Following the passage of the EU Artificial Intelligence Act by European Parliament 13 March, organizations will now be tasked with preparing for various compliance deadlines as regulators roll out the pending regulation's phased implementation. IAPP Staff Writer Lexie White reports on some of the first reactions from a range of stakeholders that will be affected by the incoming rules.Full story
The use of large language models is creating data privacy issues because they tend to disclose personal information they scrape from the internet without the consent of the data subject, Axios reports. Artificial intelligence data leaks come in many forms, such as an accidental disclosure or through malicious actions like building a model that circumvents privacy controls.
The California Privacy Protection Agency Board made a procedural step 8 March when it moved its draft automated decision-making technology and risk assessment rules forward. But the divided board has a long way to go before it can reach a consensus on how far the rules should reach compared to other states, IAPP Staff Writer Caitlin Andrews reports.Full story
The U.S. Department of Health and Human Services launched an investigation into a cyberattack on UnitedHealth Group that allegedly breached sensitive patient health information, Reuters reports.
Members of European Parliament adopted the Cyber Resilience Act 12 March. The act covers products like password managers, smart home assistants and other Internet-of-Things devices, which will be split into tiers based on information security risks. The act still needs to be adopted by the Council of the European Union to take effect.Full story
A law in Sweden surrounding the issuing of "media licenses" may create a potential loophole in the EU General Data Protection Regulation, CyberNews reports, citing a complaint from the Austrian privacy rights group NOYB. The group claims companies that obtain a media license can collect and sell individuals' personal information regardless of if they operate as a news organization.Full story
The Diffuse and Collective Interests Court of São Luís ordered Facebook and Zoom to collectively pay BRL20 million and BRL500 to each Brazilian Apple iOS user after it determined the companies collected and shared personal information without users' consent through an integration tool. The platforms will have to delete data and demonstrate how it is collected.Full story
The Court of Justice of the European Union ruled a member state's data protection authority is legally authorized to order the deletion of an individual's personal information without a formal complaint to the DPA from the data subject under the EU General Data Protection Regulation.
The Privacy Commissioner of Canada and the provincial data protection regulators in Alberta, British Columbia and Quebec issued a joint statement commending property rental platform Airbnb for banning indoor cameras from rentals. "Where people live or stay, including rental accommodations, are places where we expect a high level of privacy," regulators said.
The EU Artificial Intelligence Act was approved by European Parliament 13 March on a 523-46 vote. Despite the passage, the EU's new rules for AI development and use still have important steps to take before taking full effect. IAPP Staff Writer Caitlin Andrews reports on the detailed regulatory work ahead while exploring various reactions to Parliament's final vote.Full story