IAPP Managing Director, Washington, D.C., Cobun Zweifel-Keegan, CIPP/US, CIPM, offers his take on the latest privacy and AI governance developments in the nation's capital and around the U.S. This week, he explores what privacy professionals need to bear in mind with the New York Health Information Privacy Act, which awaits enactment by the governor.Full story
Though it came close in recent years, federal privacy legislation is not likely top of mind as a new administration takes the reigns in Washington, D.C. The same likely goes for federal AI governance and safety legislation with a divided Congress and executive branch that promotes a deregulatory posture. That means state-level privacy and AI bills will proliferate in 2025. Connecticut was the fifth U.S. state to a pass comprehensive privacy law, and Connecticut state Sen. James Maroney, D-Conn., played a large role in crafting his state's bill and is now working on AI legislation.
Kevin Bankston worked in civil society for 18 years, litigating on a wide variety of issues like government surveillance, often "at loggerheads" with large technology companies over consumer privacy issues. But he also found alignments and went into the "belly of the corporate beast," spending four years as Meta's AI policy director. He's now using that experience to "further responsible AI development in the public interest" at the Center for Democracy and Technology's AI Governance Lab.
During U.S. Senate confirmation hearings, Director of National Intelligence nominee Tulsi Gabbard said officials should be required to obtain a warrant to collect data under Section 702 of the Foreign Intelligence Surveillance Act, Politico reports.
New Zealand's Office of the Privacy Commissioner published an update on the progress of the Privacy Amendment Bill. The guidance is geared toward organizations to begin proactive planning for new compliance measures. The OPC said a major proposed update in the legislation entails revamping the Information Privacy Principle.Full story
Italy's data protection authority, the Garante, issued an order limiting DeepSeek parent companies from processing Italian citizens' personal data. The order, which took effect immediately, came after submissions by Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence were "deemed completely insufficient" by the Garante. The companies claim they do not operate in Italy and are not subject to its data protection laws.
France's data protection authority, the Commission nationale de l'informatique et des libertés, published the final version of its guide to help organizations conduct data transfer impact assessments. The guidance spells out when an impact assessment should be conducted and what objective should be sought. Meanwhile, the CNIL opened a public consultation through 28 Feb.
Malta's Information and Data Protection Commissioner released an FAQ resource detailing organizations' obligations regarding data protection officers. The IDPC said organizations that are required by the EU General Data Protection Regulation to employ a DPO should provide the DPO with support and effective training to ensure the individual has the resources to protect sensitive data.Full story
U.S. Sens. Brian Schatz, D-Hawaii, Ted Cruz, R-Texas, Chris Murphy, D-Conn., and Katie Britt, R-Ala., introduced the Kids Off Social Media Act that would prevent individuals under 13 years old from creating social media accounts and restrict content recommendations for users under age 18, MediaPost reports.
The Netherlands' data protection authority, the Autoriteit Persoonsgegevens, issued guidance on what counts as AI literacy as the 2 Feb. deadline of the EU AI Act approaches.