Maverick James, Esq., CIPP/US, CIPM

This is a really comprehensive and informative look at a timely issue.

3

Join us in Boston on October 30 for an in-depth program focused on modern #cybersecurity, covering the current cyber threat landscape, advanced risk management techniques, AI-related risks, and more. #AI

6

Important update in biometric privacy laws. Illinois passed Bill 2979, updating the Biometric Information Privacy Act. The recent Coltrane v. White Castle case clarified that every time biometric data is collected, it triggers BIPA, highlighting the need for strict regulation. Comparing the Coltrane decision with Bill 2979 shows how biometric privacy laws are evolving. While Coltrane broadened BIPA's coverage, Bill 2979 provides clearer rules for businesses navigating BIPA. #BiometricPrivacy #DataProtection #EthicalAI"

6

1 Comment

Sharing a link to IAM's article by Angela Morris on the impact of the USPTO's latest data breach. IAM's sister platform World Trademark Review reported that "repeated data exposures create serious concerns about the USPTO's ability to protect sensitive data." I was quoted as saying "it goes to show that America's innovation agency does not have all their ducks in a row with regard to the way that they are managing confidential patent application filings, and this is a huge concern. We need to know that we have an agency that is following the rules and that has the IT set-up to follow those rules." TT Consultants's Stephen Gucker and McCabe & Ali LLP's Emil Ali were also quoted in the article. Time for Congress to ensure that the USPTO's IT system is operating in America's best interest. #USPTO, #IT, #IP, #tech, #data, #breach, #leak, #trademark, #patent, #privacy, #congress https://lnkd.in/g2znVfQS

8

1 Comment

Yesterday, Maryland became the 17th state to enact a comprehensive data privacy statute. With more than 40% of the U.S. population residing in those states, the patchwork of data privacy laws in the U.S. has created significant legal challenges for companies doing business nationwide. However, with Congress taking up the new American Privacy Rights Act (APRA), those challenges may soon abate. Drawing on data privacy and protection concepts from international regulations and state comprehensive data privacy laws, the APRA creates a unique law that attempts to address contemporary privacy concerns while simultaneously anticipating future technologies. But will it pass? --- Thanks to ALM and Law.com Pro for publishing Andria Adigwe and my thoughts. #dataprivacy #dataprivacylaw #cyberlaw Buchanan Ingersoll & Rooney PC Higginbotham AFCEA Central Maryland Chapter Chris Hughes IAPP - International Association of Privacy Professionals National Defense Industrial Association - (NDIA) Business Executives for National Security (BENS) Daniel Solove Benjamin Yelin April Falcon Doss Ahmed Eissa

63

1 Comment

LEGAL COUNSEL’S ROLE IN CYBERSECURITY Cyber Hackers remain persistent in their efforts to disrupt the digital world, with accelerated digital adoption as well as the rise of the remote worker -- as evidenced by skyrocketing cyber attacks -- especially in the broadcast media and distribution industry. Information assets in the media and distribution industry need to be protected, and I had the opportunity to discuss cybersecurity as one of the topics at the PBS Annual Meeting this year. I had the honor and privilege to present the program entitled, “Cybersecurity Protection in the Media, Broadcasting and Distribution Industry – The Essential Role of Legal Counsel.” With counsel present from several PBS member stations, PBS’s Office of the Chief Legal Officer and the Corporation for Public Broadcasting, the Program at the PBS Annual Meeting was a success! We had a meaningful discussion around the importance of legal counsel in Cybersecurity and the need for legal counsel to play a key role, from data rights to governance and compliance to risk management to understanding the import of Cybersecurity Technology.  Many thanks to PBS’s Office of the Chief Legal Officer for inviting me to present. Other notable attendees included the Senior Vice President and General Counsel from the Corporation for Public Broadcasting. #PBSAnnualMeeting2024 #PBSAnnualMeeting #PBS #LegalTrack #GeneralCounsels #Legal #CyberSecurityinMedia #CyberSecurity #Protection #VegasPBS #Media #PBSChiefLegalOffice #CorporationforPublicBroadcasting #CPB

6

The weekly roundup: Although this is not FIGG related, it's really important to pay attention to cases involving privacy violations (in the US, things that may fall under the 4th amendment, here in Canada, section 8 charter rights) and genetic information. This one, out of Ontario, asserts two breaches: that the consent was not fully informed and that the DNA profiles were retained. One can easily see the implications for FIGG here, especially with regards to reference testing. Don't think this only applies to Ontario - all agencies must make sure they are obtaining informed consent and following the laws of their jurisdictions. Many new privacy laws have been popping up all over the US (would love a Canadian lawyer to weigh in on this!) : https://lnkd.in/ei36Ph57 After two years, the landfill search for the victims of a serial killer has finally begun: https://lnkd.in/ebnXBvYS "Coroner's probe finds 220 additional deaths at Ontario residential schools — deaths that were previously unknown to the Truth and Reconciliation Commission or the National Centre for Truth and Reconciliation (NCTR)." https://lnkd.in/ecnNwnSq ""John Doe" Identified Nearly 30 years after Missing Person Disappearance from Niagara Falls, NY - “This incident sheds light into the continued need for the collaboration and communication between both Canada and the US officials to solve these on-going and historical cases.” https://lnkd.in/epXjCAVp #weeklyroundup #inthenews #FIGG #FGG #IGG #searchthelandfill #mmiwg #residentialschools #missingpersons #missing #privacy #charterrights

7

2 Comments

On May 9th, Maryland became the 17th state to enact a comprehensive data privacy law, the Maryland Online Data Privacy Act (MODPA). While similar to GDPR and other state data privacy laws, MODPA goes further to restrict companies from collecting, processing, or sharing sensitive data entirely, except where "strictly necessary to provide or maintain a specific product or service requested by the consumer." This presents a significant challenge to the AI because AI often entails gathering and scrutinizing extensive datasets. Consequently, big data analytics might uncover unforeseen connections that surpass the intended processing goals. What are legal strategies should be adopted to tackle this challenge? Join me for an in-depth discussion on the following topics in AI at my upcoming CLE virtual webinars on May 23rd and June 11th: -- Data minimization requirements and legal strategies -- Biometric privacy -- State data privacy laws -- IP issues Nationwide CLE credits are available. See my comment for the registration information. Natalya M. Allison Schindler Joline Torkelson

4

3 Comments

On May 9th, Maryland became the 17th state to enact a comprehensive data privacy law, the Maryland Online Data Privacy Act (MODPA). While similar to GDPR and other state data privacy laws, MODPA goes further to restrict companies from collecting, processing, or sharing sensitive data entirely, except where "strictly necessary to provide or maintain a specific product or service requested by the consumer." This presents a significant challenge to the AI because AI often entails gathering and scrutinizing extensive datasets. Consequently, big data analytics might uncover unforeseen connections that surpass the intended processing goals. What are legal strategies should be adopted to tackle this challenge? Join me for an in-depth discussion on the following topics in AI at my upcoming CLE virtual webinars on May 23rd and June 11th: -- Data minimization requirements and legal strategies -- Biometric privacy -- State data privacy laws -- IP issues Nationwide CLE credits are available. See my comment for the registration information. Natalya M. Allison Schindler Joline Torkelson

5

4 Comments

Governor Moore signed the Maryland Online Data Privacy Act into law today, bringing the number of states with general privacy laws up to 18. (Sadly, Clay Davis wasn’t involved.) MODPA doesn’t follow the California or Washington model but introduces a new (lake trout?) flavor of privacy law. Notable differences: * For all personal data, businesses must limit the collection of personal data to what is “reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer” – not just disclosed in the privacy policy. (Keep an eye on this requirement; it's a biggie.) * Lower applicability thresholds: 35K individuals or 10K individuals plus >20% revenue derived from the sale of data. * No selling data of kids under 18 if you know or “should have known” the kid is under 18. * No geofencing within 1,750 feet of mental or reproductive/sexual health facilities to identify, track, or collect data from consumers or to send notifications to consumers regarding their data.  * Can’t collect or process data for unlawful discrimination, except for self-testing or mitigation. * No private right of action (whew!) * 60-day cure that’s discretionary with the AG Goes into effect on October 1, 2025 #law #privacy

54

6 Comments

In case you missed it, last month, UC San Diego published its Guidelines for Uses of AI Assistants in meetings and educational settings. It covers: - Allowable and prohibited uses; - Authorized users; - Privacy and notification requirements; and - Approved services We had a lot of balancing to do on this one! Privacy, and ADA, and innovation, and research, and regulated environments, and other people's policies, and... Lots of people had to pitch in! Thanks to all those folks for their expertise. We're set to review the guidelines in a few months and revise as needed. If you are doing something similar, please reach out and share your lessons-learned. Would love to learn how others are handling these thorny issues.

99

7 Comments

🚩 🚩 🚩 Federal courts across the United States are warning lawyers about a widespread phishing scam involving fake court filing notices. 🚩 The scammers are sending emails that appear to come from the federal judiciary's electronic filing system, attempting to trick lawyers into clicking malicious links or downloading harmful attachments. When recipients respond to these fraudulent emails, they receive follow-up messages containing links to dangerous websites. 🚩 One example of these scam emails includes a fake deadline of November 6th, 2024, designed to create urgency and pressure recipients into taking immediate action. 🚩 Share with your colleagues and staff. #lawyers #attorneys

25

21 Comments

Colorado leads the way in protecting neural data privacy with new legislation signed by Gov. Jared Polis. The bill expands the Colorado Privacy Act and sets a precedent for other states. Read more from Constangy Cyber Team member Amanda Novak in the link below. #coloradoprivacyact #cpa #dataprivacy #cybersecurity

2

The United States Court of Appeals 5th Circuit just announced it will not adopt a proposed rule specifically requiring disclosure and other requirements for attorneys who use AI as part of their practice. Upon reflection, and based upon a lot of negative feedback on the proposed rule, they recognized that existing rules already cover the same situations. Specifically, attorneys are enforceably required to stand behind the truthfulness and accuracy of court filings. However, the court admonished litigants and lawyers alike that “I used AI” will not be an acceptable excuse for violating existing rules! Here is the formal notice from the court: https://lnkd.in/gJWyEyxg For color, here also are some recent news articles on this announcement: * Reuters: https://lnkd.in/gJmjWSqv * Bloomberg Law: https://lnkd.in/gaVqCkHi And, since I have it at hand, for your convenience, here is the full statement by the court: “The court, having considered the proposed rule, the accompanying comments, and the use of artificial intelligence in the legal practice, has decided not to adopt a special rule regarding the use of artificial intelligence in drafting briefs at this time. Parties and counsel are reminded of their duties regarding their filings before the court under Federal Rule of Appellate Procedure 6(b)(1)(B). Parties and counsel are responsible for ensuring that their filings with the court, including briefs, shall be carefully checked for truthfulness and accuracy as the rules already require. “I used AI” will not be an excuse for an otherwise sanctionable offense.” Personally, I think this court got it right. To the extent existing rules cover situations arising from use (or misuse) or AI, it is a good idea to apply those rules first before seeking to make more rules. In the event of demonstrable failures of existing rules, then perhaps it will be more practical to craft new rules to address the gaps that have been revealed. But it is, apparently, a very good idea to sound the alarm far and wide, loud and clear: sometimes generative AI provides incorrect or otherwise unsuitable information and it remains the duty of the attorney (among others) to carefully review and stand behind any work they pass forward. That concludes my public service announcement for today :-)

121

20 Comments

Maryland's entry into the state privacy law arena brings some interesting challenges. Today I am thinking about whether the data minimization requirement dramatically hampers use of website tracking and analytics tools like Google Analytics. Controllers are required to limit their collection of personal data to what is reasonably necessary and proportionate **to provide and maintain a product or service requested by the consumer.** This breadth and scope is pretty unique in privacy law. #GDPR and many other laws focus on the purpose for data collection, not the product/service it is related to. The key will be in defining what is reasonably necessary and proportionate and what actually entails the "product or service." Read one way, if I'm buying some sports equipment from my local sports store, collecting any of my personal information on that store's website is not really necessary to that purchase. I.e., that website doesn't need to analyze my web traffic to sell me sports equipment. Read another way, the website offers an online webstore service that sells products and that service certainly needs that personal information. Privacy law continues to promise far-reaching and fascinating issues and battles. #MODPA #maryland #privacy Dickinson Wright

10

1 Comment

🔒 Empowering Consumers: Vermont Passes Landmark Data Privacy Legislation 🛡️Vermont's Democrat-led legislature has passed one of the country's most robust data privacy laws. This legislation aims to curb companies' online data collection practices and empowers consumers to take legal action against firms that violate privacy regulations. 📝Key Provisions of the Vermont Data Privacy Act: 1. Ban on Sale of Sensitive Personal Data: Including driver’s license numbers, health information, social security numbers, and financial data. 2. Limitations on Data Collection and Processing: Imposing constraints on the extent to which companies can gather and process personal data. 3. Consumer Empowerment Through Legal Action: Allowing consumers to file civil lawsuits against companies for data privacy violations, enhancing enforcement. 4. Timeframe for Compliance: Companies are given 60 days to address data privacy issues before consumers can initiate legal proceedings. 5. Targeting Specific Businesses: Primarily impacting data brokers and companies processing data from over 100,000 Vermont residents annually. 📊Additional Measures Under the Act: (I) Establishment of Advisory Council: Creation of an Artificial Intelligence and Data Privacy Advisory Council to advise the government on AI deployment and usage. (ii) Safeguarding Minors' Data: Provisions included to protect the data of minors. 💼Vermont's bold step in enacting the Data Privacy Act is expected to have far-reaching implications. It not only sets a new standard for data privacy regulations in the U.S. but also signals a shift towards greater consumer empowerment and accountability among businesses. #dataprivacy #dataprotection #digitalrights #securityawareness #cipp #cipt #cipm #cippe #cipp #cipm #pipl #pdpa #dataprotectionlaw #privacycompliance #gdpr  #datasecurity #datagovernance #cybersecurity #privacymatters #onlineprivacy #privacyprotection #privacyawareness #privacy #uk #eu #privacybydesign #privacypolicy #privacyrights  #usprivacy #california #ccpa #cpra #lawyers #texas #newyork #apec  #vermont

6