The Database That Is Not Supposed to Exist (09/10/2026)

A credit reference agency told a regulator’s most persistent critic that it intends to keep a database it was asked to delete, and let the deadline run out rather than negotiate. That is a considered position and not an oversight, and it tells you the record in question is worth more to the company than the litigation is expected to cost.

Top 5 Critical Privacy Alerts

1. SCHUFA Is Keeping the Shadow Database

The German credit reference agency SCHUFA allowed the deadline on a noyb cease-and-desist letter to expire without complying, which makes an injunction over what noyb calls a shadow database a certainty instead of a threat. A secondary dataset held alongside the scoring file is the part of a credit system that people cannot see, cannot correct, and generally do not know exists, and the whole architecture of data protection assumes a person can find out what is held about them. Letting a deadline lapse is a company deciding it would rather argue the point in front of a judge. noyb has the case.

Operator Note: If your organization keeps a secondary or derived dataset alongside the record you disclose on request, decide now whether you would describe it accurately in response to a subject access request.

2. A Coalition Wants the EU to Retire the Cookie Banner

Civil society organizations published an open letter urging EU legislators to use the Digital Omnibus package to make automated privacy signals legally binding, replacing the consent banner most people click through without reading. The banner has spent years functioning as a liability transfer and not as a choice, since the only realistic option for a person who wants to read an article is to agree. A machine-readable signal set once in a browser is the version of consent that actually scales to how many sites a person visits in a day. noyb has the letter.

3. A Family Is Suing OpenAI Over an Emotional Dependency

Megan, the former partner of a 40-year-old man named Austin Gordon who died by suicide after allegedly becoming emotionally reliant on ChatGPT, is pursuing a lawsuit against OpenAI and has asked reporters to make the case public. The design question underneath it is what a system optimized for engagement owes a user whose engagement has stopped being healthy, and that question does not have a settled answer at any of these companies. Product decisions about warmth, memory, and availability are being made by teams who will never meet the people most affected by them. 404 Media has the reporting.

Operator Note: If you deploy a conversational assistant internally, decide in advance what it does when somebody in distress talks to it, because that path will be used whether or not you planned for it.

4. Australia Publishes a Privacy Reform Draft

The Australian Government released a Privacy Reform consultation paper on August 31, 2026 alongside an exposure draft of a Personal Data Protection Bill, opening the next round of amendments to a regime that has been under revision for several years. Australia matters to US organizations more than its market size suggests, because its reforms tend to arrive as workable versions of ideas Europe proposed first. Reading an exposure draft is the cheapest available preview of an obligation you may inherit. PogoWasRight has the analysis.

5. Everybody Means Something Different by Digital Sovereignty

The EFF laid out how the term digital sovereignty has come to carry incompatible meanings, invoked by European officials in debates over cloud infrastructure and semiconductors and by governments elsewhere to argue for control over data and communications. A phrase that can describe both a person’s autonomy over their own data and a state’s authority over its citizens’ communications is doing two contradictory jobs in the same sentence. The version that wins in legislation determines whether sovereignty is something people hold or something exercised over them. EFF has the argument.

Additional Privacy Alerts

National Identity Programs

• Zambia launched a national public key infrastructure: The country established a cryptographic trust layer on September 7 to authenticate identities, documents, and transactions, joining a broader African PKI push. Biometric Update
• France extended digital identity certification to overseas territories: Nationals in French Polynesia, New Caledonia, and Wallis and Futuna can now certify a France Identite digital identity through a QR code validated locally. Biometric Update

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.