New submitter unarmed8 shares a report from CyberScoop: Three Democratic senators introduced legislation on Thursday requiring companies to notify customers of data breaches within thirty days of their discovery and imposing a five year prison sentence on organizations caught concealing data breaches. The new bill, called the Data Security and Breach Notification Act, was introduced in the wake of reports that Uber paid $100,000 to cover up a 2016 data breach that affected 57 million users. The scope of what kind of data breach falls under this is limited. For instance, if only a last name, address or phone number is breached, the law would not apply. If an organization "reasonably concludes that there is no reasonable risk of identity theft, fraud, or other unlawful conduct," the incident is considered exempt from the legislation.

"We need a strong federal law in place to hold companies truly accountable for failing to safeguard data or inform consumers when that information has been stolen by hackers," Sen. Bill Nelson, D-Fla., said in a statement. "Congress can either take action now to pass this long overdue bill or continue to kowtow to special interests who stand in the way of this commonsense proposal. When it comes to doing what's best for consumers, the choice is clear."

System76 is rolling out a firmware update for its recent laptops that will disable the Intel Management Engine altogether. The decision comes after a major security vulnerability was discovered that would allow an attacker with local access to execute arbitrary code. Liliputing reports: What's noteworthy in the System76 announcement is that the PC maker isn't just planning to disable Intel ME in computers that ship from now on. The company will send out an update that disables it on existing computers with 6th, 7th, or 8th-gen Intel Core processors. System76 also notes that Intel ME "provides no functionality for System76 laptop customers and is safe to disable." Right now the firmware update will only be available for computers running Ubuntu 16.04 or later or a related operating system with the System76 driver. But the company says it's working on developing a command line tool that should work on laptops running other GNU/Linux-based operating systems. System76 says it will also release an update for its desktop computers... but on those machines the update will patch the security vulnerability rather than disabling Intel ME altogether.

An anonymous reader quotes a report from Ars Technica: A 60-year-old electrician in Perth, Western Australia had his termination upheld by a labor grievance commission when it was determined he had been abusing his position and technical knowledge to squeeze in some recreation during working hours. Tom Colella used mylar snack bags to block GPS tracking via his employer-assigned personal digital assistant to go out to play a round of golf -- more than 140 times -- while he reported he was offsite performing repairs.

In his finding against Colella, Australia Fair Work Commissioner Bernie Riordan wrote: "I have taken into account that Mr Colella openly stored his PDA device in an empty foil 'Twisties' bag. As an experienced electrician, Mr Colella knew that this bag would work as a faraday cage, thereby preventing the PDA from working properly -- especially the provision of regular GPS co-ordinate updates Mr. Colella went out of his way to hide his whereabouts. He was concerned about Aroona tracking him when the Company introduced the PDA into the workplace. He protested about Aroona having this information at that time. Mr Colella then went out of his way to inhibit the functionality of the PDA by placing it in a foil bag to create a faraday cage."

Facebook faced a skeptical judge over its second request to get out of a lawsuit alleging its photo scanning technology flouts users' privacy rights. From a report: "The right to say no is a valuable commodity," U.S. District Judge James Donato said Thursday during a hearing in San Francisco. The case concerns the "most personal aspects of your life: your face, your fingers, who you are to the world." The owner of the world's largest social network faces claims that it violated the privacy of millions of users by gathering and storing biometric data without their consent. Alphabet's Google is fighting similar claims in federal court in Chicago.

A real-life case study, published on New England Journal of Medicine, documents the ethical dilemma that a Florida hospital faced after a 70-year-old unresponsive patient arrived at the hospital. The medical staff, the journal notes, was taken aback when it discovered the words "DO NOT RESUSCITATE" tattooed onto the man's chest. Furthermore, the word "NOT" was underlined with his signature beneath it. The patient had a history of chronic obstructive pulmonary disease, diabetes mellitus, and atrial fibrillation. Confused and alarmed, the medical staff chose to ignore the apparent DNR request -- but not without alerting the hospital's ethics team, which had a different take on the matter. From the report: We initially decided not to honor the tattoo, invoking the principle of not choosing an irreversible path when faced with uncertainty. This decision left us conflicted owing to the patient's extraordinary effort to make his presumed advance directive known; therefore, an ethics consultation was requested. He was placed on empirical antibiotics, received intravenous fluid resuscitation and vasopressors, and was treated with bilevel positive airway pressure. After reviewing the patient's case, the ethics consultants advised us to honor the patient's do not resuscitate (DNR) tattoo. They suggested that it was most reasonable to infer that the tattoo expressed an authentic preference, that what might be seen as caution could also be seen as standing on ceremony, and that the law is sometimes not nimble enough to support patient-centered care and respect for patients' best interests. A DNR order was written. Subsequently, the social work department obtained a copy of his Florida Department of Health "out-of-hospital" DNR order, which was consistent with the tattoo. The patient's clinical status deteriorated throughout the night, and he died without undergoing cardiopulmonary respiration or advanced airway management.

Mark Wilson writes: A group going by the name Google You Owe Us is taking Google to court in the UK, complaining that the company harvested personal data from 5.4 million iPhone users. The group is led by Richard Lloyd, director of consumer group Which?, and it alleges that Google bypassed privacy settings on iPhones between June 2011 and February 2012. The lawsuit seeks compensation for those affected by what is described as a "violation of trust." Google is accused of breaching UK data protection laws, and Lloyd says that this is "one of the biggest fights of my life." Even if the case is successful, the people represented by Google You Owe Us are not expected to receive more than a few hundred pounds each, and this is not an amount that would make much of an impact on Google's coffers.