Christina Montgomery

Am delighted to share that OpenText eDiscovery has been named as a Leader and Outperformer by GigaOm Radar. If you'd like to learn more about our Legal Technology solutions and expertise, please click on the link below or contact us directly. #ediscovery #gigaom #legaltechnology #ai #radarreport

11

Interesting point of view from the CPPA regarding the American Privacy Rights Act Discussion Draft, and to see that overall Privacyt rights are taken more seriously at a state level. #dataprivacy #CPPA #CCPA

1

The data privacy landscape is evolving rapidly, and recent efforts in New England highlight both progress and challenges.   While Connecticut, New Hampshire, and Rhode Island have successfully enacted comprehensive data privacy laws, setting a strong precedent for the region, Maine and Vermont have faced hurdles with their approaches. These developments emphasize the importance of balancing consumer protection with business viability. As things become more complex, interoperability between state laws is also crucial to minimize confusion and ensure smooth compliance for businesses and consumers alike.   Progress at the state level demonstrates the desire for protections across the US. I believe there's a continued need for a harmonized federal privacy framework -- ensuring comprehensive privacy laws empower consumers and foster innovation. 🛡️✨ https://lnkd.in/gmNivnQJ

42

5 Comments

As someone who has spent years supporting trusted technology that advances consumer protection, competition, and privacy, I found @Arlo Gilbert’s article on @Dark Reading, “Is a CPO Still a CPO? Privacy Leadership’s Evolving Role,” particularly resonant. The role of a Chief Privacy Officer has truly transformed – especially over the past few years!   Today, a CPO cannot think about just data protection. The intersection of privacy, security, safety, ethics and even competition and geopolitical pressures all impact the CPO role. For many CPOs, responsibilities now extend beyond compliance to ensuring ethical data use across a spectrum of issues including AI data governance. This broader scope is crucial for building and maintaining trust in our digital world.   Effective privacy management also requires close cooperation with CISOs, CDOs, CTOs, Legal, Engineering, CCO, CFO, and other key players. Teamwork is essential to tackle the diverse challenges we face, from data breaches to digital safety, security, and of course, AI.   How is your role changing in this AI era?

157

7 Comments

In April 2024, the California Privacy Protection Agency ("CPPA") released an enforcement advisory titled "Implementing Data Minimization in Consumer Requests," highlighting data minimization as a cornerstone principle of the California Consumer Privacy Act ("CCPA"). The principle requires companies to collect only the minimum consumer information necessary. This is especially important when handling consumer requests, including opt-out requests for selling or sharing personal data. The advisory serves as a reminder for businesses to review their data practices to comply with the CCPA's data minimization requirements. Stay informed on #CCPA and #Privacy regulations to ensure your business is complying with the latest guidelines.

11

I saw a recent article from Artificial Lawyer speaking to Jon Fowler on "How Will GenAI Change eDiscovery" It was a very in-depth article, covering (in part) his history with eDiscovery. One of the points mentioned that jumped out at me was the point that many lawyers expressed concerns that predictive coding would replace human judgment (where is Sarah & John Connor when you need them 😝). It also talks about how deepfake's could affect the future for eDiscovery. I felt is was a great insight into how an expert in the Legal Tech Sector sees the future of eDiscovery, The good, The Bad and The Ugly (2nd film drop). I feel that it is definitely worth reading, so have included the link below. #eDiscovery #GenAI #LegalTech https://lnkd.in/ebYBx3Z9

4

The U.S. privacy landscape is maturing and moving beyond the box checking to real data governance will be critical as companies are looking to leverage data in connection with their AI initiatives. Im excited to join Professor Solove for a conversation about how companies should think about this evolution and the practical/structural steps they can take. Register below 👇🏾

50

1 Comment

Not another webinar on "it's complicated"! At 11 am EST today (and if you can't make it, register to get the recording from OneTrust!) I will be discussing, together with Alexandra Moylan, Esq., CIPP/US, Julia Jacobson, and Michael Halaiko Esq., CIPP/E what you need to know about the new new state privacy laws and how does the Federal privacy bill #APRA affect them. We will discuss key issues and differences and what are some steps that you need to take to move along with your privacy compliance without #patchworkparalysis (Keir Lamont inspired by you and feel free to re-use 😉) #dataprivacy #dataprotection #privacyFOMO https://lnkd.in/eqWMx2SA

29

2 Comments

In a new Future of Privacy Forum blog post, Jameson Spivack explores the emerging legislative frameworks for governing synthetic content, the relevant policy questions animating discussions about these governance approaches, and how these discussions might evolve over the next year. Give it a read and let us know what you think! Report on synthetic content: https://lnkd.in/gSNAJ8Zi Blog post: https://lnkd.in/gHJr7iyN

11

2 Comments

State Data Privacy Laws: To date, 17 states have adopted comprehensive data privacy laws – most recently Maryland. And Vermont’s legislature just passed a data privacy law that would become one of the strongest data privacy laws in the country if signed into law by the Vermont Governor. It contains a private right of action for violating an individual’s privacy rights. To date, most states have not adopted a private right of action because of concerns it would open up the floodgates to litigation and bankrupt businesses. This is similar to the Illinois Biometric Information Privacy Act (BIPA) and class actions brought under this statute have exploded over the last several years. In 2023, hundreds of BIPA cases were filed in both federal and state court because of the potential for extremely large class action settlements and verdicts. Indeed, in 2020, Google settled a BIPA case for $650 million and the first BIPA case to go to trial resulted in a jury verdict of $228 million for truck drivers in 2023. That case recently settled for $75 million. New York City has also enacted a biometric law that allows for a private right of action. Even the California Consumer Privacy Act, believed to be the strongest comprehensive data privacy law, only provides a private right of action for data breaches. The United States has taken a patchwork approach to data privacy with the potential of each state creating a different set of rules similar to the 50 different data breach laws that currently exist. This has resulted from the lack of one comprehensive federal law that governs privacy and preempts state law. The costs of America’s patchwork approach of different and sometimes conflicting state privacy laws will only continue to rise. Numerous studies have estimated that the potential financial impact of complying with 50 different state laws could surpass $1 trillion over a decade and small business will likely shoulder a minimum of $200 million. A federal data privacy law such as American Privacy Rights Act would cost significantly less for businesses and bring needed consistency across all states. Additionally, the U.S. Federal Trade Commission is increasingly investigating data privacy practices and imposing civil penalties against organizations for failing to take reasonable steps to protect personal information. Section 5 of the Federal Trade Commission (FTC) Act prohibits unfair or deceptive acts or practices, including unfair practices involving the collection, use, disclosure, processing, and protection of consumers’ personal information. In those cases, the FTC has taken the position that inadequate data security practices may constitute unfair and deceptive practices under the FTC Act. Compliance with privacy and cybersecurity laws and regulations have become a priority for state and federal regulators so organizations should closely follow the developments in these areas.  #data #privacy #cybersecurity

53

1 Comment

"With the passage of 19 comprehensive state data privacy laws and even more industry or data specific state privacy laws, the long-feared "patchwork" of state privacy laws is quickly becoming unmanageable for many U.S. companies. The breaking point may be the recent passage of privacy laws in Maryland, Minnesota, and Vermont — each of which departs considerably from the dominant models of U.S. state privacy law and significantly increases the compliance burden for U.S. companies." https://lnkd.in/ev_YaMEq

3

“Privacy by Design” isn’t just a buzzword; it’s a proactive approach that integrates privacy considerations into system design from the outset. It can help organizations reduce costs, minimize data exposure risks, and align with global privacy regulations (including GDPR).   As Matt Hillary points out in this great article, Ann Cavoukian, Ph.D., the former Information and Privacy Commissioner of Ontario, Canada, introduced this concept in the 1990s. Here are the core tenets that Dr. Cavoukian outlined in 2009:   1️⃣ Proactive, Not Reactive: We should prevent privacy issues rather than patching them later. 2️⃣ Privacy as the Default: Privacy isn’t an afterthought; it should be woven into the fabric of our systems. 3️⃣ Privacy Embedded into Design: It’s not an add-on; it should be part of the blueprint. 4️⃣ Full Functionality – Positive-Sum: Privacy shouldn't compromise functionality. 5️⃣ End-to-End Security – Lifecycle Protection: We should safeguard data throughout its journey. 6️⃣ Visibility and Transparency: Users deserve clarity about how their data is handled. 7️⃣ Respect for User Privacy: It’s not just compliance; it’s about ethics.   As our current era of digital innovation and AI evolves, Dr. Cavoukian's ideas are just as important, if not more important, today as they were thirty years ago. I thoroughly enjoyed reading Matt Hillary's overview of privacy by design and its impact on security and GRC—it’s a must-read for anyone navigating through today's privacy landscape. 🌐🔍 https://lnkd.in/gaPrn6P6

75

1 Comment

In today’s regulatory climate, where does responsibility end for CISOs managing data breaches? Constangy Cyber Team partners Bert Bender and Melissa Sachs explore insights on high-profile cases and the evolving risks and responsibilities for CISOs in today’s landscape. Discover where the 'buck' should stop in the link below. 🔒 #Cybersecurity #CISO #DataPrivacy #RegulatoryCompliance

1

In case you missed it, last month, UC San Diego published its Guidelines for Uses of AI Assistants in meetings and educational settings. It covers: - Allowable and prohibited uses; - Authorized users; - Privacy and notification requirements; and - Approved services We had a lot of balancing to do on this one! Privacy, and ADA, and innovation, and research, and regulated environments, and other people's policies, and... Lots of people had to pitch in! Thanks to all those folks for their expertise. We're set to review the guidelines in a few months and revise as needed. If you are doing something similar, please reach out and share your lessons-learned. Would love to learn how others are handling these thorny issues.

99

7 Comments

🚨BREAKING AI LEGISLATION NEWS 🗞️ The Senate AI Working Group released its Policy Roadmap on AI yesterday. The roadmap endorses several pieces of legislation and encourages separate debate and legislation introduction in individual committees including Appropriations, Labor & Industry, Finance, Homeland Security, and Health, Education, Labor and Pensions. The roadmap emphasizes increased need for federal investment in non-defense AI while cautioning committees to consider issues such as consumer privacy, AI development and data transparency, intellectual property rights, and security. Read the roadmap below and join me and Kirk Weishaar this afternoon for a discussion on the future of AI Legislation and Ethical AI. 🗺️ Roadmap: https://lnkd.in/eN4GNzMU 💻 Webinar Registration: https://lnkd.in/e43QNdpr

3

The Vermont Data Privacy Act may seem like just a drop in the bucket along with the 17 other states that have passed consumer privacy laws in the last six years. But the VDPA is unique in its stringent data minimization requirements AND the private right of action it gives consumers who believe their rights have been infringed. Here’s my question: with 32 other states considering their own consumer privacy laws, how many will look to Vermont as a model and afford consumers a private right of action? If Vermont replaces Virginia as the consumer privacy model, we could see even MORE scrutiny of corporate privacy practices. Read more in my latest blog available here: https://lnkd.in/gaqaPed4

7

According to the National Center for Missing & Exploited Children, CSAM reports received by year have increased more than 3000% from 2004 to 2023. It's clear: in the era of AI, the need to combat abusive content is even more crucial. As AI technology advances, so do the risks of targeting vulnerable groups like kids and seniors. In our latest report we highlight the importance of new legislation and collaborative efforts between the tech sector, government, and civil society to address these challenges and accelerate action. Learn more about how Microsoft is working to combat abusive AI-generated content and dig into the whitepaper with recommendations on how we can work together to help stop the misuse of AI: https://lnkd.in/gJEBhAz2

38

1 Comment