2026-06-19: Labcorp settles a 2018-2019 data breach class action for $35 million

Speaker A: Legal and Privacy Brief for June 19, 2026 LabCorp settles a UH 2018-2019 data breach class action for $35 million. The Supreme Court ruled 5, 4 that federal district courts cannot review non final state court judgments under the Rooker feldman doctrine and cited 6:3 with a Texas gun owner holding that 18 USC 922G3 cannot automatically bar marijuana users from firearm possession without showing they were incapacitated. Trump DOJ the Department of justice is trying to shield Elon Musk's Memphis X AI data center from a Clean Air act lawsuit by invoking national security. Here's the full breakdown of today's top legal and privacy stories. Legal and Privacy Brief June 19, 20206 Next Section Enforcement Actions TRUMP DOJ the Department of justice invokes national security to block Memphis air pollution lawsuit the Department of Justice Federal filed a motion to dismiss a Clean Air act lawsuit against Elon Musk's X AI data center in Memphis, arguing that attempts to shut down the facility's natural gas turbines threaten national security by cutting power to AI systems that support Department of War operations. The lawsuit, filed by the Southern Environmental Law Center, Earthjustice and the NAACP alleges that XAI operates 57 turbines without required permits, releasing formaldehyde and other contaminants into minority neighborhoods with high asthma rates. The facility was originally approved with a promise to build a water recycling plant to avoid straining local water supplies, but construction on that component has stalled. Compliance action Companies operating data centers with onsite power generation must ensure all Clean Air act permits are secured before operation. Environmental justice considerations are increasingly invoked in enforcement actions against facilities that disproportionately impact minority communities. Sources Tech Dirtwired cited Bulgaria approved surveillance tech sales to repressive regimes, 2018-2023 Human Rights Watch obtained export licensing records showing that Bulgaria allowed surveillance firm Circles to sell its products to law enforcement and intelligence agencies in El Salvador, uae, Serbia, Azerbaijan, Guatemala, Bahrain, Jordan, Malaysia, Morocco and Panama between 2018 and 2023. The tools include pixel captures, Internet data, phone calls, messages, landmark range, real time mobile phone geolocation and Voice over location Enabler software SS7 based voice call interception with location data. Circles was co founded by Tal Dilian, the executive behind blacklisted spyware firm Intelexa. A Greek court found Dillian guilty in February on charges related to Intellix's use in spying on journalists and politicians. European Commission stated that member states are solely responsible for licensing decisions on dual use exports. Compliance US Companies should audit supply chains and vendor relationships to ensure compliance with export control regulations and avoid doing business with entities linked to human rights abuses or spyware operations. The Record Human Rights Watch cited next section litigation updates $35M UM LabCorp data breach class action settlement August 2018 March 2019 Again, a $35 million class action settlement has been reached for individuals who received LabCorp diagnostic services between August 2018 and March 2019. Details on the breach affected data types and claims process were not disclosed in the brief notice, but class members may be eligible for cash payments. The settlement covers one of the larger healthcare data breach resolutions in recent years. Compliance Action Healthcare providers and diagnostic labs must review breach notification timelines and class action settlement administration procedures. Document retention policies should account for multi year settlement windows. Top Class Actions TransUnion Class Action certified Over Alleged Sham Debt Collector Scheme A North Carolina federal court certified a class action alleging that TransUnion sold Consumer Reports to Liberty Credit Management Co. Accused of participating in a fraudulent debt collection scheme affecting more than 800,000 consumers. Certification allows the case to proceed as a class action, potentially exposing TransUnion to significant liability if the plaintiffs prove that the credit reporting agency knew or should have known about Liberty Credit Management's fraudulent practices. Credit reporting agencies and data brokers must conduct enhanced due diligence on customers, particularly debt collectors and financial services firms. Implement automated monitoring for patterns suggesting misuse of consumer data source. Top Class Actions Synchrony Bank Faces Class Action Over Alleged TCPA Violations A new class action claims synchrony bank unlawfully attempted to collect on alleged debts using artificial or pre recorded voices without prior express consent in violation of the Telephone Consumer Protection Act. TCPA cases continue to generate significant liability for financial institutions and debt collectors with statutory damages of $500 to $1500 per call. Review all automated calling systems for TCPA compliance. Ensure prior express written consent is obtained and documented before using autodialed calls or prerecorded voices for debt collection. Implement opt out mechanisms and honor do not call lists. Source Top Class Actions Federal Court Allows Plaintiff to Cure Standing Defect Through Early Amendment Ziegler v. Lift the Northern District of California denied lift's motion to dismiss a punitive class action after the plaintiff Volunt voluntarily amended her complaint under Rule 15 to cure standing issues. Plaintiff Tracy Ziegler's initial complaint alleged she paid a premium for a Priority pickup ride but did not receive the benefit. Lyft moved to dismiss with evidence that Ziegler never purchased Priority Pickup. Ziegler amended to allege she paid a premium for standard rides compared to Wait and Save and added two new plaintiffs who purchased priority pickup. The court held that early timely amendments can cure jurisdictional defects, rejecting Lyft's argument that Learbo v. State Farm bars all amendments to cure standing. The decision cited royal canon Usav Wolschledger, 604 US 22,2025, which held that amendments can both destroy and create jurisdiction. Companies facing standing challenges in punitive class actions should anticipate that plaintiffs may cure defects through early amendment, document the factual basis for standing challenges thoroughly, and consider whether adding new named plaintiffs would moot the challenge. So Source Inside Class Actions Next section Regulatory guidance UK data protection complaints handling requirements effective June 19, 2026 new statutory data protection complaints handling requirements took effect in the UK on June 19, 20261 have a process for handling data protection complaints 2 give individuals a way to make complaints can be as simple as an email address, 3 acknowledge receipt within 30 days, 4 respond without undue delay and 5 communicate the outcome without undue delay. Privacy notices must flag that individuals have the right to complain and explain how to exercise it. The ico, the Information Commissioner's Office, indicated that businesses can incorporate data protection complaints into existing privacy data, subject rights request or customer complaints procedures provided complaints are appropriately identified and escalated compliance. U.S. companies with UK operations or UK customers should update privacy notices by June 19, 2026 to include complaint rights and procedures. Implement tracking for data protection complaints similar to DSAR workflows ensure 30 day acknowledgment and outcome communication timelines are met. Debavoice data blog Congress passes Copyright Office overhaul HR6028 the House of Representatives passed HR6,6028, the legislative branch agency's clarification act, in a voice vote last week. The bill removes the Library of Congress supervisory roll over the Copyright Office, transfers several powers directly to the Register of Copyrights, and makes the Register a presidential appointee confirmed by the Senate. Legislation also moves DMCA section 1201 rulemaking authority from the Librarian of Congress to the Register of Copyrights. EFF and Public Knowledge oppose the bill, arguing it makes the Copyright Office more political and weakens public interest checks and balances. The bill awaits Senate action Compliance Action Companies relying on DMCA section 1201 exemptions security, research, repair, Preservation, accessibility should monitor the Senate's action ON H R UH6028 and prepare for potential changes to the rulemaking process if the bill becomes law. Tech Dirt Canada advancing Bill C22 lawful access bill without debate Canada is advancing Bill C22, the lawful access bill without serious debate on proposed amendments. The bill requires metadata retention, expands information sharing with foreign governments, and establishes a mechanism allowing Canada's Ministry of Public Safety to demand that companies create backdoors, effectively breaking encryption Signal. Apple, Google and several VPN providers oppose the bill, with some indicating they may cut Canadians off from certain features or shut down services in Canada if it passes. The Canadian government wants the bill passed before June 19th. Citizen Lab and the Canadian Civil Liberties association conclude that most elements are unsalvageable. US Technology companies offering encrypted services to Canadian customers should evaluate contingency plans. If Bill C22 passes, prepare communications to Canadian users about potential service changes or discontinuation sources. EFF Citizen Lab cited next section Privacy developments UK moves forward with under 16 social media ban Effective spring 2027 the UK government announced plans for a social media ban for users under 16, set to take effect in spring 2027. The ban applies to Snapchat, TikTok, YouTube, Instagram, Facebook and X uh, children's wellbeing and schools Bill requires highly effective age assurance measures to Prevent children under 16 from becoming or being users of all regulated user to user services. An amendment proposed in the House of Commons would raise the age to 18 and grant the Secretary of State authority to specify Internet services and features subject to restriction. The provision also requires Internet service providers to limit the time kids spend online and restrict who can contact them. EFF and digital rights groups oppose the measure of arguing there is no reliable privacy preserving method of verifying the age of every Internet user. Social media platforms and user to user services accessible in the UK should begin planning age verification implementation strategies, evaluate privacy preserving age verification technologies and prepare for potential challenges from digital rights organizations. EFF UK Home Office deploying facial age estimation at border 2027 the UK Home Office plans to deploy facial age estimation to assess asylum seeking children starting in 2027. EFF, Foxglove, Human Rights Watch and 60 organizations raised concerns in a letter to the Minister of State for border security and asylum 1. Fae is biased and performs poorly on women and people of color. 2. The Home Office admits FAE systems are imprecise for 1618 year olds with top systems having an error margin of around 25 years. 3. Unclear lawful basis for collecting and processing photographs or data from asylum seeking children to train the system. 4. No published results from extensive testing or equality data protection impact assessments. The coalition requested clarification within 21 days. Companies developing or deploying facial recognition or age estimation technologies should prepare for increased scrutiny of bias accuracy training data provenance and impact assessments, particularly for systems affecting vulnerable populations. Source EFF Plaza Home Mortgage alerts customers and employees of data Security Incident San Diego based mortgage lender Plaza Home Mortgage notified customers and employees of a security incident in which an unauthorized party may have accessed personal information. No details on the scope of the breach, data types affected, or number of individuals were disclosed. Compliance Action Financial institutions and mortgage lenders must ensure breach notification procedures comply with state laws, including California's 500 person Attorney General notification threshold and Grammleach Bliley act requirements. Source Top Class Actions Next Section Policy Changes Jawbone Act Introduced to Prevent government coercion of Online Speech Senators Ted Cruz and Ron Wyden introduced the Justice Against Weaponized Bureaucratic Overreach to Networked Expression. Jawbone Act Bipartisan legislation creates a federal cause of action against government officials who coerce or attempt to coerce broadcasters, interactive computer services, or AI providers in taking actions against lawful First Amendment protected speech. It also establishes a transparency system for government communications with intermediaries about user expression. The bill addresses concerns about government jobning, where officials pressure private companies to censor speech. EFF supports the bill but notes that not every communication from a government agency to a platform is unconstitutionally coercive and social media platforms retain First Amendment rights to moderate user speech. Technology companies should document all government requests or communications regarding content moderation Implement clear internal processes to distinguish between lawful requests for information and potentially coercive demands to remove protected speech sources EFF Tech Dirt Open Courts act of 2026 would eliminate PACER fees EFF joined a broad coalition supporting the Open Courts act of 2026, legislation that would modernize federal courts electronic filing systems and eliminate PACER fees. PACER currently collects more than $150 million annually in fees from the public for access to court records, which are public documents. The bill would replace PACER and CMECF with a modern, unified platform designed to improve public access, strengthen cybersecurity, and reduce long term costs. Legislation builds on a similar proposal that previously won bipartisan support in the Senate Judiciary Committee but did not become law. Compliance Action Legal departments and compliance teams relying on PACER for monitoring litigation should track the Open Court's Act's progress if enacted. Budget for transition to new systems but plan for elimination of per page access fees. Source Effort Trump Administration AI policy retaliation against Anthropic the Trump administration designated Anthropic a supply chain risk, effectively banning agencies and government contractors from doing business with the company after Anthropic resisted government demands to use its models for Autonomous Weapons and Domestic Surveillance Court issued a preliminary injunction preventing sanctions from taking effect. In a recent executive order, the Administration imposed export controls banning foreign nationals from using Anthropic's Mythos and Fable models, forcing Anthropic to shut down the models. EFF and civil liberties organizations filed an amicus brief arguing the sanctions are, uh, unconstitutional retaliation for protected speech. The Administration justified the export controls by claiming Mythos class models could exploit software vulnerabilities, but other LLMs with similar capabilities are not subject to export controls. Compliance Action AI companies should document all government communications and requests. Evaluate whether refusal to comply with non compulsory government requests could result in designation as a supply chain risk or other sanctions. Source EFF Next section Supreme Court Decisions Ruckerfeldman Doctrine Applies to Non Final state court judgments um University of Maryland Medical System Corp. The Supreme Court held 54 that the Ruckerfeldman doctrine bars federal district courts from reviewing state court judgments regarding regardless of whether the judgment is final or subject to further state court review. Justice Sonia Sotomayor wrote for the majority that limiting the doctrine to final judgments would create anomalous outcomes and disrupt cooperation and comedy. The case involved a Maryland woman, T.M. um seeking federal court review of a consent order from a state court lawsuit related to her involuntary hospital admission. Justice Amy Kanye Barrett dissented, joined by Chief Justice Roberts and Justices Kagan and Gorsuch Rose, arguing the opinion leaves the doctrine worse off. Justice Clarence Thomas wrote a 14 page concurrence defending the doctrine. Compliance Action Litigants cannot bypass the Rooker Feldman bar by filing federal suits before state court proceedings conclude. Companies facing parallel state and federal litigation must carefully sequence appeals to avoid jurisdictional bars. Skadu SBLOG Supreme Court Rules Federal law cannot automatically bar drug users from gun possession. United States Fee the Supreme Court ruled in United States v. Himani that the federal government cannot prosecute individuals under 18 USC 922, which bars unlawful users of or addicted to any controlled substance from possessing firearms without showing the individual was regularly incapacitated. Justice Neil Gorsuch wrote for the majority that the government's reliance on early American laws targeting habitual drunkards failed the Bruin test because those laws required showing someone was practically incapacitated and incapable of managing their affairs, not merely that they regularly used intoxicants. The case involved Ali Hemani, a Texas man found with a Glock 1960 grams of marijuana and 4.7grams of cocaine who admitted using marijuana approximately every other day. 5th Circuit previously ruled the law unconstitutional as applied to habitual drug users not shown to be under the influence when possessing a gun. Compliance Federal firearms licensees should not rely solely on 18 USC 922 G3 to deny gun purchases to admitted drug users. Law enforcement agencies must document evidence of incapacitation, not just regular drug use, to support prosecutions. Sources Peel Waivers unenforceable when they would cause miscarriage of justice Hunter v. United States The Supreme Court ruled 8:1 that defendants can sometimes appeal a conviction or sentence even when they agreed not to do so if enforcing the waiver would result in a miscarriage of justice. The case involved Munson Hunter, who pleaded guilty to aiding and abetting wire fraud and waived his right to appeal except for ineffective assistance of counsel claims. Hunter wanted to challenge a supervised release condition requiring mental health treatment and medication, but the 5th Circuit ruled the appeal waiver barred the challenge. Justice Elena Kagan wrote for the majority that the Fifth Circuit should have reviewed whether enforcing the waiver would leave in place the kind of egregious error that would bring the judicial system into disrepute. The Court remanded for the Fifth Circuit to apply that standard. Justice Clarence Thomas dissented alone, arguing there was no basis for excusing Hunter from his appeal. Waiver compliance action Prosecutors negotiating plea agreements should recognize that appeal waivers are not absolute. Courts will review whether enforcement would result in a miscarriage of justice, particularly for sentencing conditions imposed without adequate notice or advisement. Skadu S blog compliance takeaways UK data protection complaints controllers with UK operations must update privacy notices by June 19, 2026 to disclose complaint rights and procedures. Implement 30 day acknowledgment tracking for data protection complaints. Age Verification Mandates Companies operating user to user services in the UK should begin evaluating age verification technologies ahead of the spring 2027 under 16 social media ban no privacy preserving solution exists at scale Government joboning documentation Document all government communications regarding content moderation the Jawbone act, if enacted, creates a federal cause of action for government coercion of speech suppression. DMCA section 1201 rulemaking monitor H. R6028 in the Senate if enacted DMCA exemption Rulemaking authority transfers from the Librarian of Congress to the politically appointed Register of Copyrights. Class Action Standing Cures Expect plaintiffs to cure standing defects through early Rule 15amendments, including by adding new named plaintiffs. Lift and similar cases show courts will allow amendments that create jurisdiction. Analysis based on 33 legal and regulatory articles collected June 19, 2026 that concludes today's legal and privacy brief from Carolina Clear Tech for informational purposes only, not legal advice.