Paul Quigley

Edinburgh-based legal tech startup Wordsmith AI secures €4.6M in seed funding led by Index Ventures, with participation from General Catalyst and others. CEO Ross McNairn discuss how AI is enhancing legal operations globally. Read more about their innovative journey! #LegalTech #AI #StartupNews https://lnkd.in/grYVzG4M

1

The Irish Data Protection Commission (DPC) has withdrawn its action against X concerning the use of personal data from user posts for training the AI model 'Grok'. This follows X's commitment to permanently suspend such data processing. This move may initiate a deeper examination of GDPR's role in AI data processing. #DataPrivacy #GDPR #AI #AdvertisingCompliance https://lnkd.in/edjCVYQk

3

Irish proceedings remind firms of data protection obligations when developing AI: Upcoming High Court proceedings between the Irish Data Protection Commission (DPC) and X, formerly Twitter, will be hugely significant to businesses using personal data to train artificial intelligence (AI) systems, according to experts. #dataprotection #dataprivacy #privacy

5

🔎 PRIVACY WATCHDOG EYES ELON MUSK: Concerns raised over user data opted into Grok AI training #ElonMusk #GrokAI #DataPrivacy #IrishDataProtectionCommission #UserData #GDPR #LinkedIn #DataProtection The Irish Data Protection Commission (DPC) has expressed surprise and concern regarding Elon Musk's decision to automatically opt-in user data for training Grok, an AI chatbot developed by his company xAI. This move has sparked scrutiny, as it is unclear whether X, formerly known as Twitter, has a valid legal basis for processing user data under EU privacy laws, such as the General Data Protection Regulation (GDPR). The situation echoes recent complaints against Meta for repurposing Facebook and Instagram user data for AI training. As the DPC continues to monitor the issue, users can opt-out of data sharing in their X settings to protect their personal information.

1

👀 𝐖𝐡𝐞𝐧 𝐢𝐬 𝐆𝐨𝐨𝐠𝐥𝐞 𝐚𝐜𝐭𝐢𝐧𝐠 𝐚𝐬 𝐚 𝐜𝐨𝐧𝐭𝐫𝐨𝐥𝐥𝐞𝐫 𝐨𝐟 𝐢𝐭𝐬 𝐬𝐞𝐚𝐫𝐜𝐡 𝐞𝐧𝐠𝐢𝐧𝐞? ✏️ In a recent case in Germany a data subject sought a Court order compelling Google Ireland Limited (the controller) to erase search results that linked to an article which contained false information about the data subject and included a photograph of the data subject that infringed the data subject’s copyright. 🇮🇪 The Court in Germany held that Google Ireland Limited as the operator of the Google search engine, is a controller for displaying search results, irrespective of the fact that the search results are provided by the US based Google LLC. 🚷Here, in an expansion of the decision in Google Spain, the Court held that the mere display of information containing personal data constitutes the processing of such data. 🌐The fact that the company itself does not decide which and how search results are displayed is therefore irrelevant according to the court. 📵By offering German internet users access to the search engine, it provided users with the search results prepared by its parent company Google LLC and thus carried out data processing within the meaning of Article 4(2) GDPR ⚠️Notably the Court of First Instance had agreed with Google Ireland's view that they are not the controller, but the US based Google Limited Liability Company (LLC), because they make the decisions about how to respond to a search query and how the relevant search results are displayed. ✅Google LLC was also named as the controller in the privacy policy. Although Google Ireland Limited operates the Google search engine in Germany and other European countries, it had no influence on how the search results were generated. 🔐The court therefore dismissed the action for injunctive relief and request for erasure. The data subject appealed the decision of the first instance court for failing to recognise that Google Ireland Limited is a controller under Article 4(7) GDPR (https://lnkd.in/ez2DzkXA). It further requested the court to erase the search results related to the article with inaccurate information of the data subject. See more here from GDPRhub 🔗 https://lnkd.in/eRdshhYV

16

1 Comment

What are lessons we are discussing with clients following some highly publicized privacy statement revisions: 🔹 Regulators are putting a high value on transparency (see Data Protection Commission Ireland's Graham Doyle's statement in Fox Rothschild's privacy summit https://lnkd.in/efaqPWdn); Office of the New York State Attorney General enforcement advisory https://lnkd.in/gCXubc5N); and they are looking specifically at privacy disclosures (California Privacy Protection Agency's Michael Macko on enforcement priorities https://lnkd.in/eAjUAKRr); this is also evident from the complaints in many pixel based lawsuits. It is good practice to prioritize putting your consumer facing notices in order. You also need to make sure that what you do in practice matches what you say you do. 🔹 When data processing in multiple services overlaps considerably, or when a user is likely to use multiple services - it is better to consolidate the privacy disclosure into one document, rather than have multiple documents that overlap. This also echoes statements made in the US in the recent Texas AG enforcements as well as by EU regulators like the Ireland DPC in the Meta cases 🔹 Your goal should be that your target audience should be able to easily understand your privacy notice and that when done reading the document, actually understand what you are doing with their data. It is not enough that the document looks good - it need to clearly, fully and accurately reflect your data collection practices. If you feel inclined to use vague language - ask yourself why that is - is this a practice that you don't know enough about? (If so, resolve to learn more about it and amend the privacy notice ASAP) or is it something that you think if your users knew what you were doing you would have a bad gut reaction to it (if that's the case, you should reassess that practice, it is likely to give rise to causes of action such as unfair or deceptive acts or practices etc). 🔹 The design and layout of the notice should be clear and use friendly too. DPC in Meta commented specifically on the titles of privacy notices. It is helpful to include explanations. 🔹 If you collect and process sensitive information, it is helpful to highlight those uses. 🔹 It is a good idea to highlight customer tools like the ability to delete personal data #dataprivacy #dataprotection #privacyFOMO pic by ChatGPT

28

3 Comments

Both the EU AI Act and the Irish Online Safety and Media Regulation Act 2022, which gives rise to the new online safety code, use a risked-based assessment to determine which companies and technologies have the greatest regulatory obligations. Both kick the most substantial and tricky issues – how to manage or prevent those harms, and define them in the first place – back to companies. This means that the online safety code is both too specific and too vague, writes Karlin Lillington. https://bit.ly/3NHK6IZ

2

In today's brand new episode of the AI Ireland podcast, host Mark Kelly is joined by Jared Browne, Head of Privacy and AI Governance at Fexco. In this episode, Jared discusses the EU AI Act, explaining its risk-based approach, its focus on trust, safety, and sustainability in AI and the need for companies to prepare for compliance. Jared also highlights the Act's complexity, enforcement challenges and global implications. 🎧Listen now 👉 https://lnkd.in/eSiWwCWa #aiireland #euaiact #aigovernance #airegulation #podcast

7

3 Comments

With recent developments surrounding data privacy laws in the European Union, the popular social media platform, X, finds itself amidst quite a stir. In line with a compelling decision by an Irish court, X has committed to suspending the use of data belonging to EU citizens, which was hitherto leveraged for AI chatbot training. Now, ascending above the immediate turmoil, let's dive into extrapolating what these shifts could possibly mean for the future landscape of Artificial Intelligence and Data Privacy: • Preservation of privacy will become non-negotiable: As reflected by this precedent, tech giants will likely strengthen their commitment to safeguarding individual privacy. This, in turn, may yield improved trust between consumers and platforms, fostering beneficial relationships in the digital realm. • Fostering a responsible AI culture: This is a likely reality where users' data will be responsibly handled. We could foresee an influx of ‘privacy by design’ models, where AI technologies would be architected with a user’s privacy as the foundation. • Draws legislation likely: In tandem with resolving individual cases, a broader legislation process addressing data digitization might be in the pipeline. This could ensure future scenarios are navigated per established directive, thereby bringing in greater stability and predictability. • Innovation amidst constraints: Despite a potential diminution in available data, there persists an optimistic chance for harboring innovation. Companies would be likely to develop novel techniques to make AI systems Broad, robust, and resilient even with less data availability. As professionals in the digital and AI spaces, we are well-aware of the intricate balance that must be maintained between leveraging user data and respecting individual privacy. This recent development with X emphasizes the need for us to remain adaptive and proactively reassess our approach to the utilization of data. In a nutshell, privacy-focused turns in data utilization policy, like X's, corroborate the growing receptivity towards data rights. None of this suggests an end to AI process innovation but rather opens up space for them to exist more responsibly. What’s unquestionable is that the reminded focus on this blend of corporate responsibility and innovation sets the stage for exciting future developments in the AI realm. So, let’s roll up our sleeves and brace ourselves for the changing terrain ahead! #DataPrivacy #AIInnovation #AIEthics

2

The Irish Data Protection Commission (DPC) has scored a significant win against X’s AI model, Grok. This landmark case could signal a shift in the DPC’s GDPR enforcement strategy. Key insights: The Irish High Court has confirmed the DPC’s enforcement actions. X must stop processing and delete users’ data used for AI training. This is the first use of the DPC’s powers under the Irish Data Protection Act 2018. Is this the beginning of a more assertive DPC? Find out more about this pivotal case and its implications for data protection enforcement in the EU in our latest blog👉https://lnkd.in/earABuvp #DataProtection #GDPR #AI #Privacy #DPC #TechNews #Regulation #AIethics

5

𝐗 𝐡𝐚𝐥𝐭𝐬 𝐝𝐚𝐭𝐚 𝐩𝐫𝐨𝐜𝐞𝐬𝐬𝐢𝐧𝐠 𝐟𝐨𝐫 𝐀𝐈 𝐦𝐨𝐝𝐞𝐥 𝐓𝐡𝐞 Data Protection Commission Ireland (DPC) 𝐡𝐚𝐬 𝐰𝐞𝐥𝐜𝐨𝐦𝐞𝐝 𝐚𝐧 𝐚𝐠𝐫𝐞𝐞𝐦𝐞𝐧𝐭 𝐫𝐞𝐚𝐜𝐡𝐞𝐝 𝐰𝐢𝐭𝐡 𝐭𝐡𝐞 𝐬𝐨𝐜𝐢𝐚𝐥-𝐦𝐞𝐝𝐢𝐚 𝐩𝐥𝐚𝐭𝐟𝐨𝐫𝐦 𝐗. 🤖 The platform, formerly known as Twitter, has agreed to suspend its processing of the personal data contained in the public posts of X’s users in the EU and the EEA for use in the training of its AI model, called ‘Grok’. ⏰ The suspension applies to data processed between 7 May 2024 and 1 August 2024. ‼️‘𝐔𝐫𝐠𝐞𝐧𝐭 𝐧𝐞𝐞𝐝’ 𝐓𝐡𝐞 𝐃𝐏𝐂 𝐡𝐚𝐝 𝐛𝐫𝐨𝐮𝐠𝐡𝐭 𝐚𝐧 𝐮𝐫𝐠𝐞𝐧𝐭 𝐇𝐢𝐠𝐡 𝐂𝐨𝐮𝐫𝐭 𝐚𝐩𝐩𝐥𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐚𝐠𝐚𝐢𝐧𝐬𝐭 𝐗 𝐮𝐧𝐝𝐞𝐫 𝐬𝐞𝐜𝐭𝐢𝐨𝐧 134 𝐨𝐟 𝐭𝐡𝐞 𝐃𝐚𝐭𝐚 𝐏𝐫𝐨𝐭𝐞𝐜𝐭𝐢𝐨𝐧 𝐀𝐜𝐭 2018. ⚠️This section allows the DPC, where it considers that there is an urgent need to act to protect the rights and freedoms of data subjects, to make an application to the High Court for an order requiring the data controller to suspend, restrict, or prohibit the processing of personal data. ⚖️ The application was made before Ms Justice Reynolds, who indicated in her concluding remarks that the rights and freedoms of data subjects across the EU/EEA were at the core of the application. ⚠️This was the first time that the DPC had sought to use its powers under section 134. ⬇️See more here ⬇️ Law Society of Ireland

10

The Data Protection Commission (DPC) has today (27.9.2024) announced its final decision following an inquiry into Meta Platforms Ireland Limited (MPIL). This inquiry was launched in April 2019, after MPIL notified the DPC that it had inadvertently stored certain passwords of social media users in ‘plaintext’ on its internal systems (i.e. without cryptographic protection or encryption). The DPC submitted a draft decision to the other Concerned Supervisory Authorities across the EU/EEA in June 2024, as required under Article 60 of the GDPR. No objections to the draft decision were raised by the other authorities. The final decision notified to the MPIL yesterday September 26, includes a reprimand and a fine of €91million. The DPC’s Decision records the following findings of infringement of the GDPR: 👉 Article 33(1) GDPR, as MPIL failed to notify the DPC of a personal data breach concerning storage of user passwords in plaintext; 👉 Article 33(5) GDPR, as MPIL failed to document personal data breaches concerning the storage of user passwords in plaintext; 👉 Article 5(1)(f) GDPR, as MPIL did not use appropriate technical or organisational measures to ensure appropriate security of users’ passwords against unauthorised processing; and 👉 Article 32(1) GDPR, because MPIL did not implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the ability to ensure the ongoing confidentiality of user passwords. Link in the comments!

11

1 Comment

The IIC UK Chapter will be taking place tomorrow with topic discussions covering: ✅ Plurality: Impacts on news and media of shift to online advertising ✅ Competition: What issues are emerging and what is CMAs view – see Privacy Sandbox , AdTech cases, DMCCA. And international cases. ✅ Privacy: How can rights to privacy be protected and growth generated? Speakers include: Ali-Abbas Ali, Johan Keetelaar, Lynn Robinson, Sebastian Cuttill, Tim Cowen. The event is kindly hosted by Oxera Consulting LLP. Find out more information by visiting below: https://lnkd.in/exA6NdXg #theiic #ukchapter #plurality #AI #media #digitalworld #policy #dataprivacy #competition #dataprivacy

14

Introducing OneAdvanced Legal: the latest in cloud practice and case management, specifically developed for UK and Irish law firms. Discover how it's setting new standards in efficiency and customer service. #OneAdvancedLegal #LegalTech

4

Recent regulatory actions against Google and Uber highlight the increasing scrutiny companies face over GDPR compliance, especially when handling cross-border data transfers and high-risk data processing activities. Recently it has made it to the news that The Irish Data Protection Commission (DPC) is investigating whether Google conducted a Data Protection Impact Assessment (DPIA), a process designed to identify and mitigate risks to personal data when conducting high-risk processing activities, as required under Article 35 of the GDPR. Similarly, Uber is facing a €290 million fine from the Dutch Data Protection Authority for transferring sensitive driver data to the U.S. without sufficient safeguards in place. To avoid similar legal challenges, companies should take the following steps: 1. Conduct Thorough DPIAs: - Under GDPR, businesses must conduct a DPIA when data processing is likely to pose a high risk to individuals' privacy, especially when new systems or data uses are involved. - Ensure that DPIAs are conducted for all high-risk processing activities, thoroughly assessing risks and implementing appropriate measures to mitigate them. 2. Secure Cross-Border Data Transfers: - When transferring personal data outside the EU, businesses must ensure compliance with GDPR by using approved mechanisms such as Standard Contractual Clauses (SCCs) or Binding Corporate Rules (BCRs). - Regularly review transfer mechanisms and implement additional safeguards where necessary to comply with GDPR's strict data protection standards. By implementing these measures, businesses can stay ahead of regulatory scrutiny, avoid truly hefty fines, and demonstrate a strong commitment to protecting individuals’ data in line with GDPR requirements. #GDPRCompliance #DataProtection #CrossBorderTransfers #DPIA #LegalCompliance #PrivacyLaw #DataGovernance #RegulatoryCompliance #BusinessRiskManagement

18

2 Comments

🤖📵Elon Musk’s Grok AI faces EU scrutiny for ‘opting in’ every X user’s personal posts without asking ⤵️ Data Protection Commission Ireland says it is “surprised” by the move, with other privacy experts saying it is against EU data privacy law, partially because it cannot be changed by X users on smartphones. 🚫However, there is a way of opting out on desktop versions of X. ⚠️The DPC is “surprised” that Elon Musk’s X platform has automatically ‘opted in’ all X users into its Grok AI training programme without a choice. The watchdog says that it will now probe the matter further with X to see whether it complies with EU privacy law. The move, which cannot be reversed by those using the mobile app, means that Grok AI is using X users’ personal information, including posts, to build its own AI as a rival to ChatGPT and Google Gemini. "The DPC has been engaging with X on this matter for a number of months, with our latest interaction occurring as recently as yesterday," said a spokesperson for the DPC. "Therefore we are surprised by today's developments. We have followed up with X today and are awaiting a response. We expect further engagement early next week." News of the move came as a surprise to many on X, who weren’t previously notified of the opt-in. Privacy experts here have cast doubt on whether the move meets European standards. ⬇️See more here ⬇️

6