The U.S. Federal Trade Commission extended its deadline to consider the Entertainment Software Rating Board's application to use "Privacy-Protective Facial Age Estimation" technology. The commission extended its original 2 Oct. deadline by 120 days after receiving more than 350 comments.
Kenya's Office of the Data Privacy Commissioner announced three penalties totaling KES9,375,000 for alleged violations of the Data Protection Act. Each penalty concerns claims of nonconsensual uses of personal data. The largest fine was KES4,550,000 to Roma School for posting pictures of minors without parental consent.Full story
Hong Kong's Office of the Privacy Commissioner for Personal Data published data security recommendations following a string of hacks and subsequent personal data leaks. The PCPD reminded organizations to "regularly conduct data security risk assessments, and put in place adequate and effective security measures" while providing seven recommended measures that can be adopted to achieve security goals.Full story
The Record reports the National Student Clearinghouse indicated 890 U.S. higher education institutions had data stolen as part of the MOVEit ransomware hack. Schools from nearly every U.S. state were affected as the attack breached troves of personally identifiable information. Universities nationwide are required by the U.S.
Denmark's data protection authority, Datatilsynet, published the details of an enforcement sweep covering the data breach handling of municipalities and banks. The regulator carried out 16 inspections and sought to ensure EU General Data Protection Regulation rules for data breach reporting was being followed.
WAND TV reports the Illinois Supreme Court will determine whether health care providers can invoke a Health Insurance Portability and Accountability Act exemption to collect employee's biometric information. Two nurses from Chicago-area hospitals claimed violations of the Illinois Biometric Information Privacy Act related to nonconsensual collection and retention of fingerprints.
The U.S. Securities and Exchange Commission approved amendments to its Privacy Act regulations. The regulator said the final rule "clarifies, updates, and streamlines" regulations while allowing for "electronic methods to verify one's identity and submit Privacy Act requests." The SEC regulations were last updated in 2011.Full story
European Parliament's Artificial Intelligence Act co-rapporteur Brando Benifei urged the European Commission to compromise on certain areas in hopes of a final agreement before the end of the year, Reuters reports. The most contentious issues remaining are AI-powered biometric surveillance and the use of copyrighted material by generative AI. Members of European Parliament are seeking an outright ban on biometric surveillance, while France and other member states are pushing for national security exemptions.
Major provisions of Quebec's Law 25 entered into force 22 Sept. The legislation contained within the omnibus Bill 64 passed in 2021 aims to improve personal data protection standards and modernize the Private Sector Act.
Artificial intelligence systems, much like any other technology system, are susceptible to failure. Luminos.Law Partner Brenda Leong, CIPP/US, and Responsible AI Collaborative AI Incident Database Editor Daniel Atherton explain how preparation for potential failure across the design, development, sale and operation phases of a given system "can make all the difference between a timely, controlled response and chaos." Full story