Morning Briefing: Privacy

There was no major privacy ruling yesterday. The clearest movement came from breach response: Instructure said it reached an agreement with the actor behind the Canvas intrusion, recovered the stolen data, and received digital logs meant to show deletion. That may reduce the immediate leak threat, but it does not end the privacy exposure because the company also said it cannot be certain every copy is gone.

For schools and universities, the issue now is downstream misuse. Instructure said the exposed data included names, email addresses, student ID numbers, course and enrollment information, and Canvas messages. Even without passwords, birth dates, government IDs, or financial data, that mix is valuable for phishing, impersonation, and social engineering, especially after an outage that hit students and faculty during finals.

New York City's planned renewal of its Rikers Island phone contract with Securus put detention surveillance back in focus. Critics say modern jail-phone systems can do far more than record calls, including building voiceprints, mapping relationships, and using AI to flag conversations, while past concerns about recording attorney-client calls have not fully faded. Like recent disputes over camera-network renewals, this is another case where local procurement terms may matter more than any new statute.

Separate reporting also revived scrutiny of ICE's use of driver-license databases, facial recognition, vehicle tracking, and cell-phone geofencing inside the U.S., largely by resurfacing existing Georgetown Law research rather than marking a new court or regulator step. And NVIDIA confirmed a smaller but concrete user-data breach at a GeForce NOW partner in Armenia, a reminder that privacy exposure still often enters through regional operators and vendors rather than a company's core platform.