The Utah Office of the Attorney General released updated guidelines on what businesses and consumers should expect when the state's Protection of Personal Information Act takes effect 31 Dec. The law requires businesses to implement data security practices to protect users' confidentiality, and consumers have the right to request what data is collected on them and to opt out of personal data collection used in advertising.Full story
The Future of Privacy Forum released a "Risk Framework for Body-Related Data in Immersive Technologies." The framework aims to help organizations develop responsible "immersive technologies" capable of extracting data about individuals' bodies and behaviors.
After three days of negotiations, EU institutions struck a political agreement on the Artificial Intelligence Act. The final trilogue negotiations had cast uncertainty an agreement would be reached as multiple member states sought foundation models to be excluded from the act. The IAPP's Jedidiah Bracy and Alex LaCasse report on the details of the agreement and share reaction from several stakeholders on the EU's next steps on AI.Full story
After a grueling trilogue process that featured two marathon negotiating sessions, the EU finally came to a political agreement 8 Dec. on what will be the world's first comprehensive regulation of artificial intelligence. Though the so-called trilogue process is a fairly opaque one, journalist Luca Bertuzzi has acted as a window into the process through his persistent reporting for Euractiv.
The European Data Protection Board will hold a plenary meeting 12 Dec. The agenda includes a discussion on Meta’s so-called "Pay or OK" model, which would require EU users to either pay for ad-free services or be subjected to targeted advertising, and an update from the European Commission on the status of EU-U.S. e-Evidence negotiations.Full story
The European Data Protection Board's urgent binding decision on Meta's targeted advertising practices only banned the company from processing data under the legal authority of contractual agreements, such as standard contractual clauses, the Business Post reports.
The U.S. Department of Health and Human Services called for hospitals to meet voluntary cybersecurity goals and to work with Congress to develop incentives for hospitals to improve their security in a new concept paper.
The U.S. Federal Communications Commission announced it signed memorandums of understanding with the state attorneys general of Connecticut, Illinois, New York and Pennsylvania to coordinate cybersecurity and privacy-related investigations. The agreements say the entities share common legal interest in investigating and sometimes prosecuting these crimes under sections 201 and 222 of the Communications Act.Full story
Poland's data protection authority, Urząd Ochrony Danych Osobowych, announced companies will be able to obtain EU General Data Protection Regulation compliance certifications. The UODO said the certifications will be optional, and aim to "increase transparency and improve compliance with personal data protection standards."Full story
Cambodia aims to create a law that would put data protections in place for all private entities that collect personal information, Nikkei Asia reports. But requirements to keep data stored in Cambodia has raised concerns from legal advocates, who say the clause would give the government a loophole to access that data.