Alissa Cooper

The Biden Executive Order on AI set forward a path for responsible uses of AI in government and beyond, and set a key role for privacy enhancing technologies that you can be used in support of AI. At Future of Privacy Forum we are excited to help advance legal certainty, standardization and (most important) ethical uses of PETS. Looking forward to meeting with key Administration, civil society, academic and industry experts at the White House to kick this effort off today.

22

On April 17, Colorado Governor Jared Polis signed HB 1058 into law, which means it is time to update our chart comparing the various definitions of sensitive data in consumer data privacy laws. Here's some more context: 1️⃣ HB 1058 amends the Colorado Privacy Act to add biological data (and through it neural data) as a category of sensitive data in the Colorado Privacy Act. 2️⃣ The true impact of the amendment is debatable as the definition of biological data states that the data must be "used or intended to be used, singly or in combination with other personal data, for identification purposes." 3️⃣ Colorado is the first state to add biological/neural data to its state privacy law. This continues the trend over the last two legislative sessions of state lawmakers expanding the types of data covered as sensitive data. Given the constant expansion, at some point it may be easier to define what is not sensitive data rather than what is. 4️⃣ California is also considering a bill to add neural data to the CCPA's definition of sensitive personal information. 5️⃣ Colorado isn't done. The legislature is still considering two other bills to amend the Colorado Privacy Act, dealing with the treatment of biometric data and minor's data. 6️⃣ Here's a link to the Colorado bill for those interested: https://lnkd.in/gE7KPyY9

134

9 Comments

The ITTI Use-case guide. Your go to source to learn about industry 4.0 trend, applications and use-cases across a multitiude of industries https://lnkd.in/dPftqvUw

44

The Massachusetts Attorney General released guidance on AI developers, suppliers, and users' obligations under Massachusetts consumer protection, anti-discrimination, and data security laws. Nothing earth-shattering in the advisory notice and another example of how existing laws are being used to regulate AI. The advisory presents the below non-exhaustive list of acts and practices that may be considered to be unfair and deceptive under the Massachusetts Consumer Protection Act: - Falsely advertising the quality, value, or usability of AI systems - Supplying an AI system that is defective, unusable, or impractical for the purpose advertised - Misrepresenting the reliability, manner of performance, safety, or condition of an AI system - Offering for sale or use an AI system in breach of warranty, in that the system is not fit for the ordinary purposes for which such systems are used, or that is unfit for the specific purpose for which it is sold where the supplier knows of such purpose - Misrepresenting audio or video content of a person for the purpose of deceiving another to engage in a business transaction or supply personal information as if to a trusted business partner as in the case of deepfakes, voice cloning, or chatbots used to engage in fraud  - Failing to comply with Massachusetts statutes, rules, regulations or laws, meant for the protection of the public’s health, safety or welfare 

27

The Privacy Pendulum: From Historical Benchmarks to the Age of AI As a attorney who works in the privacy arena, I'm excited to see the University of Michigan Safe Computing team tackling the fascinating (and ever-shifting) landscape of data privacy! Their History of Privacy Timeline is a fantastic resource. This interactive tool lets you explore how privacy rights have been established and challenged over time. We see it all: -The foundational 1890 Brandeis Law Review article that ignited the "Right to Privacy" movement. -Landmark Supreme Court decisions that continue to shape privacy protections. -The rise of data collection and the ongoing battle for control in the age of Artificial Intelligence. #AI But the story doesn't end there! The Gramm Leach Bliley Act (GLBA) and state laws add another layer of complexity, particularly for financial institutions. Understanding these regulations is crucial for businesses navigating the data privacy landscape. https://lnkd.in/eRRYQSKw #DataPrivacy #InformationSecurity #UofM #SafeComputing #GLBA

2

European legislators are working hard to understand generative AI, and data protection authorities are carefully assessing key legal and technical questions such as does a model itself actually contain personal information. FPF official side event at the Global Privacy Assembly will dig deep into this issue. California however.... well this bill talks about systems and of course an AI system can be trained on personal information and can output personal information. But the model itself? Maybe, may not always. The sponsor's intent is clearly intended to cover models, not only a full system. So thanks for the confusion, in the state where much of this is actually being built. I am all for advancing smart state AI bills, coordinated around a common model... not a fan of 'one off' stabs an an issue that create legal muddles.. We shared some of the emergence guidance from DPAs in Hamburg and the CNIL - but I suspect Newsom signed this bill, because he did veto the "big" AI state bill that many lobbied against. The suprise will be if this bill ends up having more impact, given the challenges it creates.

37

Two U.S. lawmakers (Democratic Senator Maria Cantwell & Republican Congresswoman Cathy McMorris Rodgers) proposed a draft of bipartisan data privacy legislation. The legislation represents a combined political effort to establish a unified national standard for data privacy that addresses the fragmented regulatory infrastructure. The proposed legislation would compel businesses to adopt more stringent protocols for handling sensitive information and potentially look for a new partner to help protect their data. With Opsbook you're already one step ahead of real-world events with our groundbreaking platform designed to revolutionize proactive cybersecurity practices. Opsbook automates the design, execution, and post-action review of complex cybersecurity scenarios to help you prepare for the next threat. With our 100% customizable tabletop scenarios, businesses can validate their operating procedure and improve their readiness. #CyberResilience #cybersecurity #managedservices #incidentresponse #automation #tabletopexercise #preparedness #TTX #scenarioplanning #MSP #cybersecurityreadiness #Cybersecurity #NISTFramework #MSSP #TabletopExercises #Opsbook #DigitalResilience #TabletopPlatform

4

So, what is Differential Privacy? Did you know about the "Fundamental Law of Information Reconstruction" which says "Overly accurate estimates of too many statistics is blatantly non-private"! What about the idea that de-identified data isn't, either de-identified or there is so much "out there" that data can be re-identified with the right tools? Then the question must become, how can you analyse data while preserving privacy?... and the person who may know this best is its creator Cynthia Dwork. Here https://buff.ly/3YhV2Dy is 18 mins from Cynthia Dwork at the Differential Privacy Symposium giving Differential Privacy as an explanation in a nutshell. Oh and not forgetting... EPSILON #epsilon #gdpr #dataprotection #research #personaldata #researchers #innovation #futurism #technology #data #future #regulation #compliance #privacy #DataSavesLives #economics #economy #funding #machinelearning #privacypreservingtechnologies #privacyenhancingtechnologies #TRE #TrustedResearchEnvironments #ai #datasharing #sharing #ICO #DataSharing #DPO #DataProtectionOfficer #differentialprivacy

14

The U.S. Patent and Trademark Office (USPTO) recently released new guidance for practitioners using artificial intelligence (AI)-based tools. The guidance primarily serves as a reminder of longstanding requirements and best practices for patent and trademark practitioners. For example, patent practitioners have a duty of candor and good faith to the USPTO and a duty of confidentiality to their clients. The guidance does not announce any new law or rule regarding practicing before the Office;  rather, it provides some insight into how the Office expects practitioners to operate when incorporating AI-based tools into their practice.

18

1 Comment

The FTC's investigation into AI-powered "surveillance pricing" raises important questions about the role of regulation in this emerging space. Even the name of this practice suggests something bad or wrong, and certainly that looks like the FTC's angle here. While concerns around privacy and fairness may be valid depending on the situation, there may be potential benefits of AI-driven pricing adjustments – efficiency, personalized experiences, and competitive advantage. For all we know, these practices could actually result in lower prices to certain consumers that they might not otherwise get to take advantage of -- which would be a good thing. When I think about how lawyers price their services variably across a wide range of clients large and small, I do not automatically agree that adjusting pricing depending on the customer and circumstances is a bad thing or suspicious in some way. What do you all think? Is the FTC's impending crackdown on "surveillance pricing" a step in the right direction, or a sign of overly aggressive regulation? Is so-called "surveillance pricing" always bad? #AI #regulation #FTC #innovation

7

1 Comment

Upon reviewing the informal text of the AI Act, certain aspects like differentiating between General Purpose AI and AI systems posed challenges. Additionally, it appears that some sections were hastily written, as seen in § 2(12) where the text states "This Regulation applies to AI systems released under free and open source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50." when it should likely have been "does not apply to." While aware of the ongoing corrigendum process, concerns arise regarding the rushed decision-making process highlighted by Kai Zenner's remarks in an interview where they had 20 minutes to choose betwen 4-5 different GPAI regulatory options. This rushed approach may not be conducive to the effective shaping of laws.

3

What does the American Privacy Rights Act mean for AI Governance? ▪ Congress introduced the American Privacy Rights Act (APRA) by Senator Maria Cantwell and Representative Cathy McMorris Rodgers, targeting the establishment of comprehensive federal privacy laws that will have huge implications for AI governance. ▪ APRA mandates stringent oversight on AI, requiring "large data holders" to perform annual impact assessments on algorithms that could harm specific demographics, and necessitates preemptive risk mitigation in algorithm design. ▪ The legislation empowers individuals to opt out of AI-driven decisions affecting life aspects, such as healthcare and employment opportunities, and establishes robust enforcement mechanisms via the Federal Trade Commission and state attorneys general, with provisions for personal lawsuits. ▪ APRA faces resistance due to its preemption of state laws, which may undermine localized privacy protections like those in California, presenting a significant challenge in balancing national AI regulation with existing state laws. We discuss this in our latest Trustible newsletter plus: 🇯🇵 The Rise of Non-English LLMs 🔄 AI-Ception – When models are trained on AI content 📈 Why AI Governance is going to get a lot harder 🤖 Stanford HAI Summarizes the World of AI Read more here 👉 https://lnkd.in/eSfkWV53

9

1 Comment

In the cover article for the print edition of Judicature Vol. 108 No. 1 (2024), Christopher Griffin, Cas Laskowski, and Samuel A. Thumma offer a preliminary agenda for how generative AI (GenAI) can improve access to justice, especially given both its extraordinary potential and extraordinary risks. https://loom.ly/G7o4M0Q By “access to justice,” the authors — a law professor, a law librarian, and a judge — focus particularly on how #GenAI can help litigants resolve civil legal matters with minimal or no formal attorney representation. While the article is written from an American legal perspective, its findings and suggestions are relevant and have applications across borders and industries. For example, the authors suggest the following best practices that should be considered as part of the evaluation process for any #AI system: • Use Diverse, Representative Data. • Create “Human-in-the-Loop” Systems. • Develop Impact Assessments. • Be as Transparent as Possible. The authors then conclude with a discussion of what, how, and when to evaluate AI tools for access to justice. While the authors urge care before adopting any GenAI system, they note that the “sky is the limit” regarding potential uses for GenAI, provided care is taken to understand both its promises and pitfalls. (This article was spotlighted in the November 2024 edition of Judicature International, an online-only publication and monthly e-newsletter. Subscribe here to receive future editions of Judicature International: https://lnkd.in/eD3enerh)

4

The latest attempt to provide US Citizens with some fundamental digital rights, the American Privacy Rights Act (APRA), stalled out in the US Congress in June and is doomed to die in the months before the election. And it is not that APRA was that great, either. All the civil rights protections had already been stripped from the bill, protections that are needed more than ever in the age of artificial intelligence (AI), where technologies like facial recognition have been shown to have error rates that vary significantly by race and have led to the arrest of innocent people. Many states have taken up the slack, but this state-by-state approach also creates inconsistencies in consumer protections, leaving citizens with varying privacy safeguards depending on their location. This disparity is unacceptable, especially as artificial intelligence becomes more prevalent. https://lnkd.in/gfMGAMC4?

10

Very informative summary

2

We're thrilled to share insights on the emerging NIST Generative AI Risk Profile, brought to you by our colleague, Patrick Hall — an esteemed AI authority. Collaborating with Patrick and other leading experts, we provide unparalleled support to diverse industries in mastering model risk management for generative AI technologies. A common challenge our clients articulate is the novelty and magnitude of risks associated with generative AI. They're eager to leverage these advancements but often grapple with understanding and mitigating the inherent risks. Ensuring customer safety and regulatory compliance remains a paramount concern. The evolving NIST guidance under the AI RMF framework is set to offer crucial benchmarks for safely capitalizing on generative AI's potential. Our role is to guide you through these regulatory challenges while maximizing business outcomes. Our team at SolasAI, BLDS LLC, and Global Economics Group possess over 45 years of expertise applying statistics (now known as "data science") to legal and regulatory compliance issues, as well having significant experience in business optimization (i.e., making algorithms work). We also have a specialized focus on the fair and equitable use of algorithms. In our work, we have developed MRM programs for major players in Financial Services and Health Insurance, conducted LLM audits, testified before the Senate on fairness standards, and are at the forefront of setting benchmarks that regulators will rely on as technology progresses. Interested in how we can help your organization navigate these challenges, seize opportunities, and develop a robust risk management program? Please contact message me or one of my colleagues, Susan Bridge, Steven D., or Darrin Williams. We look forward to working with you! #genAI #mrm #fairai

46

ECDSA ... the signature that just won't go away. Overall, the Schnorr patent has stopped EdDSA from replacing ECDSA, but now that the patent has expired and that EdDSA has been approved within FIPS standards, the way is clear for it to be used. The Edwards-curve Digital Signature Algorithm (EdDSA) is used to create a digital signature using an enhancement of the Schnorr signature with Twisted Edwards curves. Overall it is faster that many other digital signature methods, and is strong for security. One example of EdDSA is Ed25519, and which is based on Curve 25519. It generates a 64-byte signature value of (R,s), and has 32-byte values for the public and the private keys. In this case we will split a private key into a 2-from-3 secret share policy and allocate to a number of parties. Next each of the parties can generate a part of the signature, and then these are aggregated together to produce the overall signature. In this way the private key never has to be rebuild, in order to create a signature for a data object. https://lnkd.in/eR-2NgYH

26

1 Comment

I wrote a second Bloomberg Law analysis piece regarding the surge in state child online privacy laws, showing that the laws are surprisingly varied and nuanced. Check out the state patchwork 2.0. https://lnkd.in/gkBCkuWP #privacy #childonlineprivacy #stateprivacylaw #dataprivacy #dataprotection

25

4 Comments

User-facing privacy options should always be simple, easily accessible, and understandable. If they are confusing or misleading, you undermine the purpose of privacy controls in the first place and, even if they weren’t intentionally designed to confuse or mislead, the effects can be damaging to trust, credibility, and reputation. The California Privacy Protection Agency (CPPA) Enforcement Division’s latest advisory on these types of dark patterns nicely highlights the “importance of reviewing their user interfaces to ensure they offer symmetrical choices and use clear, easy-to-understand language offering privacy choices—two of the attributes spelled out in the regulations.” In the advisory, Michael Macko, Deputy Director of the CPPA’s Enforcement Division, aptly points out that “dark patterns aren’t about intent, they’re about effect. The law gives consumers the right to make their privacy choices without jumping through confusing hoops or solving puzzles. Businesses need to ask themselves the right questions about their user interfaces and make sure they aren’t part of the problem.” Clear user choice and control is a good thing for everyone. If you always think about your experiences from the perspective of your users, you will build more trust with them and you will see better business results over time.

12