The Office of the Australian Information Commissioner released a report on data breaches, noting that personal information collected by multiple parties can increase the chance of a data breach. From July to December 2023, the OAIC received 483 data breach reports with health and finance organizations targeted the most.Full story
The California Chamber of Commerce petitioned the state Supreme Court to review an appellate court decision to allow the California Privacy Protection Agency to begin enforcing California Privacy Rights Act regulations. CalChamber argued the CPPA failed to develop final regulations as required under the ballot measure approving the CPRA, and therefore cannot begin enforcement until the completion of a year-long grace period for businesses to comply with the law.
A study published by University of Grenoble Alpes professor of law Théodore Christakis found the "zero-risk" theory commonly held by EU data protection authorities after the "Schrems II" decision is "overly restrictive, is not mandated by the (EU General Data Protection Authority) and could have a number of adverse effects." Christakis said the "notion that data controllers can take measures to entirely 'eliminate' any risk of unauthorized access to European personal data by foreign governments is grounded on questionable assumptions."
The European Commission will soon launch the European AI Office. The office's objectives will be to support the development and use of safe artificial intelligence and assist with the implementation of the AI Act. Additionally, the office will enforce general purpose AI rules and foster international cooperation for AI governance.
In a post for Lawfare, Atlantic Council Senior Fellow Kenneth Propp broke down how the U.S. government's amended approach to digital trade protections and policy could affect the international data transfer landscape. Propp explored the factors driving the policy changes and how the U.S. might be aligning with the EU's positions on digital trade.Full story
The Nigeria Data Protection Commission issued guidance for the registration requirements for data controllers and processors with "particular value or significance to the economy, society or security of Nigeria" under the Data Protection Act. The requirements apply to any controller or processor handling the personal data of more than 200 data subjects every six months or processing personal data in key sectors, including financial, health care, education and energy.
U.S. Federal Trade Commissioner Alvaro Bedoya spoke with Tech Policy Press about how the agency is thinking about artificial intelligence in its wider regulatory purview. He spoke about voice cloning, algorithmic fairness and what the future holds for AI.Full story
The South Korea Personal Information Protection Committee released a guide on how to properly provide pseudonymous information for public institutions.Full story
The Organisation for Economic Co-operation and Development launched a group focused on finding common ground between artificial intelligence, data and privacy policies. The group hopes to use its platform to bring together data governance and AI communities.Full story
Spain's data protection authority, the Agencia Española de Protección de Datos, published its Action Plan on Social Responsibility for 2024. The plan's objective is to "promote innovation and entrepreneurship when creating products and services compatible with people's rights," including gender equality and the protection of minors online. Full story