The U.S. National Institute of Standards and Technology released guidance for building and maintaining a cybersecurity and privacy learning program throughout federal agencies. The recommendations say programs should encourage behavior changes to minimize risk and create a culture around security.Full story
Italy's data protection authority, the Garante, announced it fined electric company Hera Comm 5 million euros after the company allegedly violated personal data processing standards. Hera Comm's door-to-door employees allegedly misused more than 2,300 customers' personal data by activating contracts without consumers' consent and maintaining outdated consumer data without enlisting data retention policies.Full story
Large language model use among individuals is only growing. Do those inputs and outputs constitute data controllership? Morrison & Foerster Senior of Counsel Lokke Moerel and Data Protection and Privacy Lawyer Marijn Storm explain how such an interpretation could be a violation of the EU General Data Protection Regulation's fairness principle. Full story
The EU AI Act will be important and consequential to the governance of AI in the EU and worldwide. Covered entities must begin to understand the potential impacts of the act as provisions are phased in and implemented over the coming months.
IAPP Managing Director, Washington, D.C., Cobun Zweifel-Keegan, CIPP/US, CIPM, offers his take on the latest privacy and AI governance developments in the nation's capital and around the U.S. This week, he explores the Maryland Online Data Privacy Act and its virtual total ban on the sale of sensitive personal data.Full story
IAPP Managing Director, Europe, Isabelle Roccia, CIPP/E, breaks down the likely upcoming priorities for the second term of EU Commission President Ursula von der Leyen.
The Netherlands Authority for Consumers and Markets issued guidance for complying with the EU Digital Services Act and plans to hold a meeting on the regulation 21 Nov. The document explains who is covered by the DSA and how to follow the rules.Full story
The U.S. District Court for the District of Utah issued a preliminary injunction against the Utah Minor Protection in Social Media Act that would have required social media companies to verify the ages of their users and take additional precautions to ensure their privacy, The Associated Press reports. The injunction was sought by NetChoice, which is looking to block the law from entering into force 1 Oct. Full story
The Office of the Australian Information Commissioner announced the completion of an investigation into the data breach sustained by medical software company MediSecure. The OAIC opted not to administer any penalties "at this stage," per a statement, adding "the possible remedies that we could obtain for the community will not be proportionate to the resources required for a comprehensive investigation."Full story
The U.S. Office of Business and Management is expected to release guidance for government agencies on acquiring AI technology and how agencies can mitigate risks with those acquisitions, FedScoop reports. The guidance is expected by 24 Sept. and will align with the OMB's previous guidance on the federal use of AI systems.