Lori Fena

On August 31, the California legislature closed for the 2024 session. Here's what happened with the privacy and AI-related bills we've been tracking: Five of the six privacy-related bills passed the legislature: 1️⃣ Opt-Out Preference Signals (AB 3048) – Among other provisions, the bill prohibits a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts. 2️⃣ Kid's Privacy (AB 1949) – Amends the CCPA to provide that a business cannot collect, sell, or share the personal information of a child ages 13 to 17 without the child’s consent or, for children below 13, without a parent or guardian’s consent. 3️⃣ Neural Data / Personal Information & AI systems (SB 1223 & AB 1008) – Amend the CCPA to add neural data as an element of sensitive PI. Also amend the CCPA’s definition of PI to specify that PI can exist in various formats, including “artificial intelligence systems that are capable of outputting personal information.” 4️⃣ Recognition of Prior Opt-Outs in M&A Deals / Kid's Privacy (AB 1824) – Amends the CCPA to require acquiring businesses to honor prior opt-out requests. The bill also contains the kid’s privacy provisions in AB 1949. Four of the seven AI-related bills passed the legislature: 1️⃣ Safe and Secure Innovation for Frontier Artificial Intelligence Act (SB 1047) – The bill regulates the largest artificial intelligence models. It has been the subject of extensive controversy and is a potential candidate for a governor’s veto. 2️⃣ Generative AI Training Data Transparency (AB 2013) - Provides that developers of generative artificial intelligence systems or services must, prior to making their systems or services publicly available to Californians, post on their website documentation regarding the data used to train the system or service. 3️⃣ Definition of AI (AB 2885) - Amends California law to define artificial intelligence as “an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.” 4️⃣ California AI Transparency Act (SB 942) – Creates transparency obligations for persons that create, code, or otherwise produce generative artificial intelligence systems that have over one million monthly visitors or users and are publicly accessible within California’s geographic boundaries. 5️⃣ The three AI-related bills that did not pass the legislature were AB 2930 (algorithmic discrimination), AB 3211 (provenance, authenticity and watermarking standards), and AB 1791 (digital content provenance for social media platforms). All of the passed bills now head to the governor for consideration. Article co-authored by Owen Davis and Fred Sager.

164

3 Comments

On April 17, Colorado Governor Jared Polis signed HB 1058 into law, which means it is time to update our chart comparing the various definitions of sensitive data in consumer data privacy laws. Here's some more context: 1️⃣ HB 1058 amends the Colorado Privacy Act to add biological data (and through it neural data) as a category of sensitive data in the Colorado Privacy Act. 2️⃣ The true impact of the amendment is debatable as the definition of biological data states that the data must be "used or intended to be used, singly or in combination with other personal data, for identification purposes." 3️⃣ Colorado is the first state to add biological/neural data to its state privacy law. This continues the trend over the last two legislative sessions of state lawmakers expanding the types of data covered as sensitive data. Given the constant expansion, at some point it may be easier to define what is not sensitive data rather than what is. 4️⃣ California is also considering a bill to add neural data to the CCPA's definition of sensitive personal information. 5️⃣ Colorado isn't done. The legislature is still considering two other bills to amend the Colorado Privacy Act, dealing with the treatment of biometric data and minor's data. 6️⃣ Here's a link to the Colorado bill for those interested: https://lnkd.in/gE7KPyY9

134

9 Comments

🎧 New AR for Enterprise Alliance Podcast! 🎧 "Top AR Trends for 2024: Privacy" Christine Perey, AREA Founder, chats with Jameson Spivack, Senior Policy Analyst at the Future of Privacy Forum about the privacy challenges in enterprise AR. AI and computer vision advancements could address concerns over privacy in data collection and handling. Privacy and sensitivity to security risks from the use of cameras and other sensors in the workplace continue to be obstacles to large-scale AR deployments. Privacy is the #4 trend in Christine's Top 12 blog: "Top 2024 Enterprise AR Trends to Watch." In this clip, Jameson talks about the business and technology tradeoffs that sometimes need to be considered when privatizing data. Listen now and subscribe to our podcast channel: https://bit.ly/4dn5Uox #AR #AugmentedReality #AI #ArtificialIntelligence #Privacy #InternetOfThings #IoT #Cybersecurity #AREnterprise Mark Sage

3

Colorado leads the way in protecting neural data privacy with new legislation signed by Gov. Jared Polis. The bill expands the Colorado Privacy Act and sets a precedent for other states. Read more from Constangy Cyber Team member Amanda Novak in the link below. #coloradoprivacyact #cpa #dataprivacy #cybersecurity

2

The brain is the new privacy frontier: Responding to developing technologies in the neurotech space, a number of American states have amended their privacy laws to include "neural data" in their definition of sensitive personal information. Some require opt-in consent for its collection, others simply the possibility for a data subject to opt out. Some have included employees' neural data in the definition, others not - with varying implications for privacy protection:

7