After three days of negotiations, EU institutions struck a political agreement on the Artificial Intelligence Act. The final trilogue negotiations had cast uncertainty an agreement would be reached as multiple member states sought foundation models to be excluded from the act. The IAPP's Jedidiah Bracy and Alex LaCasse report on the details of the agreement and share reaction from several stakeholders on the EU's next steps on AI.Full story
After a grueling trilogue process that featured two marathon negotiating sessions, the EU finally came to a political agreement 8 Dec. on what will be the world's first comprehensive regulation of artificial intelligence. Though the so-called trilogue process is a fairly opaque one, journalist Luca Bertuzzi has acted as a window into the process through his persistent reporting for Euractiv.
The European Data Protection Board will hold a plenary meeting 12 Dec. The agenda includes a discussion on Meta’s so-called "Pay or OK" model, which would require EU users to either pay for ad-free services or be subjected to targeted advertising, and an update from the European Commission on the status of EU-U.S. e-Evidence negotiations.Full story
The European Data Protection Board's urgent binding decision on Meta's targeted advertising practices only banned the company from processing data under the legal authority of contractual agreements, such as standard contractual clauses, the Business Post reports.
The U.S. Department of Health and Human Services called for hospitals to meet voluntary cybersecurity goals and to work with Congress to develop incentives for hospitals to improve their security in a new concept paper.
The U.S. Federal Communications Commission announced it signed memorandums of understanding with the state attorneys general of Connecticut, Illinois, New York and Pennsylvania to coordinate cybersecurity and privacy-related investigations. The agreements say the entities share common legal interest in investigating and sometimes prosecuting these crimes under sections 201 and 222 of the Communications Act.Full story
Poland's data protection authority, Urząd Ochrony Danych Osobowych, announced companies will be able to obtain EU General Data Protection Regulation compliance certifications. The UODO said the certifications will be optional, and aim to "increase transparency and improve compliance with personal data protection standards."Full story
Cambodia aims to create a law that would put data protections in place for all private entities that collect personal information, Nikkei Asia reports. But requirements to keep data stored in Cambodia has raised concerns from legal advocates, who say the clause would give the government a loophole to access that data.
The American Advertising Federation announced it joined the "Responsible Privacy in Advertising Initiative." The strategy, rolled out by the Association of National Advertisers and the American Association of Advertising Agencies, aims to develop "guidance and tools to drive compliance with data privacy laws and industry standards."Full story
The FBI published guidance for companies on the process to request a delay on required cybersecurity incident disclosures to the U.S. Securities and Exchange Commission. The guidance indicates cases where a cyberattack is a threat to national security or public safety, companies may be able to delay disclosure of the incident for up to 30 days. Full story