Bailey Sanchez

On April 17, Colorado Governor Jared Polis signed HB 1058 into law, which means it is time to update our chart comparing the various definitions of sensitive data in consumer data privacy laws. Here's some more context: 1️⃣ HB 1058 amends the Colorado Privacy Act to add biological data (and through it neural data) as a category of sensitive data in the Colorado Privacy Act. 2️⃣ The true impact of the amendment is debatable as the definition of biological data states that the data must be "used or intended to be used, singly or in combination with other personal data, for identification purposes." 3️⃣ Colorado is the first state to add biological/neural data to its state privacy law. This continues the trend over the last two legislative sessions of state lawmakers expanding the types of data covered as sensitive data. Given the constant expansion, at some point it may be easier to define what is not sensitive data rather than what is. 4️⃣ California is also considering a bill to add neural data to the CCPA's definition of sensitive personal information. 5️⃣ Colorado isn't done. The legislature is still considering two other bills to amend the Colorado Privacy Act, dealing with the treatment of biometric data and minor's data. 6️⃣ Here's a link to the Colorado bill for those interested: https://lnkd.in/gE7KPyY9

134

9 Comments

The United States Court of Appeals 5th Circuit just announced it will not adopt a proposed rule specifically requiring disclosure and other requirements for attorneys who use AI as part of their practice. Upon reflection, and based upon a lot of negative feedback on the proposed rule, they recognized that existing rules already cover the same situations. Specifically, attorneys are enforceably required to stand behind the truthfulness and accuracy of court filings. However, the court admonished litigants and lawyers alike that “I used AI” will not be an acceptable excuse for violating existing rules! Here is the formal notice from the court: https://lnkd.in/gJWyEyxg For color, here also are some recent news articles on this announcement: * Reuters: https://lnkd.in/gJmjWSqv * Bloomberg Law: https://lnkd.in/gaVqCkHi And, since I have it at hand, for your convenience, here is the full statement by the court: “The court, having considered the proposed rule, the accompanying comments, and the use of artificial intelligence in the legal practice, has decided not to adopt a special rule regarding the use of artificial intelligence in drafting briefs at this time. Parties and counsel are reminded of their duties regarding their filings before the court under Federal Rule of Appellate Procedure 6(b)(1)(B). Parties and counsel are responsible for ensuring that their filings with the court, including briefs, shall be carefully checked for truthfulness and accuracy as the rules already require. “I used AI” will not be an excuse for an otherwise sanctionable offense.” Personally, I think this court got it right. To the extent existing rules cover situations arising from use (or misuse) or AI, it is a good idea to apply those rules first before seeking to make more rules. In the event of demonstrable failures of existing rules, then perhaps it will be more practical to craft new rules to address the gaps that have been revealed. But it is, apparently, a very good idea to sound the alarm far and wide, loud and clear: sometimes generative AI provides incorrect or otherwise unsuitable information and it remains the duty of the attorney (among others) to carefully review and stand behind any work they pass forward. That concludes my public service announcement for today :-)

121

20 Comments

So glad that Marc is bringing attention to early U.S. leadership on privacy and data protection. This is the 50th anniversary year of Congress declaring that “the right to privacy is a personal and fundamental right,” and then proceeding to embody fair information practice principles (FIPPs) into federal law (well before other countries and the OECD followed suit). The Federal Privacy Act of 1974 stacks up well to this day against its descendants. If one wishes to confirm this observation, peruse 5 USC 552a. Note that the congressional declaration of privacy as a “fundamental right” was duly enacted into law, but was not codified in the operational provisions of 5 USC 552a. The full text of the Privacy Act, enacted as Public Law 93-579, is available here: https://lnkd.in/evjfHAZV. See section 2(a)(4) for Congress’ declaration of the fundamental right.

17

3 Comments

Alternative licensing is a logical step. Coupled with powerful AI systems, it will radically alter the playing field for many practices. https://lnkd.in/eG7bn-vc

2

1 Comment

"Practitioners have looked forward to iterations of the USPTO's subject matter eligibly guidance to add clarity and expedite prosecution. After a decade of such guidance, it is clear that the USPTO's example-based approach has failed. The chosen examples do not clarify the murky principles and distinctions that the words of the guidance set forth. Moreover, the USPTO's reasoning regarding these examples is contradictory, muddled, opaque, and ultimately not helpful. The greatest evidence for this is how different examiners apply the guidance in dramatically different ways. Again, the fault lies with the Federal Circuit's incoherent parade of patent eligibility horribles masquerading as judicial decisions. But instead of acknowledging that the emperor is stark raving naked, the USPTO once again tries to pretend otherwise." https://lnkd.in/ev2th7yg

7

In this week's The Trademark Lawyer newsletter 📢 USPTO issues guidance on use of AI tools by patent and trademark practitioners. The USPTO recognizes that practitioners are increasingly using AI tools to prepare and prosecute patent and trademark applications. Therefore, to “cabin the risks” arising from the use of AI, on April 11, 2024, the USPTO issued guidance on the use of AI tools. Read the full news article here 👉 https://lnkd.in/euTG6Znk Written by David McCombs, Partner, Jon Bowser, Partner, and Eugene Goryunov, Partner, Haynes and Boone, LLP Subscribe to our newsletter to stay up-to-date with all the most pertinent trademark stories and news here https://lnkd.in/d6ZGz7m Want to write for The Trademark Lawyer newsletter? Email ellen@ctclegalmedia.com #trademark #lawyer #news #USPTO #guidance #AI #AItools #IPpractitioners #prosecute #applications #risks #IPlaw

1

'Covered data' under the proposed American Privacy Rights Act: A cursory search of the American Privacy Rights Act discussion draft does not yield the term "personal data." IAPP Westin Research Fellows Andrew Folks, CIPP/E, CIPP/US, CIPM, and Luke Fischer explain how drafters "eschewed attaching the modifier 'personal' to the elemental definition of the data it covers," instead using a "covered data" terminology that "draws heavily from privacy and data protection regimes in the states and abroad." Full story #dataprotection #dataprivacy #privacy

2

When AI is trained with unlicensed copyrighted material, the question of infringement versus fair use remains unresolved. Many copyright holders assert that this use violates their rights, and are litigating to address the issue. In light of this, is it premature to require AI companies to disclose which copyrighted works are used to train their generative AI systems? #ai #trainingdata

2

👉Osano's article, What Makes Maryland's Consumer Data Privacy Law Different is one of the featured articles in the @JDSupra Corporate Law Report this week. Kudos to @Matt Davis for this overview of the unique aspects of Maryland's new law. If you do business in Maryland, you'll want to read it: https://pvcy.me/4btb1S1 #Maryland #DataPrivacy #PrivacyLaw

12

🚨 Read Tirzah Duren's latest in Free the People - Bad Antitrust Is a Barrier to Data Privacy. Read it here: https://lnkd.in/gmiXzRPD

2

Earlier today, Bloomberg Law published an insightful article, "Law Clerk vs. AI? Courthouse Test Highlights Judicial Curiosity," which delves into the growing interest in utilizing artificial intelligence within the judicial system. The article spotlights of Eleventh Circuit Judge Kevin Newsom's thought-provoking concurring opinion, where he proposes that large language models could potentially assist in determining the "ordinary meaning" of legal text. I had the opportunity to share my perspective on this topic with reporter Olivia Alafriz during her research for the article. As I conveyed, this technology can be particularly valuable as a tool for examining the common usage and understanding of words and phrases – arguably, a core function of these models. What I meant by my quote in the article is now that this technology is readily accessible, it's crucial to test both its potential benefits and limitations within the legal field, and to use it. While responsible implementation is paramount, I firmly believe that AI holds significant promise for legal professionals. Let's continue to explore how these tools can be leveraged effectively and ethically to support the legal process. You can read the full Bloomberg Law article here: https://lnkd.in/gRA7zBfR And this earlier blog post I wrote on Newsom's concurring opinion provides a bit more context: https://lnkd.in/giUeQrwX

54

6 Comments

📖 The Privacy Act of 1974 (1/n) 1974 was a remarkable year in US legislative history. Confronting the abuses of the Nixon Administration, Congress enacted a wide range of laws to promote government accountability, protect individual privacy, and strengthen democratic decision-making. For those who care about privacy and transparency, 1974 was likely the most consequential year in US history. I spent a great deal of time studying the Congress of 1974. Among the top achievements: ➡ Enacted the Privacy Act of 1974 (still the most comprehensive privacy law in US history) ➡ Strengthened the Freedom of Information Act (to promote government transparency and accountability) ➡ Established the Government in the Sunshine Act (to promote transparency of meetings and advisory committees) ➡ Strengthened the Administrative Procedures Act (to improve citizen participation in government) These laws set benchmarks for democratic decision-making and provide direction for effective legislation today. Regrettably, too many people today talk about the "US approach to privacy" with little appreciation for this history. The 1974 Congress was remarkable also because Congress began to confront the reality of computer technology and how it might impact the personal freedoms of Americans. The Department of Defense tracked war resisters with "automated databases" raising widespread privacy concerns. Private sector credit agencies compiled secret dossiers on Americans, impacting their opportunities for credit, housing, and employment. I plan on making several posts this year recalling the important history of the 1974 Congress. I begin with the introductory remarks of Senator Sam Ervin, a key leader in the '74 Congress, who led the Watergate hearings, and then the efforts to strengthen government accountability. On May 1, 1974, Senator Ervin rose in the Senate to say "I introduce a bill to establish a Federal Privacy Board, to oversee the gathering and disclosure of data of individuals, and to provide management systems in all Federal agencies, state, and local government, and other organizations." "Recent events have focused a great deal of attention . . , on one of our most fundamental civil liberties -- the right to privacy." "The Constitution creates a right of privacy which is designed to assure that the minds and hearts of American remain free. . . ." 🔥 1974: The United States proposes a Data Protection Agency, long before the GDPR, the EDPS, the EPDB, or the creation of almost every other Data Protection Agency in the world. Why? To protect freedom 🔥 Congress strengthened personal privacy and government transparency in the same year. No contradiction. No trade-offs. No "balancing." Democratic governments protect the privacy of the individual and ensure government transparency. Authoritarian governments do the opposite. More to follow. #privacy #gdpr #HistoryMatters Georgetown University Law Center John Shattuck Dr. Gabriela Zanfir-Fortuna Alan Raul

56

2 Comments

The Colorado Artificial Intelligence Act (CAIA) (SB 205) is a significant legislation establishing a regulatory framework for developing and using artificial intelligence technologies in Colorado. The Davis Wright Tremaine LLP team (David L. Rice, K.C. Halm, Jevan Hutson) did a wonderful breakdown: https://lnkd.in/gw-TsZZ6 As we prepare for the CAIA to effect in 2026, it's crucial to acknowledge the complexity and depth of this legislation, which requires careful consideration and understanding. 🔑 Here are some key takeaways that caught my attention (YMMV)🔑 Scope and Application: The CAIA applies to developers and deployers of high-risk AI systems intended to interact with Colorado residents. Reasonable Care Requirement: Developers and deployers must use reasonable care to protect consumers from the foreseeable risks of algorithmic discrimination. Compliance with specific CAIA provisions creates a rebuttable presumption of reasonable care. Douglas Brush's hot take: The duty of care and reasonableness in assessing future harm still need to be better understood within the cyber and privacy leadership. Colorado's Attorney General has exclusive authority to enforce the act, and no private right of action exists. ❗ However, if you spend your days, nights, and weekends reading case law and civil disputes, motions, and opinions*, you know that actions will proceed in state and federal courts referencing such acts. My job is to consider privacy and cybersecurity issues through the lens of litigation, so this will be one to watch as a tip of the spear for future litigations and to be copied by other states. (* If you do, please get better hobbies than me.) Disclosure Obligations: Developers must disclose details about high-risk AI systems, including foreseeable uses and risks, and make this information available to deployers and the Colorado Attorney General (AG) within 90 days upon request. Impact Assessments: Deployers must conduct annual impact assessments of high-risk AI systems, including after significant modifications. These assessments must document the system's impact and any risks of algorithmic discrimination. Risk Management Policies: Deployers must implement a comprehensive risk management policy that adheres to recognized standards such as the NIST AI Risk Management Framework. This policy must be reviewed and updated regularly throughout the AI system’s lifecycle. Exemptions and Exclusions: The CAIA excludes certain technologies from being classified as high-risk AI systems, such as anti-fraud technology and cybersecurity tools, unless they make consequential decisions. It also provides exemptions for self-testing purposes to identify and mitigate discrimination. #dataprivay #litigation #regulation #colorado #cybersecurity #legal #AI

4

2 Comments

The proposed American Privacy Rights Act, if passed, would mark a significant change in the enforcement of consumer data privacy laws in the U.S. Stephen Piepgrass, Natalia Jacobo and I published an article in Bloomberg News addressing how the proposed legislation may upset the contemporary regulatory enforcement regime currently spearheaded by State AGs and the powerful "Multistate" coalitions that have come about to address complex multi-jurisdictional issues involving rapid evolutions in technology and consumer privacy. Check out the article for an interesting perspective on the proposed federal legislation!

10

A small but important change in the new discussion draft of the American Privacy Rights Act: "sensitive covered data" now includes "neural data," but no definition of "neural data" is given. For such a novel policy issue, it's surprising that the term is left undefined. Looking at the two pieces of legislation that do provide definitions of "neural data"—Colorado's HB 1058 and California's SB 1223—model language for a definition emerges, though with one key difference between the two. Both 1058 and 1223 define neural data as "information that is generated by the measurement of the activity of an individual's central or peripheral nervous system that can be processed by or with the assistance of" a device/neurotechnology. However, 1058 only covers such data if it "is used or intended to be used...for identification purposes," whereas 1223 covers it more broadly. A definition tied to identification, in the context of APRA, would merely duplicate the definition of biometrics. A broader definition, on the other hand, would raise questions about what exactly it means to measure nervous system activity, and how expansive this ends up being.

22

Yesterday, Maryland became the 17th state to enact a comprehensive data privacy statute. With more than 40% of the U.S. population residing in those states, the patchwork of data privacy laws in the U.S. has created significant legal challenges for companies doing business nationwide. However, with Congress taking up the new American Privacy Rights Act (APRA), those challenges may soon abate. Drawing on data privacy and protection concepts from international regulations and state comprehensive data privacy laws, the APRA creates a unique law that attempts to address contemporary privacy concerns while simultaneously anticipating future technologies. But will it pass? --- Thanks to ALM and Law.com Pro for publishing Andria Adigwe and my thoughts. #dataprivacy #dataprivacylaw #cyberlaw Buchanan Ingersoll & Rooney PC Higginbotham AFCEA Central Maryland Chapter Chris Hughes IAPP - International Association of Privacy Professionals National Defense Industrial Association - (NDIA) Business Executives for National Security (BENS) Daniel Solove Benjamin Yelin April Falcon Doss Ahmed Eissa

63

1 Comment

In this week's edition of PTAB Highlights, Shawn M. Buchanan and John Peloquin summarize the recent decisions regarding disqualifying prior art for being inventor’s own work, public accessibility of software, interpretation of claimed ranges, and more! Read their full summaries by clicking here: https://bit.ly/4ao5goa #PTABLitigation #IPLitigation #IntellectualProperty

24

You’ve finalized your negotiations around boilerplate concepts like indemnification and limitation of liability, landing a great indemnification to cover third-party IP infringement claims (or maybe just settled for copyright?). Congrats! Don’t forget about today’s AI Gotcha No. 2 - The Indemnification Audit Gap Do you have a plan to produce audit trails that show a clear difference between synthetic out and human contribution? Does the vendor’s product have such functionality built into its systems? Let’s think this one through… you get sued by a third-party for some type of IP infringement that’s tied to a generative AI output you are using in some manner (commercially, right?). Now, you go back to your gen AI vendor that gave you an IP indemnification and they’ll step in now, right? Maybe not. How will you prove that the output from the AI system is the result of the system vs. additional contributions or modifications by a human (or other AI) at some point down the line? Oh, the vendor’s system doesn’t store prompts or outputs for longer than 90 days? It’s been 92 days since the content was generated? This is an extremely problematic issue when it comes to gen AI systems, many of which are designed without any thought given to tracking what content is the generative output of the system, especially if the output is combined with other human created or synthetic content. The solution? I often use this as a teaching moment by analogizing it to the use of open source software. Record-keeping is a core requirement for the use of OSS given the requirement to comply with the license term and attribution obligations (and any other obligations that are under the contract). It will take time, but proper record-keeping when it comes to the use of gen AI tools is going to be critical as we move forward, especially if there is an indemnity on the line. There are also third-party tools that are offering such services. Let me know if you have been using any that you like! —---- Join the fun! 😎I also welcome others to chime in with their own “gotchas” when it comes to licensing, contracting, negotiating, or policy-making around gen AI! The more the merrier 😀 Each day this week, I’m sharing one “gotcha” moment when it comes to legal issues and opportunities. I’m sourcing these from what I’ve learned over the last few years working in and writing about the generative AI space. Like, comment, and consider resharing this post so that you don’t miss each post this week! You can also click on my profile and “follow” me. #artificialinteligence #AI #generativeAI #genAI #GAI #tips #legal #copyright #techtransactions #audit #policy

37

12 Comments

The Joseph Saveri Law Firm is taking action to protect the rights of authors. Our firm has filed a lawsuit against Meta Platforms, Inc. alleging it infringed on book authors' copyrights by using their works to train its LLaMA large language models without consent. "As artificial intelligence continues to change every aspect of the modern world, we must recognize and protect the rights of artists such as these authors against unlawful theft and fraud," said firm founder Joseph Saveri. "LLaMA is not just an infringement of authors' rights; whether they aim to or not, these products will eliminate 'author' as a viable career path. This case represents a larger fight for preserving ownership rights for all artists and other creators." Learn more about the case: https://lnkd.in/eXDcQQ8K #AI #CopyrightInfringement #SaveriLawFirm #ArtistRights

1