Erez Liebermann

What to expect from the California Privacy Protection Agency meeting today? Some highlights: Objection to preemptive Federal privacy law: The CPPA will discuss its position on this law, which objects to preemption - this is is also in a letter from Executive Director Soltani and a number of State AGs (https://lnkd.in/erQvhJuX) Discuss California Privacy/AI bills including: (https://lnkd.in/eHRpEzHQ) 🔹 Requiring browsers to honor opt out preference signals (OOPS) (AB 3048) 🔹 Removing the M&A carve out and making data sharing during an asset purchase - a potential sale (AB 1824) 🔹 Adding neural data to the definition of sensitive information (similar to Colorado) (SB 1223). 🔹 Prohibiting a developer from using personal information of an under 16 to train AI without authorization (AB 2877) 🔹 Requiring registration of data digesters (aka "providers" under EU AI Act) and giving AI enforcement authority to the CPPA (AB 3204) 🔹 Imposing requirements re: algorithmic discrimination on developers and deployers (AB 2930) 🔹 Requiring consent for selling or sharing of information of under 18s (AB 1949) [Staff recommended that the agency supports this subject to amendment] (https://lnkd.in/ePDm2uma) 🔹 Data Broker registry regulations (https://lnkd.in/eVqenp-J) (recommend to move to formal rulemaking: https://lnkd.in/eR_hzxJS) 🔹 Amendments to existing regs (https://lnkd.in/ejMng6Jn) #dataprivacy #dataprotection #privacyFOMO #AIFOMO

29

Colorado leads the way in protecting neural data privacy with new legislation signed by Gov. Jared Polis. The bill expands the Colorado Privacy Act and sets a precedent for other states. Read more from Constangy Cyber Team member Amanda Novak in the link below. #coloradoprivacyact #cpa #dataprivacy #cybersecurity

2

This is a #privacy #bigdeal.👇🏻Do companies start #optingout of certain states due to #PRA risk? Not a viable strategy for long term as data practices continue to become more heavily regulated x ♾️ in more and more states/national level. #privacylaws #moreprivacylaws More press from CR on this here touting the pro consumer features of the law: https://lnkd.in/euCgq_2K.

46

2 Comments

On April 7, 2024, US Senate Commerce Committee and House Energy and Commerce Committee unveiled the American Privacy Rights Act of 2024 (APRA), a comprehensive privacy bill that, if enacted, would set significant data privacy and security standards. The APRA would largely preempt similar comprehensive privacy laws enacted by individual states in the last few years. The APRA would also provide individuals with a limited private right of action to seek monetary and other relief for certain violations by covered entities. Although the APRA is not likely to pass in the current Congress, the bipartisan effort suggests future comprehensive federal legislation. #dataprivacy

4

The Court dismissed a large portion of the U.S. Securities and Exchange Commission's complaint against SolarWinds and Timothy Brown. SolarWinds and its customers – federal and state government agencies as well as 1,500 publicly traded companies – were victims of a large-scale cyberattack, known as SUNBURST, which was orchestrated by state-sponsored hackers in Russia, which was discovered in 12/20. The SEC brought an unprecedented and extensive enforcement action against SolarWinds arising from its cybersecurity practices and its disclosures about those practices prior to and after SUNBURST. For context, the Court described SUNBURST. Between 1/19 and 11/20, threat actors repeatedly accessed SolarWinds’ network through a VPN. These threat actors were able to access SolarWinds’ entire network and exfiltrate voluminous amounts of data without “triggering alerts from SolarWinds’ data loss prevention software.” These threat actors then launched the SUNBURST attack by inserting malicious code into three different Orion software builds used by approximately 18,000 customers. As a result, the malicious code gave the threat actors a “backdoor” into the networks of SolarWinds’ customers who downloaded and installed the infected software.    The Judge dismissed all post-SUNBURST charges finding they “impermissibly rely on hindsight and speculation,” but is allowing the SEC to pursue pre-SUNBURST securities fraud claims against SolarWinds and Timothy Brown based upon the SolarWinds’ Security Statement published on its website beginning in 2017, which the SEC alleges were materially misleading regarding SolarWinds’ cybersecurity posture. While SolarWinds held itself out “as having sophisticated cybersecurity controls in place and heeding industry best practices,” the Court concluded that based upon the pleadings, “the company feel way short of even basic requirements of corporate cyber health.” The Court dismissed claims based upon press releases, blogs, and podcasts “because each qualifies as non-actionable corporate puffery.” Court also dismissed charges based upon SolarWinds’ cybersecurity risk disclosure finding it could not have misled a reasonable investor. The Court further dismissed the claims based upon post-SUNBURST disclosures. For instance, the Court found that SolarWinds’ Form 8-K disclosures were not misleading and captured the severity of the attack. The first Form 8-K was filed just two days after SolarWinds learned of the vulnerability in its product and the malicious code.   Lastly, the Court dismissed novel claims that SolarWinds’ also failed “to devise and maintain internal accounting controls” finding that these requirements do not apply to cybersecurity; they require that public companies devise and maintain a system of internal accounting controls that addresses financial accounting issues. The Court dismissed the disclosure controls and procedure claims as well.   There will be more to come on this. See attached opinion.

55

5 Comments

#ICYMI: New #DataPrivacy laws took effect on July 1 in #Texas, #Oregon, and #Florida. Constangy Cyber Team members Carolyn Ho and Sarah L. Rugnetta Esq., CIPP-E wrote an article for The Legal Intelligencer discussing these updates and what employers need to know to ensure compliance and avoid penalties. Read more in the link below.

1

Please enjoy this short piece by Mallory Acheson, CIPP-E, CIPM and me*. * Mallory is responsible for most of the creation of this. And by “most,” I mean “virtually all.”

1

The recently unveiled American Privacy Rights Act (APRA) would regulate the collection, processing, retention, and transfer of “covered data” by certain entities, setting significant data privacy and security standards across the US. APRA also includes several impactful provisions that would affect organizations and entities developing and utilizing artificial intelligence (AI). Our alert provides key considerations for these proposals from the perspective of AI. #dataprivacy #AI #APRA

2

Yesterday, Maryland became the 17th state to enact a comprehensive data privacy statute. With more than 40% of the U.S. population residing in those states, the patchwork of data privacy laws in the U.S. has created significant legal challenges for companies doing business nationwide. However, with Congress taking up the new American Privacy Rights Act (APRA), those challenges may soon abate. Drawing on data privacy and protection concepts from international regulations and state comprehensive data privacy laws, the APRA creates a unique law that attempts to address contemporary privacy concerns while simultaneously anticipating future technologies. But will it pass? --- Thanks to ALM and Law.com Pro for publishing Andria Adigwe and my thoughts. #dataprivacy #dataprivacylaw #cyberlaw Buchanan Ingersoll & Rooney PC Higginbotham AFCEA Central Maryland Chapter Chris Hughes IAPP - International Association of Privacy Professionals National Defense Industrial Association - (NDIA) Business Executives for National Security (BENS) Daniel Solove Benjamin Yelin April Falcon Doss Ahmed Eissa

63

1 Comment

As rapidly evolving #AI capabilities collide with the ongoing 2024 elections, federal and state policymakers increasingly are taking steps to protect the public from the threat of deceptive AI-generated political content. Read some key examples. https://okt.to/vFGSgW #Deepfakes

8

The most recent criminal case involving artificial intelligence emerged last week from a Maryland high school, where police say a principal was framed as racist by a fake recording of his voice. The case is yet another reason why everyone — not just politicians and celebrities — should be concerned about this increasingly powerful deep-fake technology, experts say. “Everybody is vulnerable to attack, and anyone can do the attacking,” said Hany Farid, a professor at the University of California, Berkeley, who focuses on digital forensics and misinformation. Here’s what to know about some of the latest uses of AI to cause harm: AI HAS BECOME VERY ACCESSIBLE Manipulating recorded sounds and images isn’t new. But the ease with which someone can alter information is a recent phenomenon. So is the ability for it to spread quickly on social media. The fake audio clip that impersonated the principal is an example of a subset of artificial intelligence known as generative AI. It can create hyper-realistic new images, videos and audio clips. It’s cheaper and easier to use in recent years, lowering the barrier to anyone with an internet connection.

1

Our technology transactions team take a closer look at the four draft publications released by the U.S. Department of Commerce intended to help improve the safety, security, and trustworthiness of AI. These publications were prepared in response to President Biden’s landmark Executive Order that advances a coordinated, federal government-wide approach toward the safe and responsible development of AI. Learn more from our team Alex Touma, Daren Orzechowski, and Jack Weinert here. #AOShearman

1

Our technology transactions team take a closer look at the four draft publications released by the U.S. Department of Commerce intended to help improve the safety, security, and trustworthiness of AI. These publications were prepared in response to President Biden’s landmark Executive Order that advances a coordinated, federal government-wide approach toward the safe and responsible development of AI. Learn more from our team Alex Touma, Daren Orzechowski, and Jack Weinert here. #AOShearman

7

Join Director Lestin Kenton at The AI Strategy Summit: IP, Data and Compliance, hosted by CenterForce USA on May 22, 2024, in Palo Alto, CA. Lestin is a speaker on the "Navigating Intellectual Property Challenges in AI-Driven Innovations" panel. Register here: https://lnkd.in/e-tXxeT8 The panel will discuss: 1️⃣ AI as Inventor: Legal Implications and Future Directions 2️⃣ Ownership and Licensing Strategies for AI-Generated IP 3️⃣ Harmonizing Global IP Laws for AI Innovations Don't miss out on this insightful discussion! #AI #IntellectualProperty

9

The House Subcommittee on Innovation, Data, and Commerce has approved a major overhaul of the American Privacy Rights Act (APRA) This draft bill aims to: Strengthen data privacy protections for consumers by placing stricter limits on how businesses collect, store, and use personal information. Update the Children's Online Privacy Protection Act (COPPA) to further safeguard children's data online. Empower teenagers with a "digital marketing bill of rights" and establish a Youth Marketing and Privacy division within the FTC. Streamline data transfers for research purposes while maintaining privacy safeguards. Increase oversight of algorithms by tasking the National Telecommunications and Information Administration (NTIA) and independent auditors with evaluating their impact on data privacy. This is a significant step forward for federal data privacy legislation in the US. #APRA #DataPrivacy #ConsumerRights #COPPA #FTC

8

1 Comment

I wrote a second Bloomberg Law analysis piece regarding the surge in state child online privacy laws, showing that the laws are surprisingly varied and nuanced. Check out the state patchwork 2.0. https://lnkd.in/gkBCkuWP #privacy #childonlineprivacy #stateprivacylaw #dataprivacy #dataprotection

25

4 Comments

Excited to speak as a panelist at CenterForce USA's conference on "Developing a Comprehensive Corporate AI Policy: Legal, Ethical, and Compliance Considerations." This Thursday, May 30 in Chicago, I'll be joining experts 👉 Michael Booden, JD, CIPP/US, CIPP/E, of HUB International 👉 Donna Haddad of IBM 👉 Julie Honor of Thompson Hine LLP and 👉 David Oberst of The Boler Company® for an insightful discussion of best practices for developing a sound corporate #AIPolicy! #AI #AIPolicy #LegalTech #Compliance #dataprotection #datasecurity #cybersecurity #riskmanagement

7