prepare for the implications of these changes on their procurement approaches and compliance strategies.

The Department of Commerce has issued a policy change restricting federal statistical agencies to basic data protection techniques. This could significantly influence procurement strategies for data services, analytics, and technology solutions in government data operations.

U.S. Immigration and Customs Enforcement plans to award a $125 million contract to Thomson Reuters for its CLEAR database, expanding use cases to include voter fraud investigations. This emphasizes a trend towards leveraging commercial data tools in federal law enforcement, raising important privacy considerations moving forward.

Four states are prosecuting Meta for allegedly creating addictive features harmful to youth. This landmark case, with potential penalties of up to **$1.4 trillion**, may lead to stricter compliance requirements for social media companies and their contractors.

The Massachusetts Senate has proposed legislation aimed at regulating addictive social media features for minors. These changes will require social media platforms to limit potentially harmful features, signaling new procurement opportunities for technology firms focused on compliance and safety solutions.

The Framingham Police Department will discontinue its contract with Flock Safety for Automated License Plate Readers (ALPR) due to community privacy concerns. This decision opens a procurement opportunity for vendors in this sector, particularly with a new ordinance guiding future acquisitions aimed at balancing safety and privacy.

The Department of Homeland Security's ICE has secured a contract for accessing Individual Taxpayer Identification Numbers from private sources. This move aims to enhance fraud investigations within the constraints of IRS data sharing laws, highlighting procurement trends towards third-party data services.

Snapchat's recent analysis reveals significant issues in confirming complete deletion of user data due to backup systems. This underscores the need for clear contractual obligations and proactive vendor evaluations to comply with data privacy regulations like GDPR.

Nebraska's enactment of LB 525 marks a significant step in safeguarding agricultural data. With updated contract requirements effective January 1, 2027, procurement professionals must adapt to these new regulations, ensuring compliance and protection of data ownership rights.

Rhode Island's federal court ruling fortifies the state's control over voter data privacy, limiting federal access. Election systems vendors should prepare for stricter state data management requirements and assess compliance with local privacy laws.