Charles Simon

The Massachusetts Attorney General released guidance on AI developers, suppliers, and users' obligations under Massachusetts consumer protection, anti-discrimination, and data security laws. Nothing earth-shattering in the advisory notice and another example of how existing laws are being used to regulate AI. The advisory presents the below non-exhaustive list of acts and practices that may be considered to be unfair and deceptive under the Massachusetts Consumer Protection Act: - Falsely advertising the quality, value, or usability of AI systems - Supplying an AI system that is defective, unusable, or impractical for the purpose advertised - Misrepresenting the reliability, manner of performance, safety, or condition of an AI system - Offering for sale or use an AI system in breach of warranty, in that the system is not fit for the ordinary purposes for which such systems are used, or that is unfit for the specific purpose for which it is sold where the supplier knows of such purpose - Misrepresenting audio or video content of a person for the purpose of deceiving another to engage in a business transaction or supply personal information as if to a trusted business partner as in the case of deepfakes, voice cloning, or chatbots used to engage in fraud  - Failing to comply with Massachusetts statutes, rules, regulations or laws, meant for the protection of the public’s health, safety or welfare 

27

Deprecation doesn't matter if you have a multifaceted privacy strategy. Great point by Adam Klee. 𝙍𝙖𝙩𝙝𝙚𝙧 𝙩𝙝𝙖𝙣 𝙥𝙧𝙚𝙥𝙖𝙧𝙞𝙣𝙜 𝙛𝙤𝙧 𝙖 𝙨𝙞𝙣𝙜𝙡𝙚 𝙩𝙚𝙘𝙝𝙣𝙞𝙘𝙖𝙡 𝙘𝙝𝙖𝙣𝙜𝙚, 𝙡𝙞𝙠𝙚 𝙩𝙝𝙚 𝙡𝙤𝙨𝙨 𝙤𝙛 𝙩𝙝𝙚 𝙘𝙤𝙤𝙠𝙞𝙚, 𝙞𝙩'𝙨 𝙗𝙚𝙨𝙩 𝙩𝙤 𝙥𝙧𝙚𝙥𝙖𝙧𝙚 𝙛𝙤𝙧 𝙖 𝙗𝙧𝙤𝙖𝙙𝙚𝙧 𝙞𝙣𝙙𝙪𝙨𝙩𝙧𝙮 𝙨𝙝𝙞𝙛𝙩 𝙩𝙤𝙬𝙖𝙧𝙙 𝙜𝙧𝙚𝙖𝙩𝙚𝙧 𝙘𝙤𝙣𝙨𝙪𝙢𝙚𝙧 𝙖𝙬𝙖𝙧𝙚𝙣𝙚𝙨𝙨 𝙖𝙣𝙙 𝙖𝙪𝙩𝙤𝙣𝙤𝙢𝙮. Opportunity lies in being able to mitigate risk while still reaping the rewards for your business, in this case, the value you derive from identity-based data. So why wouldn't a business do this? They could choose not to, which might put them in a bucket with many others waiting to see what happens. The history in this space gives us a pretty good idea of what is unfolding and likely to unfold in the future. Credit: Adam Klee - Licorice #identity #privacy #regulatorychange #adtech #martech #consent

9

1 Comment

The IAPP has released the Privacy Summer Reading List 2024 📚 (https://lnkd.in/ecs8Cvds) The IAPP asked privacy professionals to recommend their favorite privacy-centered books focusing on a variety of topics including social media, data governance and AI. Huge thanks to Alexandra White for coordinating this year's list! Beyond this list, some books I've recently finished up and would recommend that connect to privacy, technology and business: 𝗧𝗵𝗶𝘀 𝗜𝘀 𝗛𝗼𝘄 𝗧𝗵𝗲𝘆 𝗧𝗲𝗹𝗹 𝗠𝗲 𝗧𝗵𝗲 𝗪𝗼𝗿𝗹𝗱 𝗘𝗻𝗱𝘀 🌎 (from the IAPP's 2022 list!) 𝘣𝘺 𝘕𝘪𝘤𝘰𝘭𝘦 𝘗𝘦𝘳𝘭𝘳𝘰𝘵𝘩 (https://lnkd.in/edQKjpYG) 𝗙𝗮𝗰𝗲𝗯𝗼𝗼𝗸: 𝗧𝗵𝗲 𝗜𝗻𝘀𝗶𝗱𝗲 𝗦𝘁𝗼𝗿𝘆 💻 𝘣𝘺 𝘚𝘵𝘦𝘷𝘦𝘯 𝘓𝘦𝘷𝘺 (https://lnkd.in/e58QiPyY) 𝗧𝗵𝗲 𝗙𝗼𝘂𝗻𝗱𝗲𝗿𝘀: 𝗧𝗵𝗲 𝗦𝘁𝗼𝗿𝘆 𝗼𝗳 𝗣𝗮𝘆𝗽𝗮𝗹 𝗮𝗻𝗱 𝘁𝗵𝗲 𝗘𝗻𝘁𝗿𝗲𝗽𝗿𝗲𝗻𝗲𝘂𝗿𝘀 𝗪𝗵𝗼 𝗦𝗵𝗮𝗽𝗲𝗱 𝗦𝗶𝗹𝗶𝗰𝗼𝗻 𝗩𝗮𝗹𝗹𝗲𝘆 💸 𝘣𝘺 𝘑𝘪𝘮𝘮𝘺 𝘚𝘰𝘯𝘪 (https://lnkd.in/ex25dZKQ) 𝗧𝗵𝗲 𝗘𝘃𝗲𝗿𝘆𝘁𝗵𝗶𝗻𝗴 𝗦𝘁𝗼𝗿𝗲: 𝗝𝗲𝗳𝗳 𝗕𝗲𝘇𝗼𝘀 𝗮𝗻𝗱 𝘁𝗵𝗲 𝗔𝗴𝗲 𝗼𝗳 𝗔𝗺𝗮𝘇𝗼𝗻 📦 𝘣𝘺 𝘉𝘳𝘢𝘥 𝘚𝘵𝘰𝘯𝘦 (https://lnkd.in/e8HZcZaV) Next up on my list of privacy/technology focused books are: 𝗜𝗻𝗳𝗹𝘂𝗲𝗻𝗰𝗲 𝗘𝗺𝗽𝗶𝗿𝗲: 𝗜𝗻𝘀𝗶𝗱𝗲 𝘁𝗵𝗲 𝗦𝘁𝗼𝗿𝘆 𝗼𝗳 𝗧𝗲𝗻𝗰𝗲𝗻𝘁 𝗮𝗻𝗱 𝗖𝗵𝗶𝗻𝗮'𝘀 𝗧𝗲𝗰𝗵 𝗔𝗺𝗯𝗶𝘁𝗶𝗼𝗻 🐧 𝘣𝘺 𝘓𝘶𝘭𝘶 𝘠𝘪𝘭𝘶𝘯 𝘊𝘩𝘦𝘯 (https://lnkd.in/eHEG_FEV) 𝗗𝗮𝗿𝗸 𝗪𝗶𝗿𝗲: 𝗧𝗵𝗲 𝗜𝗻𝗰𝗿𝗲𝗱𝗶𝗯𝗹𝗲 𝗧𝗿𝘂𝗲 𝗦𝘁𝗼𝗿𝘆 𝗼𝗳 𝘁𝗵𝗲 𝗟𝗮𝗿𝗴𝗲𝘀𝘁 𝗦𝘁𝗶𝗻𝗴 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻 𝗘𝘃𝗲𝗿 📞 𝘣𝘺 𝘑𝘰𝘴𝘦𝘱𝘩 𝘊𝘰𝘹 (https://lnkd.in/edEANvYi) #privacy #tech #ai #books

22

🚀 Exciting News for Consumer Privacy! 🚀 Minnesota has taken a significant step forward in protecting consumer privacy with the signing of the Minnesota Consumer Data Privacy Act as part of the omnibus bill HF 4757. This landmark legislation makes Minnesota the 19th state to enact a comprehensive privacy law, with the new regulations set to take effect on July 31, 2025. While becoming more complex to navigate being a US Based Technology firm using data to drive addressability, solutions exist to automate and optimize monetization and return on ad spend. https://lnkd.in/ga2T-UD5 #DataPrivacy hashtag #MarketingCompliance hashtag #MinnesotaLaw hashtag #OregonLaw hashtag #ConnecticutPrivacyLaw

34

So important for the marketing and advertising ecosystem to stand up and be heard.

14

[Comment] The use of artificial intelligence in the context of digital death - that is, the post-mortem management and representation of our online identity and data - is still in its infancy. The services currently available, such as StoryFile, Eternos.Life, Project December, LifeNaut, HereAfter AI, can only be considered as preliminary sketches of the real potential of this technology. The scope for progress and the potential for AI to capture a person's memory are considerable. Post-mortem use of the data that make up our memory is just one of the many possible applications for this type of service. Indeed, there is great ante-mortem potential in cloning our memories and processing them with AI. In the medical field, for example, this technology could have revolutionary applications. Take the case of Alzheimer's disease: an AI with access to a complete database of a patient's memories could potentially help stimulate residual memory, or even provide external support for lost memories. Similarly, for people suffering from post-traumatic amnesia, such a system could serve as a "back-up memory", helping to gradually reconstitute memories erased by the trauma. Memory can be affected by a whole range of disorders, including psychiatric disorders, stroke and traumatic brain injury. In all these areas, access to lost memories, facilitated by an AI processing our memory data, could prove extremely beneficial for diagnosis, treatment and patients' quality of life. ℹ LLink to research article "Griefbots, Deadbots, Postmortem Avatars: on Responsible Applications of Generative AI in the Digital Afterlife Industry", directed by Katarzyna Nowaczyk-Basińska, PhD & Tomasz Hollanek, PhD for Leverhulme Centre for the Future of Intelligence in the first comment

1

1 Comment

Joint press statement on the first review of the EU-US Data Privacy Framework. https://lnkd.in/eNtCDf46 This year's review has largely flown below the radar, a marked change compared to prior years and its highly publicized launch, suggesting that US and EU policymakers are more aligned on this one. Industry privacy leaders celebrated its first anniversary for the increased stability it ushered in. While we could see the framework reenter debate via the courts in conjunction with the European Data Protection Supervisor’s challenge of the European Commission’s own use of US cloud services, overall privacy professionals are spending far more time keeping up with the evolving global data transfer rulebook now that the transatlantic landscape has become more stable. #datatransfers

63

2 Comments

Signup to get the ADA Lawsuit Mid-year report early! The UsableNet data and research team tracks ADA-based digital accessibility lawsuits filed in state and federal courts. We review thousands of cases against websites and mobile apps to create our bi-annual accessibility reports. https://lnkd.in/eF8EwvdZ #WebAccessibility #ADA #Inclusion #Accessibility #A11y

7

Excellent analysis from Amy Olivero and Andrew Folks on FTC enforcement trends. While the US lacks a GDPR-like law, when it comes to advertising/marketing, the FTC has been super active(even more than the EU) in fining companies due to sensitive data sharing with advertisers. If you are health-tech company, the following measures can help you with compliance: 1. Create an inventory of third-party integrations in your mobile app, website 2. Ad-Tech comes in various forms - Pixels, SDKs, APIs, Server Side Tags, JS, make sure to inventory all of them 3. Classify Health Data based on recent cases: User Input, Search Query, User Name can all be health data 4. Create a report of all event names and make sure an audience/list name or event name does not reveal health information 5. Document Data Flows: Discover data elements being shared with these advertising third parties 6. Governance: Add automated privacy checks in software development lifecycle to ensure continuous compliance https://lnkd.in/eS7Hfm7s

36

This topic comes up frequently in my talks - what’s safe to enter into a LLM? Free models: Whenever a service is free, you are the product. Ideating is fine, but don’t upload proprietary data. Paid models: You can turn off the controls that determine whether the LLM will train future versions of itself on your data. These models are already trained on *trillions* of parameters that teach them what word might come next in a sentence. If they train on your data, it’s not like you’ve created a Wikipedia entry that the models can look up and regurgitate to another user - it’s more like you’ve poured a teaspoon of water into the ocean. Your specific inputs are diluted by trillions of other sentences. Enterprise models: ChatGPT Enterprise and ChatGPT Team do not train on your inputs by default. They are SOC-2 compliant, meaning it’s harder for hackers to access your data in the cloud or on its way to the cloud. This isn’t the strongest available data protection against cyber threats (HIPAA provides stronger protection for medical data, as an example). Hosting a local instance of an open-source LLM on your server: I think this is overkill for most DMO use cases. But for meeting planners or agencies who work with client data rather than their own… possibly worth the investment? In this example the data never leaves your server. To further complicate the issue, my brother just pointed out that I shouldn’t conflate data privacy with data security. Data security: SOC-2 compliance safeguards your data from unauthorized use. Data privacy: How is the information in your prompts used by the LLM provider? In part to provide the service (i.e. respond to your prompt), but perhaps also to improve future models, to identify and safeguard against future attempts to jailbreak the chatbot, or to enhance the user interface. ChatGPT Team still feels like the right approach to me for most tourism organizations but I’m eager to learn what others are doing! #destinationmarketing #chatgpt

4

AMERICAN PRIVACY RIGHTS ACT MOVING THRU CONGRESS: MAY.24 Attention CMOs & marketing-data-miners. You may find the below "Privacy Rights Act" of interest. Your world of "intrusive data-mining-based-marketing" will be disrupted soon. On April 7, 2024, Senate Commerce Committee Chair Maria Cantwell and House Energy and Commerce Committee Chair Cathy McMorris Rodgers jointly released a draft of the American Privacy Rights Act (APRA). The APRA would create a comprehensive federal consumer privacy framework. It builds on prior congressional efforts to enact a comprehensive privacy bill, most notably incorporating elements of the American Data Privacy and Protection Act (ADPPA) (H.R. 8152), which was advanced out of the House Energy and Commerce Committee during the 117th Congress. This Sidebar provides a summary of the APRA, as released on April 7, 2024, and briefly compares it with the ADPPA and other comprehensive privacy bills that have been introduced in Congress. The Sidebar explains that the APRA borrows a substantial amount from the ADPPA but includes material differences, such as its treatment of small businesses, approach toward minors, algorithmic opt-out rights, effective availability of a private right of action, and interaction with state laws. The Sidebar concludes by discussing stakeholders’ reaction to the APRA and potential litigation that may arise should the bill be enacted. Summary of the Bill Key Definitions The APRA’s chief focus is governing how covered entities use covered data. Thus, these two definitions are central to the bill’s scope. The APRA defines “covered entities” to include most individuals, commercial entities, and nonprofits that “alone, or jointly with others, determine the purposes and means of collecting, processing, and retaining, or transferring covered data.” Small businesses, among others, are exempt from this definition. The APRA defines “covered data” to include any information that “identifies or is linked or reasonably linkable” to an individual. Another key definition is sensitive covered data, for which the APRA provides additional protections. “Sensitive covered data” includes, among other things, government-issued identifiers, genetic information, health information, financial information, precise geolocation information, and information about an individual under the age of 17. The APRA would give the Federal Trade Commission (FTC) authority to expand the categories of sensitive covered data through regulation. Congressional Research Service https://lnkd.in/ghAERhvd LSB11161 Congressional Research Service 2 The APRA also defines large data holder and data broker, which are two subsets of covered entities that must comply with additional requirements. Large data holders are those covered entities with annual gross revenue of more than $250 million in the preceding calendar year that collect enough data to meet one of the bill’s thresholds.

2

New Privacy Regulations are now active in Texas and Oregon. As of July 1, we've hit a landmark where a total of seven states—including California, Colorado, Connecticut, Utah, and Virginia—have enacted data protection frameworks. The Oregon Consumer Privacy Act breaks new ground with the introduction of unique "sensitive data" categories such as victims of crime, national origin, and the status as transgender or non-binary. Oregon is also setting stringent transparency standards by mandating companies to provide a detailed list of third parties to which personal data is disclosed, upon consumer request. This move underscores the critical need for marketers to maintain accurate data sharing records. In Texas, the Data Privacy and Security Act mandates conspicuous footer language for notices to consumers regarding the potential sale of sensitive or biometric data. This requirement is a clear signal to marketers about the paramount importance of transparency in data handling practices. #DigitalMarketing #Compliance #OregonPrivacy #TexasPrivacy #ConsumerTrust #DataProtection https://lnkd.in/g2RqmKFf

6

Good analysis by Carey Lening, CDPP of the M$ 'recall' feature (love the scifi analogy) and intersection with the 'household' exemption under the GDPR. Key quote; "It turns out, that the ‘purely’ bit in ‘purely personal or household activity’ is really important, actually. It’s not enough, in other words, that processing is done for a personal reason — it has to be only for a personal or household use. When you start adding others to the mix and sharing that information, things get messy." Worth a read. https://lnkd.in/gPq_9pvb

10

3 Comments

Those of you who specialize in attribution but are seeking more meaningful work, come help to analyze (with properly anonymized data) the effectiveness of various programs and approaches to fostering health, equity and well-being. We need to do a better job of preserving health in advance rather than fixing it (at huge cost) when the damage is already done. #SDOH #health (not healthcare)

19

1 Comment

Hi folks, I'm excited to support the growing demand for AI governance professionals by earning the new AI Governance Professional certification through the IAPP - International Association of Privacy Professionals! 🤓 If you are interested too, check this out: https://lnkd.in/gaKRZYAU 👇 #iapp #aigp #responsibleai #rai #artificialintelligence #ai #aigovernance

242

16 Comments

I've posted often on #RegulatoryOverReach and #CostofRegulation, which have negative impacts on all sectors. Today I saw this #legal article, which highlights in extremely clear legal terms how #GDPR #overreach on the notion of #FreeConsent has been repeatedly stretched way beyond any original intentions, to try to regulate different #digital #businessmodels. There are a few important #principles across all sectors and markets. I hope we can all agree that companies should be free to structure their business models, online or offline, according to their sectors and applicable laws. EU legislators avoided sector/size-specific regulatory approaches in GDPR as that would reinterpret the rules. Last year, the #CJEU clarified that a #PayOrConsent model is an alternative for users who do not give consent to #PersonalisedAdvertising. This article shows clearly that the #EDPB should not anoint itself as price regulator in its upcoming #opinion. The #GDPR is NOT a price control instrument, and it appears dangerous for the #EDPB to enter into a debate where it has no mandate - on whether a service is offered for fair or reasonable price. IF we go down this road, where would it stop? I can see it potentially undermining so so many sectors. I hope every digital sector reads and spreads the worries I've flagged. Because this #OverRegulation might be coming for you next. #CCIAeurope CCIA Europe #DigitalEU #privacy https://lnkd.in/eH2Du5Xc

21

13 Comments

Comments from Perplexity AI’s CEO, noting that robots.txt is not a legal framework, and that Perplexity also relies on 3rd party crawlers for data access, will come as no surprise for publishers dealing with industrialised IP theft in the age of AI. https://lnkd.in/ehZi4wNT Robots.txt has at least 3 clear problems: It's voluntary - so no sanction for developers who ignore and scrape anyway. Essentially a parish notice asking billion dollar businesses not to nick the thing that's central to building and grounding their payday LLMs. No wonder many companies are ignoring requests.  The next government should mandate rules with significant penalties attached for crawlers who don’t comply with instructions from website owners. No transparency of crawlers - with no duty on web crawlers to identify themselves they can scrape and index IP anon.  So even with a web application firewall in place to block scrapers, as an IP owner you don't know who's scraping what or why tilll they dain to tell you.  We need a transparent register of first and third party crawlers used or utilised by any AI developer that wants to trade with UK businesses and consumers. Laundering of IP for commercial uses - Various copyright regimes around the world have well-meaning but flawed exceptions for text and data mining for non-commercial purposes.  These exceptions have created loopholes whereby academic institutions and non-profits scrape commercial IP for “non-commercial purposes”, only for these datasets to be repurposed by billion dollar businesses for commercial purposes, without a commercial licence.  The next government should narrow these exceptions, and put in place sanctions where non-commercial users of IP allow that data to be used for commercial purposes. There's lots of joined up thinking going on between different regulators on AI's impact on the UK economy and wider society.  The DRCF AI and digital hub is a good example of this collaboration in action.    But plans such as Peter Kyle + the The Labour Party's to create a Regulatory Innovation Office must also recognise the pivotal role of copyright in training and ground LLMs, and make sure that the Intellectual Property Office has a seat at that table.  There is no doubt that the IP created by companies within the UK’s world class knowledge economy is already being used to underpin AI technologies, at present largely without permission or reward.  Before technology companies get the chance to batter down the doors in Whitehall to integrate their AI into every aspect of the economy and the civil service, the next government needs to put in place a clear and transparent framework that supports a sustainable value exchange between the creators and commercial users of that high quality knowledge and information.

24

1 Comment

Please enjoy this short piece by Mallory Acheson, CIPP-E, CIPM and me*. * Mallory is responsible for most of the creation of this. And by “most,” I mean “virtually all.”

1