Keith Enright

Colorado leads the way in protecting neural data privacy with new legislation signed by Gov. Jared Polis. The bill expands the Colorado Privacy Act and sets a precedent for other states. Read more from Constangy Cyber Team member Amanda Novak in the link below. #coloradoprivacyact #cpa #dataprivacy #cybersecurity

2

From Husch Blackwell: We are currently tracking thirteen privacy and AI-related bills that previously crossed chambers prior to the legislative deadline. With the California legislature closing on August 31, we will be providing weekly updates on the progress of these bills. #dataprivacy #ai #artificialintelligence #california #legislation

2

On April 17, Colorado Governor Jared Polis signed HB 1058 into law, which means it is time to update our chart comparing the various definitions of sensitive data in consumer data privacy laws. Here's some more context: 1️⃣ HB 1058 amends the Colorado Privacy Act to add biological data (and through it neural data) as a category of sensitive data in the Colorado Privacy Act. 2️⃣ The true impact of the amendment is debatable as the definition of biological data states that the data must be "used or intended to be used, singly or in combination with other personal data, for identification purposes." 3️⃣ Colorado is the first state to add biological/neural data to its state privacy law. This continues the trend over the last two legislative sessions of state lawmakers expanding the types of data covered as sensitive data. Given the constant expansion, at some point it may be easier to define what is not sensitive data rather than what is. 4️⃣ California is also considering a bill to add neural data to the CCPA's definition of sensitive personal information. 5️⃣ Colorado isn't done. The legislature is still considering two other bills to amend the Colorado Privacy Act, dealing with the treatment of biometric data and minor's data. 6️⃣ Here's a link to the Colorado bill for those interested: https://lnkd.in/gE7KPyY9

134

9 Comments

Patchwork privacy protections won't shield the public from the invasive aspects of AI. Now's the time to update and bolster privacy and consumer protection laws. Don't take my word for it - Ryan Calo (University of Washington) makes quite the compelling case on this podcast from The Lawfare Institute. Give it a listen over your coffee and let me know what you think! https://lnkd.in/eXZmdvGa

9

In case you missed it: Colorado Governor Jared Polis signs SB205 into law, offering new consumer protections for AI interactions. What does this mean for your business? Stay ahead with insights from my colleagues in our Artificial Intelligence Sector. #ArtificalIntelligence #IndustryNews #InnovativeTechnology

3

When AI is trained with unlicensed copyrighted material, the question of infringement versus fair use remains unresolved. Many copyright holders assert that this use violates their rights, and are litigating to address the issue. In light of this, is it premature to require AI companies to disclose which copyrighted works are used to train their generative AI systems? #ai #trainingdata

2

Ensuring our AI systems understand context and avoid unexpected outcomes is key to maintaining reliability and user satisfaction — and, in one humorous case, “Rickrolling.” My Foley colleague discusses how robust training datasets and precise AI tuning are essential to user experience and trust. #ArtificialIntelligence #AI #InnovativeTechnology #IntellectualProperty

2

Earlier today, the California Privacy Protection Agency Board voted to advance the new draft CCPA regulations to formal rulemaking. We thought it might be helpful to provide a series of short high-level summary webinars on the new rulemaking topics, starting with automated decisionmaking technology (ADMT). If you missed the Board meeting, the draft ADMT rules were a source of many comments and concerns, including their impact on artificial intelligence. There can be no doubt that the ADMT regulations will generate many proposed revisions. https://lnkd.in/guW-BJPc

134

2 Comments

Following #AI regulation? Then you need to follow the draft California Consumer Privacy Act (#CCPA) regulations involving automated decisionmaking technology (#ADMT) In short, ADMT means any technology that processes personal information and uses computation to execute a decision, replace human decisionmaking, or substantially facilitate human decisionmaking. And in this case, “technology” includes #artificialintelligence. It's worth reviewing the details if this would apply to you but some of the highlights are: (1) the requirement to notify consumers prior to use, (2) establishing opt outs and access rights, and (3) requiring risk assessments. Great work here by Keir Lamont keeping us all up to date!

10

1 Comment

The brain is the new privacy frontier: Responding to developing technologies in the neurotech space, a number of American states have amended their privacy laws to include "neural data" in their definition of sensitive personal information. Some require opt-in consent for its collection, others simply the possibility for a data subject to opt out. Some have included employees' neural data in the definition, others not - with varying implications for privacy protection:

7

🔎 Quick highlights from the draft of the American Privacy Rights Act (APRA) ➡ Covered data is now defined as "information that identifies or is linked or reasonably linkable, alone or in combination with other information, to an individual or a device that identifies or is linked or reasonably linkable to 1 or more individuals." ➡ APRA covers data that can be derived or inferred. Currently, only California and Oregon address this. ➡ APRA uses "Individuals" instead of "Consumers" (which most state privacy laws use Consumers). The devil is in the definition 👿 ➡ APRA's applicability extends beyond the business-to-consumer context and includes nonprofit organizations. ➡ Exemptions are provided for government entities and their service providers, small businesses with less than USD40 million in rolling three-year average gross revenue that handle the data of fewer than 200,000 individuals or do not broker data, and publicly available information. ➡ Employee information exempt to the extent it is provided for publicly available "business contact information" that is made available on a website or online service to all members of the public, including the name, position or title, business telephone number, business email address, or address of the employee. #privacy #APRA #dataprotection #individuals #employees #organizations #smallbusinesses #governmententities #publicinformation

6

I’m loving all the 2025 #privacy predictions—ranging from shifts (or slowdowns) in #FTC enforcement, to differing views on the likelihood of a federal law, and the potential emergence of a diluted AI compliance culture. Instead of speculating on the future, I’m taking a practical approach.🔧 Putting my operational privacy hat back on, I wanted to share pragmatic, actionable steps privacy leaders and teams can take now to strengthen their programs and prepare for whatever the future may bring. TL;DR: - Build more agile and adaptable privacy programs - Deepen collaboration with executive leadership - Enhance your knowledge of AI and other emerging technologies - Reevaluate the effectiveness of your current privacy tech stack - Actively engage with the broader community to ensure your voice is heard Anything you'd add? Explore my full thoughts below💡

28

3 Comments

Dear Friends: As the California Privacy Protection Agency advances CCPA regulations on Cyber, Risk, and AI (see https://lnkd.in/gQHia6Bx), I have a prediction: The Federal government will adopt a comprehensive data privacy law before the mid-term elections in 2026. A bold prediction? Yes. Mind you, I've been saying for years we would not get a comprehensive Federal privacy law any time soon. I knew this empirically. Washington could not even get its act together to adopt a relatively "thin" data breach notice law. Both sides of the aisle found creative ways to disagree - material risk of harm or not, pre-emption or not, private rights of action or not, etc. A comprehensive data privacy law is much more complicated. It raises all of the same areas of conflict as a data breach notice law (e.g., private rights of action or not, etc.), plus a range of substantive issues on scope, rights, sensitive personal data, data protection assessments, profiling, etc. But now, with Republicans taking control of both houses of Congress and the White House, I could see how a pro-business privacy law that pre-empts state privacy laws, could find itself – perhaps as part of a second or third wave of legislation – across the finish line. Shocking prediction? Perhaps. But in today’s world I think anything is possible.  #dataprivacy #AI #CCPA  

50

4 Comments

From DC to Sacramento, AI regulation remains a hot (and often contentious) topic. Big thanks to Helen Toner and Zachary Arnold of Center for Security and Emerging Technology (CSET) for coming on The Lawfare Institute podcast to talk about a regulatory agenda that could unite "doomers" and "ethicists." Thanks also to Graham Hardig for excellent research assistance in preparing for this exciting interview. Give it a listen: https://lnkd.in/e4G3cHag

20

Please see the article I wrote with my fabulous colleague Terry Shieh-Newton on how to approach IP strategy when it comes to AI technology.

54

Excited to speak as a panelist at CenterForce USA's conference on "Developing a Comprehensive Corporate AI Policy: Legal, Ethical, and Compliance Considerations." This Thursday, May 30 in Chicago, I'll be joining experts 👉 Michael Booden, JD, CIPP/US, CIPP/E, of HUB International 👉 Donna Haddad of IBM 👉 Julie Honor of Thompson Hine LLP and 👉 David Oberst of The Boler Company® for an insightful discussion of best practices for developing a sound corporate #AIPolicy! #AI #AIPolicy #LegalTech #Compliance #dataprotection #datasecurity #cybersecurity #riskmanagement

7

If you are a data broker and you know it then you really got to show it (and register, and provide adequate disclosures). The Enforcement Division of the California Privacy Protection Agency (CPPA) is conducting a public investigative sweep of data broker registration compliance under the Delete Act (https://lnkd.in/e4TfhWQP) You are a data broker if you: knowingly collect and sell to third parties the personal information of a consumer with whom you do not have a direct relationship. If you are you need to register with the CPPA; provide disclosures and comply with the Delete Act regarding data deletion requests - see here (https://lnkd.in/ePpk87Kj) But also - the Consumer Financial Protection Bureau is coming after you (https://lnkd.in/eM4cjBKU) and the Federal Trade Commission (https://lnkd.in/ebHVMBYK) and generally you should do a lot of compliance things - see our webinar with Lusha's Assaf Gilad and Latham & Watkins' Calum Docherty (https://lnkd.in/eDg7eaNf) #dataprivacy #dataprotection #privacyFOMO pic by ChatGPT

34

3 Comments