The use of large language models is creating data privacy issues because they tend to disclose personal information they scrape from the internet without the consent of the data subject, Axios reports. Artificial intelligence data leaks come in many forms, such as an accidental disclosure or through malicious actions like building a model that circumvents privacy controls.
The California Privacy Protection Agency Board made a procedural step 8 March when it moved its draft automated decision-making technology and risk assessment rules forward. But the divided board has a long way to go before it can reach a consensus on how far the rules should reach compared to other states, IAPP Staff Writer Caitlin Andrews reports.Full story
The U.S. Department of Health and Human Services launched an investigation into a cyberattack on UnitedHealth Group that allegedly breached sensitive patient health information, Reuters reports.
Members of European Parliament adopted the Cyber Resilience Act 12 March. The act covers products like password managers, smart home assistants and other Internet-of-Things devices, which will be split into tiers based on information security risks. The act still needs to be adopted by the Council of the European Union to take effect.Full story
A law in Sweden surrounding the issuing of "media licenses" may create a potential loophole in the EU General Data Protection Regulation, CyberNews reports, citing a complaint from the Austrian privacy rights group NOYB. The group claims companies that obtain a media license can collect and sell individuals' personal information regardless of if they operate as a news organization.Full story
The Diffuse and Collective Interests Court of São Luís ordered Facebook and Zoom to collectively pay BRL20 million and BRL500 to each Brazilian Apple iOS user after it determined the companies collected and shared personal information without users' consent through an integration tool. The platforms will have to delete data and demonstrate how it is collected.Full story
The Court of Justice of the European Union ruled a member state's data protection authority is legally authorized to order the deletion of an individual's personal information without a formal complaint to the DPA from the data subject under the EU General Data Protection Regulation.
The Privacy Commissioner of Canada and the provincial data protection regulators in Alberta, British Columbia and Quebec issued a joint statement commending property rental platform Airbnb for banning indoor cameras from rentals. "Where people live or stay, including rental accommodations, are places where we expect a high level of privacy," regulators said.
The EU Artificial Intelligence Act was approved by European Parliament 13 March on a 523-46 vote. Despite the passage, the EU's new rules for AI development and use still have important steps to take before taking full effect. IAPP Staff Writer Caitlin Andrews reports on the detailed regulatory work ahead while exploring various reactions to Parliament's final vote.Full story
Following the European Parliament's vote to approve the EU Artificial Intelligence Act, the IAPP will host a 19 March LinkedIn Live focused on the governance practices companies deploying AI need to know in the wake of the pending regulation. Additionally, a 15 March LinkedIn Live with European Parliament AI Act co-rapporteur Dragoş Tudorache will further explore EU's landmark rules and next steps toward implementation.