Tammy Horn

I saw a recent article from Artificial Lawyer speaking to Jon Fowler on "How Will GenAI Change eDiscovery" It was a very in-depth article, covering (in part) his history with eDiscovery. One of the points mentioned that jumped out at me was the point that many lawyers expressed concerns that predictive coding would replace human judgment (where is Sarah & John Connor when you need them 😝). It also talks about how deepfake's could affect the future for eDiscovery. I felt is was a great insight into how an expert in the Legal Tech Sector sees the future of eDiscovery, The good, The Bad and The Ugly (2nd film drop). I feel that it is definitely worth reading, so have included the link below. #eDiscovery #GenAI #LegalTech https://lnkd.in/ebYBx3Z9

4

The California Privacy Protection Agency Board will meet in San Francisco this Friday (Oct. 4). This meeting is important for a few reasons, including- (a) possible adoption of data broker registration regs, and (b) kicking off the regulation-making process under the APA for CPPA's pending regulations on cybersecurity audits, risk assessments, and automated decision-making techniques (ADMT). The latter might have significant ramifications, especially after the whole hullabaloo around SB 1047 (which was unsurprisingly vetoed, boo-freakin'-hoo). What I specifically want to highlight are some of the less-discussed publicly available documents that accompany these regulations, and how they are super useful. First, the Initial Statement of Reasons (ISOR), which literally provides a clause-by-clause justification for the text of the proposed regulations. It references a lot of recent academic research, news articles, reports etc,. and provides a strong policy rationale for how the regulation will benefit the public. Second, the Standardized Regulatory Impact Assessment (SRIA). It's a complex document which highlights the cost-benefit analysis of the economic impact of the regulations in hard numbers. For example, the SRIA for the regulations explains how it will impact 52,326 businesses in California and cost USD 3.5 bn to implement, with average annual ongoing costs of USD 1 bn, while direct benefits will total USD 1.5 bn in 2027 (which is when the regulations are likely to become effective), and USD 19 bn over a 10-year period. While I feel thankful that I am a lawyer and not an economist (can't imagine coming up with all these numbers), it is useful to see quantified ramifications of policy measures. Like all CPPA Board meetings, Friday's meeting is open to the public and anyone can attend in-person or through the Zoom link. A video recording of the meeting is also uploaded on YouTube and a transcript is uploaded on the CPPA website (usually within the next 1-2 weeks). All links in comments.

48

1 Comment

New mandatory quarterly reporting requirements are coming for U.S. persons and U.S. entities that develop, acquire, or possess advanced AI models and computing clusters. The U.S. Department of Commerce’s Bureau of Industry and Security (BIS) recently published a Proposed Rule that fulfills the Department of Commerce’s mandate in Section 4.2 of the October 2023 Executive Order on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (AI Executive Order) to collect information on dual-use foundation models and large-scale computing clusters. To protect U.S. national security and ensure the U.S. government can properly assess whether U.S. entities are developing AI in a safe and reliable manner, the AI Executive Order directed BIS to collect information from U.S. entities on an ongoing basis concerning their use, possession, and development of “dual-use foundation models” and large-scale computing clusters. Like other dual-use technologies, dual-use AI foundation models have military applications. They can, among other things, be used to enhance the maneuverability, accuracy, and efficiency of military equipment and enhance signal intelligence devices. Accordingly, in the hands of U.S. adversaries dual-use foundation models could “substantially lower the barrier of entry for non-experts” to develop weapons of mass destruction as well as automated cybersecurity vulnerability detection, exploitation, and cyber warfare. If implemented, the Proposed Rule would require detailed reporting requirements concerning highly sensitive and proprietary data of U.S. companies. The U.S. government’s collection and storage of this data raises significant security risks. How will the government protect such data against foreign state actors, especially the People’s Republic of China, in light of the recent revelations about stealthy cyberattacks orchestrated by Salt Typhoon and Volt Typhoon?   Although BIS expects that this Proposed Rule would only impact a small number of “well-resourced technology companies,” the failure to comply carries the risk of civil and criminal penalties. Read more about BIS’s Proposed Rule in my article in the link below ⬇️ #AI #artificalintelligence #enforcement #nationalsecurity

30

This is a good post that highlights 15 of hundreds of regulatory and legislative actions related to AI. Since so many laws impact the use of AI that are focused on AI, it is imperative to remember that all existing statutes and regulations be analyzed through an AI lens. All companies and family offices need to recognize the full universe of potential legal implications. In particular, family offices and other investors need to employ third parties to ensure claims about AI are actually true. #artificialintelligence #ai #AIregulation #AIlaw #generalcounsel #familyoffice #investing #duediligence

1

#NEW: FPF filed two comments with the Office of the New York State Attorney General to inform forthcoming rulemaking for the implementation of the New York Child Data Protection Act (NYCDPA) and the Stop Addictive Feeds Exploitation (SAFE) for Kids Act. FPF’s comments seek to ensure that New York’s online protections for youth can protect and empower minors while supporting interoperability with existing state and federal privacy frameworks. Some of our recommendations include:  ➡️ Mitigating privacy, technical, and practical implementation concerns with “age flags” by further consulting with stakeholders and establishing baseline criteria for qualifying signals. FPF offers technical and policy considerations the OAG should consider in furthering this emerging technology ➡️ When exploring appropriate methods for providing verifiable parental consent, the OAG should consider the known problems, concerns, and friction points already existing with the existing verifiable parental consent framework under COPPA. ➡️ Where appropriate, align core privacy concepts with the developing state comprehensive privacy landscape including the definition of “personal information” and opportunities for data sharing for research Read the full comments in a new blog by Senior Counsel for U.S. Legislation Bailey Sanchez and Policy Fellow for Youth & Education Privacy Daniel Hales: https://lnkd.in/g-H2N5fz

11

1 Comment

The introduction of the American Privacy Rights Act seeks to establish a uniform national standard for consumer privacy, with the goal of remedying the fragmented landscape of state laws. Gary Kibel was quoted in the Legal Dive article "Solution to Patchwork of State Data-Privacy Laws Shows Promise," sharing his thoughts on the incredible burden that current privacy laws are imposing on businesses. Read the full article. https://lnkd.in/e-9ZMeud #PrivacyLaws #StateLaws #DataPrivacy

9

The U.S. Justice Department and the Federal Trade Commission (FTC) recently filed a civil enforcement action against Adobe Inc. and two of its executives for alleged violations of the Restore Online Shoppers’ Confidence Act (ROSCA). The lawsuit alleges that Adobe imposed a hidden “Early Termination Fee” on millions of online subscribers and made cancelling subscriptions a complex and challenging process. According to the complaint, Adobe allegedly hid important information about subscription plans using fine print and inconspicuous hyperlinks, including a significant Early Termination Fee that customers may be charged when cancelling their subscriptions. The complaint also alleges that Adobe made it difficult for consumers to cancel, subjecting them to a convoluted and inefficient process. The lawsuit seeks unspecified amounts of consumer redress and monetary civil penalties from the defendants, as well as a permanent injunction to prohibit them from future violations. The Justice Department and FTC are committed to stopping companies from preying on consumers who sign up for online subscriptions by hiding key terms and making cancellation an obstacle course. It's not just Adobe; many companies make it difficult for consumers to cancel their subscriptions, often burying important information in the fine print. #consumerprotectionlaws  #ROSCAenforcement

21

What a set back for Mexico if the data protection authority is dissolved! INAI has been a key partner for data protection authorities around the world at the Global Privacy Assembly and beyond. Effective data protection is critical to cross border trade and of course to local human rights and economy. Sad to see this setback https://lnkd.in/eAjdwg53 @Me

34

2 Comments

This is what real public protection looks like. Not "rules" that continue to allow corporations to take advantage of mismatches of power and information, but rules that put real guardrails on how they can treat people. A basic level of privacy is core to the foundation of democracy, and eroding the bases of the data surveillance economy is a crucial part of rebalancing agency, meaningful choice and autonomy in our society.

59

A strong word of caution to my students and others using Generative AI generally and Westlaw in particular. Companies are always going to oversell their products; and regulatory agencies are always going to be playing catch-up. It is up to you to use critical thinking and due diligence when using AI.

6

1 Comment

Really helpful visual regulatory roadmap to #ai and #privacy from The George Washington University Law School Professor Daniel Solove. Currently reading through his draft article that "aims to lay the conceptual and practical groundwork for how to understand the relationship between AI and privacy as well as provide a roadmap for how privacy law should regulate AI." https://lnkd.in/eXPR8sKk

12

So glad that Marc is bringing attention to early U.S. leadership on privacy and data protection. This is the 50th anniversary year of Congress declaring that “the right to privacy is a personal and fundamental right,” and then proceeding to embody fair information practice principles (FIPPs) into federal law (well before other countries and the OECD followed suit). The Federal Privacy Act of 1974 stacks up well to this day against its descendants. If one wishes to confirm this observation, peruse 5 USC 552a. Note that the congressional declaration of privacy as a “fundamental right” was duly enacted into law, but was not codified in the operational provisions of 5 USC 552a. The full text of the Privacy Act, enacted as Public Law 93-579, is available here: https://lnkd.in/evjfHAZV. See section 2(a)(4) for Congress’ declaration of the fundamental right.

17

3 Comments

With Congress' proposal of the American Privacy Rights Act (APRA), Senior Legal Analyst Tony Foley discusses the impact of the federal legislation in his recent piece. Foley explains that the single, national bill would preempt state privacy laws and involve data minimization, FTC enforcement, consumer data rights and more. To read the full piece, visit: https://bit.ly/4b0SzAE #privacylaw #cybersecurity

6

Pursuant to EO 14110, NIST released four draft publications aimed at implementing the Executive Order's goals for improving the safety, security and trustworthiness of AI systems. NIST is seeking public comment on the draft guidance documents to be submitted on or before June 2, 2024. ·      AI RMF Generative AI Profile (NIST AI 600-1): A companion resource for users of the NIST AI Risk Management Framework, this guidance document focuses on a list of generative 12 AI risks and mitigation strategies. NIST plans to add a glossary and is seeking feedback regarding terms to include. Additionally, NIST seeks comments regarding whether the document should further categorize the 12 risks identified and the mitigation actions, as well as risks associated with certain actions. For example, the 12 risks could be further categorized “between technical/model risks, misuse by humans, ecosystem/societal risks.” ·      Secure Software Development Practices for Generative AI and Dual-Use Foundation Models (NIST Special Publication (SP) 800-218A): This guidance document is the companion resource to the SSDF required by Section 4.1.a of the EO. It addresses how to incorporate secure development practices for generative AI and for dual-use foundational models, including data sourcing for designing, fine-tuning and evaluating AI models. It specifically addresses cybersecurity practices for training data and other data being used for AI model development.   ·      Reducing Risks Posed by Synthetic Content (NIST AI 100-4): This guidance draft focuses on transparency in digital content and outlines methods for detecting, authenticating and labeling synthetic content among other standards, tools, methods and practices. Synthetic content is “information, such as images, videos, audio clips, and text, that has been significantly altered or generated by algorithms, including by AI.” ·      A Plan for Global Engagement on AI Standards (NIST AI 100-5): This draft document establishes a plan for promoting and developing AI standards globally. The publication calls for comments regarding: (1) prioritization of topics for standardization work, including additional topics; (2) prioritization of activities and actions; (3) important ideas that are missing; and (4) completeness of standards activities listed in Appendix B to the draft. NIST also announced NIST GenAI, a program for evaluating and measuring the capabilities and limitations of generative AI technologies. The program goals include helping determine whether a human or AI produced a given output (text, image, video, audio, etc.). In addition to NIST’s four draft publications, the Department of Commerce’s USPTO issued a request for public comment on how AI may impact determinations regarding if an invention is patentable under U.S. law.  #AIriskmanagement #AIGovernance

9

1 Comment