Nikolas Guggenberger

For some months I have been discussing and debating with various experts about whether LLMS "contain or store" personal information. Technologists say no, but some data protection experts have maintained that "tokens" and how they may correlate with each other to spit our personal information are therefore personal information. (This is separate from the question of does a LLM produce personal information in response to a query). I have also been of the view that the model does store personal information in this statistical format. This opinion from the Hamburg DPA is very helpful and provides an analysis of why the tokens and associations in the model should not be viewed as personal information. I am still trying to get my head around how knowledge about correlations of parts of words that a query can assemble into personal information are not actually simply by definition personal information, but the DPA provides a compelling perspective. In the comments I am posting some alternative views that are usful to understand this debate. See blog by David Rosenthal in particular. https://lnkd.in/evGS2nai?

52

9 Comments

On April 8, 2024, the New York State Bar Association released its own report and recommendations on the use of AI by lawyers. Among those instructive recommendations is a direction for lawyers to avoid sharing client personal information when using certain generative AI tools. The report also recalls that “when using ChatGPT or other similar AI tools, attorneys must verify the accuracy of the information and legal authority produced by such tools.” This is a direct reference to the recent Avianca case where a Californian law firm was fined for having “submitted non-existent judicial opinions with fake quotes and citations created by *** ChatGPT”. It is important to stress that the report offers no conclusions since AI continues to evolve. This shows how quick is the pace of innovation in the AI field.  This also shows how realistic and reasonable lawyers are!

9

🔍 Deep Dive: USPTO's New AI Patent Eligibility Examples The USPTO has released three new #examples (47-49) to illustrate the application of subject matter eligibility criteria for #AI inventions. Let's break them down: 1. AI-Based Medical Diagnosis System - ✅ Eligible - Why? Integrates AI with specific steps to improve diagnostic processes - Key lesson: Show how AI practically improves a specific field 2. AI-Enhanced Manufacturing Process - ✅ Eligible - Why? Demonstrates concrete AI application optimizing manufacturing in real-time - Key lesson: Highlight AI's contribution to technical solutions in industrial contexts 3. AI-Driven Financial Analysis Tool - ❌ Ineligible - Why? Merely automates a mental process without technological improvement - Key lesson: AI must go beyond automation, contributing novel technical advancements These examples offer crucial insights for drafting AI patent claims. They emphasize the importance of demonstrating: 1. Practical improvements in specific fields 2. Concrete applications solving technical problems 3. Novel technological advancements beyond mere automation For in-house counsel, these examples provide a roadmap for framing AI #inventions to meet #subjectmattereligibility requirements. They underscore the USPTO's approach to balancing innovation promotion with responsible AI development. #AIPatents #IntellectualProperty #USPTO #PatentStrategy Any thoughts? Feel free to comment below. https://lnkd.in/eyqjNCVq

11

2 Comments

The Supreme Court ruling in Loper Bright Enterprises v. Raimondo could have significant implications for the SEC and the crypto landscape, particularly in cases where statutory terms are unclear. The Howey test, which determines when a crypto asset is a security, has been viewed as ambiguous in defining an "investment contract." However, in many cases, it appears that courts have been applying their independent judgment to these cases, rather than relying on the SEC's interpretation, leading to varied judicial outcomes. The Loper decision may solidify this trend, allowing courts to continue independently evaluating whether certain crypto assets qualify as securities. On June 28, 2024, the Supreme Court overturned Chevron, emphasizing that the Administrative Procedure Act requires courts to exercise their independent judgment in deciding whether an agency has acted within its statutory authority, and courts may not defer to an agency interpretation of the law simply because a statute is ambiguous. The 1984 Chevron case established a two-step approach, requiring deference to agencies only when clear congressional intent was absent. The ruling clarifies that statutory ambiguity does not automatically imply that an agency, as opposed to a court, should resolve interpretive questions. While an agency’s viewpoint can be insightful, particularly if grounded in its specialized knowledge, courts are not obligated to defer to agency interpretations simply due to statutory vagueness. Link to decision here: https://lnkd.in/gJwXTa4c

36

2 Comments

In our latest Future of Privacy Forum blog post, Tatiana Rice and I examine the history-making Colorado Artificial Intelligence Act, the first #law in the US to comprehensively regulate the development and deployment of #AI systems. In particular, we explore the law's broad scope of regulated entities and their role-specific obligations, and we outline how the law establishes a duty of care to mitigate algorithmic discrimination. We also note the law's novel consumer rights and the rulemaking and enforcement authorities it grants to the Attorney General. I also encourage you to read FPF's policy brief on the Colorado law (linked in the blog post). Extra shout-outs to Tatiana Rice, Keir Lamont, and Jordan Francis for publishing this (extremely) helpful resource.

63

U.S. Senators Lummis (R-WY) and Gillibrand (D-NY) this morning released a draft 179-page bill to create a regulatory framework for #stablecoins. A bipartisan House bill being drafted by HFSC Chair McHenry (R-NC) and Ranking Member Waters (D-CA) is also expected soon. Attached is a copy of the draft Lummis-Gillibrand bill. #financialregulations #blockchain #payments #progress 😉

15

1 Comment

AI & lawyers update: See rules below. Low hanging fruit and very delayed based on the US litigator using AI for caselaw citations and quotes that were incorrect. I personally think Courts could adopt Elsevier's policies. AI is here to stay, with data analysis... however the below is a tad reactive and lower ambition than I hoped. https://lnkd.in/gh2def4a

4

The U.S. Patent and Trademark Office (USPTO) recently released new guidance for practitioners using artificial intelligence (AI)-based tools. The guidance primarily serves as a reminder of longstanding requirements and best practices for patent and trademark practitioners. For example, patent practitioners have a duty of candor and good faith to the USPTO and a duty of confidentiality to their clients. The guidance does not announce any new law or rule regarding practicing before the Office;  rather, it provides some insight into how the Office expects practitioners to operate when incorporating AI-based tools into their practice.

19

1 Comment

Another angle on the EU AI Act as published! We probably all know the Act was published today and the schedule for incoming obligations - especially the first general obligation, for AI Literacy, affecting all providers and deployers of AI systems from August 2025. I thought I would check if anything has changed since March in the "legal-linguistic finalisation". I attach an informal comparison. Most of the changes are consistency, clarity, cross-references, etc. But there are a few instances of substantive new wording. Top of my list follows (limited by the LinkedIn wordcount). ➡ The effect of Article 2(12) has been reversed (as some predicted). It now says that that Act does *NOT* apply "to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50." ➡ The penalties under Article 99(4) now apply to "non-compliance" with Article 5, not just to "non-compliance of an AI system". (That could have been an interesting loophole ...). ➡ the definition of "AI system" has been tweaked! I doubt the changes are material ... but then, why change it now? ➡ "putting into service" no longer specifically mentions "by the provider". That might have conflicted with obligations of other actors who put AI into service, such as product manufacturers. ➡ The definitions of "notified body", "CE marking", "national competent authority" and "profiling" have also been changed. ➡ The prohibition on subliminal techniques now requires causing harm or being "reasonably" likely to cause harm. ➡ Tidying up of the interaction between the AI Act and other EU legislation relating to safety components - see Recital (50) and Article 2(2). ➡ The words "To ensure consistent implementation, it is appropriate to empower the Commission to adopt implementing acts on the application of the provisions on the labelling and detection of artificially generated or manipulated content" have been deleted from Recital (135). The intention seems to be to attempt codes of practice first (see Article 50(7)). (Henry Ajder) ➡ In Recital (169) the decisions of the Commission under the Act are now expressly subject to "the unlimited jurisdiction of the Court of Justice with regard to penalties pursuant to Article 261 TFEU". ➡ Articles 40, 41, 53 and 55 regarding standardisation, specifications, codes and deemed compliance have been tidied up quite a bit. ➡ Articles 58-60 (Sandboxes) have been tweaked regarding the application to prospective provider/provider/prospective deployer/deployer. ➡ Article 92(5): representatives of providers are expressly required to supply information for evaluations conducted by the AI Office. Anything important to add?

201

14 Comments

Important and amazing work done by the FAIR-IMPACT team, which resulted in the paper: “Core metadata schema for legal interoperability”: https://lnkd.in/exF_VrVk ‘FAIR-IMPACT aims to support the implementation phase of the European Open Science Cloud. To this end, FAIR-IMPACT has a focus on the EOSC Interoperability Framework. The perspective for this deliverable is on legal interoperability for core metadata schemes for research datasets which refers to the ability to share, access, and use research data across different legal jurisdictions and institutions while complying with relevant laws, regulations, and policies.’ See: https://lnkd.in/eNag2_gH It was truly an honourable request to review the deliverable, and my opportunity to support and contribute to ‘legal interoperability’, facilitating responsible access, and use of research data across different legal jurisdictions and institutions. #FAIR #EOSC #LegalInteroperability

4

Read patent examiners reactions to Congress's call for Kathi Vidal, Under Secretary of Commerce for Intellectual Property to investigate those reddit comments. I imagine USPTO management will respond to Congress by rounding up the usual suspects and deny any responsibility for patent examiners' and patent applicants' pressing concerns. "This is undoubtedly a bad look for the office. That being said, think for a minute about the typical content of this subreddit: obscenely high attrition rates; millions of dollars wasted hiring and firing examiners nonfunctional IT systems and resulting wage theft by management a broken docketing system that assigns applications to examiners who are not qualified to examine them examiners not being given enough time to properly examine applications. It's incredibly frustrating that out of all the damning stuff that gets posted here, this is what finally gets picked up by outside media and politicians." https://lnkd.in/dhgTvgBq

14

6 Comments

On April 17, Colorado Governor Jared Polis signed HB 1058 into law, which means it is time to update our chart comparing the various definitions of sensitive data in consumer data privacy laws. Here's some more context: 1️⃣ HB 1058 amends the Colorado Privacy Act to add biological data (and through it neural data) as a category of sensitive data in the Colorado Privacy Act. 2️⃣ The true impact of the amendment is debatable as the definition of biological data states that the data must be "used or intended to be used, singly or in combination with other personal data, for identification purposes." 3️⃣ Colorado is the first state to add biological/neural data to its state privacy law. This continues the trend over the last two legislative sessions of state lawmakers expanding the types of data covered as sensitive data. Given the constant expansion, at some point it may be easier to define what is not sensitive data rather than what is. 4️⃣ California is also considering a bill to add neural data to the CCPA's definition of sensitive personal information. 5️⃣ Colorado isn't done. The legislature is still considering two other bills to amend the Colorado Privacy Act, dealing with the treatment of biometric data and minor's data. 6️⃣ Here's a link to the Colorado bill for those interested: https://lnkd.in/gE7KPyY9

134

9 Comments

I enjoyed participating in this thoughtful discussion about the potential risks and benefits that AI poses at the Social Security Administration’s National Disability Forum on “How Artificial Intelligence May Affect the Landscape of Social Security.” The bottom line, I think, is that machine learning AI generally, and generative AI in particular, have immense potential to reduce backlogs of SS claims and improve fraud detection. For those seeking SS benefits, AI can enhance their ability to navigate the claims process and to understand and contest claim denials. But each of these use cases comes along with significant and distinct risks that must be proactively managed both for narrow consumer protection reasons and because of the broader prospect that high-profile problems with AI will deter innovation. Thanks to Regina "Gina" Kline for doing a great job hosting, and to my fellow panelists Rylin Rodgers Adler A. and Jason Green-Lowe. Thanks also to James Edrington Brian Peltier Margaret Knowles and Charlotte Magee, PhD Marcela Escobar-Alava!

18

So glad that Marc is bringing attention to early U.S. leadership on privacy and data protection. This is the 50th anniversary year of Congress declaring that “the right to privacy is a personal and fundamental right,” and then proceeding to embody fair information practice principles (FIPPs) into federal law (well before other countries and the OECD followed suit). The Federal Privacy Act of 1974 stacks up well to this day against its descendants. If one wishes to confirm this observation, peruse 5 USC 552a. Note that the congressional declaration of privacy as a “fundamental right” was duly enacted into law, but was not codified in the operational provisions of 5 USC 552a. The full text of the Privacy Act, enacted as Public Law 93-579, is available here: https://lnkd.in/evjfHAZV. See section 2(a)(4) for Congress’ declaration of the fundamental right.

17

3 Comments

The EU AI Act received the "final green light" today. Tomorrow, I'm chairing an extremely timely panel with Kai Zenner, MEP and a key architect of the EU AI Act, and Gabriela Commatteo, the UK's AI Regulation Policy Team Lead. We'll be discussing why AI regulation is needed, whether the EU AI Act will have the same "Brussel's Effect" as the GDPR, the latest developments with the UK's approach to AI regulation, the pros and cons of "cross-cutting" regulation and practical steps for companies facing a fractured and fast developing regulatory environment for AI. Catch us at the Morning Plenary Panel Discussion at the Generative AI Summit, tomorrow at 10am. The EU AI Act is greenlit: https://lnkd.in/eEP_vE7u https://lnkd.in/eN2wBYm5 #AI #GenerativeAI #AIAct #regulation

72

5 Comments

Today, June 18, is the official release date of my new book, "The EU Geo-Blocking Regulation: A Commentary." The book discusses geoblocking issues in general, analyzes in detail in 2018 European Union regulation, including its legislative history and implementation, and comments on related matters, such as the role of geoblocking in copyright law, and the interface between geoblocking and antitrust/competition law. The book should be useful for all who implement geoblocking or are considering employing geoblocking tools, whether they are in or outside the EU. Many of the topics apply globally, and the regulation has a significant extraterritorial reach. https://lnkd.in/eqt9HDcE #geoblocking #geolocation #eulaw Court of Justice of the European Union Council of the European Union European Commission European Parliament European Court of Auditors #copyright #copyrightlaw #antitrust #competitionlaw #nondiscrimination #internalmarket #digitalsinglemarket Edward Elgar Publishing William S. Boyd School of Law, University of Nevada-Las Vegas #unlv Geo Week

26

3 Comments

The Court dismissed a large portion of the U.S. Securities and Exchange Commission's complaint against SolarWinds and Timothy Brown. SolarWinds and its customers – federal and state government agencies as well as 1,500 publicly traded companies – were victims of a large-scale cyberattack, known as SUNBURST, which was orchestrated by state-sponsored hackers in Russia, which was discovered in 12/20. The SEC brought an unprecedented and extensive enforcement action against SolarWinds arising from its cybersecurity practices and its disclosures about those practices prior to and after SUNBURST. For context, the Court described SUNBURST. Between 1/19 and 11/20, threat actors repeatedly accessed SolarWinds’ network through a VPN. These threat actors were able to access SolarWinds’ entire network and exfiltrate voluminous amounts of data without “triggering alerts from SolarWinds’ data loss prevention software.” These threat actors then launched the SUNBURST attack by inserting malicious code into three different Orion software builds used by approximately 18,000 customers. As a result, the malicious code gave the threat actors a “backdoor” into the networks of SolarWinds’ customers who downloaded and installed the infected software.    The Judge dismissed all post-SUNBURST charges finding they “impermissibly rely on hindsight and speculation,” but is allowing the SEC to pursue pre-SUNBURST securities fraud claims against SolarWinds and Timothy Brown based upon the SolarWinds’ Security Statement published on its website beginning in 2017, which the SEC alleges were materially misleading regarding SolarWinds’ cybersecurity posture. While SolarWinds held itself out “as having sophisticated cybersecurity controls in place and heeding industry best practices,” the Court concluded that based upon the pleadings, “the company feel way short of even basic requirements of corporate cyber health.” The Court dismissed claims based upon press releases, blogs, and podcasts “because each qualifies as non-actionable corporate puffery.” Court also dismissed charges based upon SolarWinds’ cybersecurity risk disclosure finding it could not have misled a reasonable investor. The Court further dismissed the claims based upon post-SUNBURST disclosures. For instance, the Court found that SolarWinds’ Form 8-K disclosures were not misleading and captured the severity of the attack. The first Form 8-K was filed just two days after SolarWinds learned of the vulnerability in its product and the malicious code.   Lastly, the Court dismissed novel claims that SolarWinds’ also failed “to devise and maintain internal accounting controls” finding that these requirements do not apply to cybersecurity; they require that public companies devise and maintain a system of internal accounting controls that addresses financial accounting issues. The Court dismissed the disclosure controls and procedure claims as well.   There will be more to come on this. See attached opinion.

55

5 Comments

Join Director Lestin Kenton at The AI Strategy Summit: IP, Data and Compliance, hosted by CenterForce USA on May 22, 2024, in Palo Alto, CA. Lestin is a speaker on the "Navigating Intellectual Property Challenges in AI-Driven Innovations" panel. Register here: https://lnkd.in/e-tXxeT8 The panel will discuss: 1️⃣ AI as Inventor: Legal Implications and Future Directions 2️⃣ Ownership and Licensing Strategies for AI-Generated IP 3️⃣ Harmonizing Global IP Laws for AI Innovations Don't miss out on this insightful discussion! #AI #IntellectualProperty

9