South Korea's National Assembly passed the Basic Act on the Development of Artificial Intelligence and the Establishment of Trust in the concluding days of 2024, CCN reports. The law combines 19 AI-centric proposals from lawmakers into a single framework that places restrictions on high-risk AI models, similar to the EU AI Act. The AI Basic Act includes financial penalties for violations of up to KRW30 million.Full story
Comprehensive privacy laws in four U.S. states took effect 1 Jan. Laws in Delaware, Iowa, Nebraska and New Hampshire are now enforceable while New Jersey's comprehensive statute takes force 15 Jan.
The U.S. Department of Health and Human Services' Office for Civil Rights issued a notice of proposed rulemaking to update information security requirements under the Health Insurance Portability and Accountability Act's Security Rule. IAPP Cybersecurity Law Center Managing Director Jim Dempsey analyzes the proposed rulemaking and its potential path to finalization as OCR changes leadership under the incoming Trump administration.Full story
Inter-ministerial consultations of the draft rules for India's Digital Personal Data Protection Act concluded 31 Dec. 2024, the Financial Express reports. The Ministry of Electronics and Information Technology will soon release the draft rules for public consultation, which will eventually enter into force in a phased manner.
The U.S. Department of Justice issued the final rule implementing the Biden administration's executive order preventing the access and transfer of citizens' sensitive personal data to adversarial countries. According to a DOJ fact sheet, the final rule identifies certain classes of prohibited, restricted and exempted data transfers, as well as identifying the persons covered under the rule.
Italy's data protection authority, the Garante, fined OpenAI 15 million euros over alleged EU General Data Protection Regulation violations. The Garante claimed the company did not adequately identify a legal basis for processing personal data toward the development and deployment of its AI products.
Bavaria's State Office for Data Protection Supervision ordered biometric and blockchain company Worldcoin to establish additional EU General Data Protection Regulation compliance measures before resuming EU operations. After a formal investigation, the BayLDA will require Worldcoin to generate a data deletion process and a consent mechanism for certain data processing within 30 days of the order taking effect.
The U.S. Equal Employment Opportunity Commission published a fact sheet discussing potential violations of employment discrimination laws stemming from required use of wearable technology and subsequent biometric data collection, Reuters reports. EEOC Chair Charlotte Burrows said organizations "must be vigilant in following the law to ensure that they do not create a new form of discrimination.
The U.S. Federal Trade Commission finalized its order against Marriott International and Starwood Hotels and Resorts to implement an information security program following data breaches involving more than 344 million customers.
The U.K. Information Commissioner's Office is seeking feedback on updated guidelines for storage and access technologies. The updated guidelines cover the lawful use of user tracking practices, including third-party cookies, pixel tracking and device fingerprinting.