Arsen Kourinian

Colorado leads the way in protecting neural data privacy with new legislation signed by Gov. Jared Polis. The bill expands the Colorado Privacy Act and sets a precedent for other states. Read more from Constangy Cyber Team member Amanda Novak in the link below. #coloradoprivacyact #cpa #dataprivacy #cybersecurity

2

The Privacy-Preserving Data Sharing in Practice (PDaSP) program is accepting proposals from qualified researchers and multidisciplinary teams in the following tracks. Track 1: Advancing key technologies to enable practical PPDSA solutions: Projects are expected to be in the $500K - $1 million range for up to two years.  Track 2: Integrated and comprehensive solutions for trustworthy data sharing in application settings: Projects are expected to be in the $1 million - $1.5 million range for up to three years.  Track 3: Usable tools and testbeds for trustworthy sharing of private or otherwise confidential data: Projects are expected to be in the $500K - $1.5 million range for up to three years. Visit the site to register for upcoming informational webinars on either July 12 or July 23. PDaSP is led by the National Science Foundation (NSF) Directorate for Technology, Innovation and Partnerships in collaboration with the NSF Directorate for Computer and Information Science and Engineering, as well as Intel Corporation and VMware, as industry partners, and the Federal Highway Administration and U.S. Department of Commerce National Institute of Standards and Technology (NIST) as federal agency partners. #OpenData #Privacy #PETs #DemocratizingOurData https://lnkd.in/e_XiDb8U

25

State Data Privacy Laws: To date, 17 states have adopted comprehensive data privacy laws – most recently Maryland. And Vermont’s legislature just passed a data privacy law that would become one of the strongest data privacy laws in the country if signed into law by the Vermont Governor. It contains a private right of action for violating an individual’s privacy rights. To date, most states have not adopted a private right of action because of concerns it would open up the floodgates to litigation and bankrupt businesses. This is similar to the Illinois Biometric Information Privacy Act (BIPA) and class actions brought under this statute have exploded over the last several years. In 2023, hundreds of BIPA cases were filed in both federal and state court because of the potential for extremely large class action settlements and verdicts. Indeed, in 2020, Google settled a BIPA case for $650 million and the first BIPA case to go to trial resulted in a jury verdict of $228 million for truck drivers in 2023. That case recently settled for $75 million. New York City has also enacted a biometric law that allows for a private right of action. Even the California Consumer Privacy Act, believed to be the strongest comprehensive data privacy law, only provides a private right of action for data breaches. The United States has taken a patchwork approach to data privacy with the potential of each state creating a different set of rules similar to the 50 different data breach laws that currently exist. This has resulted from the lack of one comprehensive federal law that governs privacy and preempts state law. The costs of America’s patchwork approach of different and sometimes conflicting state privacy laws will only continue to rise. Numerous studies have estimated that the potential financial impact of complying with 50 different state laws could surpass $1 trillion over a decade and small business will likely shoulder a minimum of $200 million. A federal data privacy law such as American Privacy Rights Act would cost significantly less for businesses and bring needed consistency across all states. Additionally, the U.S. Federal Trade Commission is increasingly investigating data privacy practices and imposing civil penalties against organizations for failing to take reasonable steps to protect personal information. Section 5 of the Federal Trade Commission (FTC) Act prohibits unfair or deceptive acts or practices, including unfair practices involving the collection, use, disclosure, processing, and protection of consumers’ personal information. In those cases, the FTC has taken the position that inadequate data security practices may constitute unfair and deceptive practices under the FTC Act. Compliance with privacy and cybersecurity laws and regulations have become a priority for state and federal regulators so organizations should closely follow the developments in these areas.  #data #privacy #cybersecurity

53

1 Comment

In 1974, the introduction of the Fair Information Practice Principles marked a pivotal moment in data privacy. Today, 50 years later, we stand on the brink of a significant legislative evolution with the proposed American Privacy Records Act (APRA). This new proposal aims to unify privacy standards across the U.S., enhancing consumer trust and simplifying compliance in our digital age. It's not just about adapting to technology but about fortifying the trust between consumers and businesses. The APRA not only aims to address modern privacy challenges but also to uphold the core values established by the FIPPs. As we navigate these changes, it's crucial for privacy professionals and stakeholders to engage in this dialogue and consider the broader impact on our society. 👉 Read more about the transition from FIPPs to APRA and what it means for the future of privacy in our latest blog post: https://lnkd.in/eTAbCqyT #DataPrivacy #APRA #DigitalAdvertising #PrivacyLaw #TechPolicy #Innovation #PrivacyMatters #Privacy #DataPrivacy #PrivacySecurityREIMAGINED

2

The American Privacy Rights Act promises a "positive path" toward creating a single national data privacy framework. Cathy Mulrow-Peattie reviews the significance of this bipartisan legislative proposal in Law360: https://lnkd.in/g9jwHHHu #DataPrivacy #ConsumerPrivacy #PrivacyLaw #DataProtection

10

1 Comment

A Bluffers Guide to EdDSA and ECDSA - Ed25519 was proposed in 2011 by Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang, while ECDSA was proposed around 2001 by Don Johnson, Alfred Menezes, and Scott Vanstone. - ECDSA uses the secp256k1 curve, and EdDSA uses Curve 25519. - Bitcoin and Ethereum use ECDSA, while IOTA uses EdDSA. - EdDSA uses the Schnorr signature method, and which is now out of patent. It supports the aggregation of keys in the signature, and also the aggregation of the signature for multiple parties. - For improved security, ECDSA supports a 521-bit curve (P521), while EdDSA supports X448. - ECDSA has a random nonce value created within the signature creation, whereas EdDSA does not. In ECDSA, we need to be careful in making sure that we do not reuse this nonce value, and that it is random. - ECDSA signatures change each time based on the nonce used, whereas EdDSA signatures do not change for the same set of keys and the same message. - ECDSA is often used to keep compatibility with Bitcoin and Ethereum. - ECDSA public keys are (x,y) coordinates and thus have 512 bits (for secp256k1), while Ed25519 uses just the y co-ordinate value for the point, and thus has 256 bits. - ECDSA and EdDSA typically have equivalent performance and security levels. - EdDSA is a deterministic signature (meaning that we always get the same signature for the same private key and message), whereas ECDSA is non-deterministic. T- he security of EdDSA and ECDSA are on a par with 128-bit AES and 3K RSA. - EdDSA is fairly immune from side-channel attacks. https://lnkd.in/eM6Dc67N

46

2 Comments

Upon reviewing the informal text of the AI Act, certain aspects like differentiating between General Purpose AI and AI systems posed challenges. Additionally, it appears that some sections were hastily written, as seen in § 2(12) where the text states "This Regulation applies to AI systems released under free and open source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50." when it should likely have been "does not apply to." While aware of the ongoing corrigendum process, concerns arise regarding the rushed decision-making process highlighted by Kai Zenner's remarks in an interview where they had 20 minutes to choose betwen 4-5 different GPAI regulatory options. This rushed approach may not be conducive to the effective shaping of laws.

3

The U.S. Justice Department and the Federal Trade Commission (FTC) recently filed a civil enforcement action against Adobe Inc. and two of its executives for alleged violations of the Restore Online Shoppers’ Confidence Act (ROSCA). The lawsuit alleges that Adobe imposed a hidden “Early Termination Fee” on millions of online subscribers and made cancelling subscriptions a complex and challenging process. According to the complaint, Adobe allegedly hid important information about subscription plans using fine print and inconspicuous hyperlinks, including a significant Early Termination Fee that customers may be charged when cancelling their subscriptions. The complaint also alleges that Adobe made it difficult for consumers to cancel, subjecting them to a convoluted and inefficient process. The lawsuit seeks unspecified amounts of consumer redress and monetary civil penalties from the defendants, as well as a permanent injunction to prohibit them from future violations. The Justice Department and FTC are committed to stopping companies from preying on consumers who sign up for online subscriptions by hiding key terms and making cancellation an obstacle course. It's not just Adobe; many companies make it difficult for consumers to cancel their subscriptions, often burying important information in the fine print. #consumerprotectionlaws  #ROSCAenforcement

21

The Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1 et. seq., is one of the most hotly litigated privacy statutes in the country. As it stands, there is no clear appellate authority on BIPA’s reach in at least one critical aspect. Namely, whether BIPA applies to data that cannot identify a person. This article from Purvi G. Patel & Liz Hutchinson (Morrison Foerster) explores this gap in the law and how its outcome is contrary to the plain language of the statute and makes little legal or policy sense... #techREG #biometrics #privacy #identity #personaldata

5

Check out these insights! Thanks, James E. Lee, for your suggestion.

3

We're thrilled to share insights on the emerging NIST Generative AI Risk Profile, brought to you by our colleague, Patrick Hall — an esteemed AI authority. Collaborating with Patrick and other leading experts, we provide unparalleled support to diverse industries in mastering model risk management for generative AI technologies. A common challenge our clients articulate is the novelty and magnitude of risks associated with generative AI. They're eager to leverage these advancements but often grapple with understanding and mitigating the inherent risks. Ensuring customer safety and regulatory compliance remains a paramount concern. The evolving NIST guidance under the AI RMF framework is set to offer crucial benchmarks for safely capitalizing on generative AI's potential. Our role is to guide you through these regulatory challenges while maximizing business outcomes. Our team at SolasAI, BLDS LLC, and Global Economics Group possess over 45 years of expertise applying statistics (now known as "data science") to legal and regulatory compliance issues, as well having significant experience in business optimization (i.e., making algorithms work). We also have a specialized focus on the fair and equitable use of algorithms. In our work, we have developed MRM programs for major players in Financial Services and Health Insurance, conducted LLM audits, testified before the Senate on fairness standards, and are at the forefront of setting benchmarks that regulators will rely on as technology progresses. Interested in how we can help your organization navigate these challenges, seize opportunities, and develop a robust risk management program? Please contact message me or one of my colleagues, Susan Bridge, Steven D., or Darrin Williams. We look forward to working with you! #genAI #mrm #fairai

46

With Congress' proposal of the American Privacy Rights Act (APRA), Senior Legal Analyst Tony Foley discusses the impact of the federal legislation in his recent piece. Foley explains that the single, national bill would preempt state privacy laws and involve data minimization, FTC enforcement, consumer data rights and more. To read the full piece, visit: https://bit.ly/4b0SzAE #privacylaw #cybersecurity

6

Minnesota's state privacy legislation has been sent to Governor Tim Walz's desk to be signed into law. The Minnesota Consumer Data Privacy Act, once enacted, will add to the growing list of state privacy laws in the US. This year alone, five state laws have been enacted, bringing the total to 18.   Use our US State Privacy Law tracker as a reliable and easy resource while planning your compliance strategies. https://lnkd.in/dFHU2yhk #Privacy #DataPrivacy #PrivacyRisk #Compliance #InformationGovernance #InfoGov #InfoSec #LegalTech #PrivacyRegulation #DataProtection #RecordsManagement #PrivacyTech #Automation #PrivacyByDesign #ThirdPartyRisk #ThirdPartyRiskManagement #RiskManagement #MODPA #NJDPA #CCPA #CPRA #VCDPA #CPA #CTDPA #UCPA #TDPSA #OCPA #FDBR #MCDPA #DPDPA #ICDPA #SB255 #NDPA #NJDPA #TIPA #KCDPA #INCDPA #GDPR 

2

What does the American Privacy Rights Act mean for AI Governance? ▪Congress introduced the American Privacy Rights Act (APRA) by Senator Maria Cantwell and Representative Cathy McMorris Rodgers, targeting the establishment of comprehensive federal privacy laws that will have huge implications for AI governance. ▪APRA mandates stringent oversight on AI, requiring "large data holders" to perform annual impact assessments on algorithms that could harm specific demographics, and necessitates preemptive risk mitigation in algorithm design. ▪The legislation empowers individuals to opt out of AI-driven decisions affecting life aspects, such as healthcare and employment opportunities, and establishes robust enforcement mechanisms via the Federal Trade Commission and state attorneys general, with provisions for personal lawsuits. ▪APRA faces resistance due to its preemption of state laws, which may undermine localized privacy protections like those in California, presenting a significant challenge in balancing national AI regulation with existing state laws. We discuss this in our latest Trustible newsletter plus: 🇯🇵 The Rise of Non-English LLMs 🔄 AI-Ception – When models are trained on AI content 📈 Why AI Governance is going to get a lot harder 🤖 Stanford HAI Summarizes the World of AI Read more here 👉 https://lnkd.in/evSvmfhP

1

As an advocate and developer of responsible AI in legal, I can personally attest that there aren't enough hours in the day to stay on top of everything! That's why I love this new resource from the EDRM - Electronic Discovery Reference Model. Check out the article below, share it, and make use of their new resource: 'a repository of judicial orders concerning the use of artificial intelligence in the legal realm.' You can find it at https://lnkd.in/gqNZPEbT. I know I will! Thanks Kaylee Walstad, Rob Robinson, Mary Mack, CISSP and all who are helping with this effort. This is very important work! #litsupport #legaltech #ediscovery #ArtificialIntelligence #AIinLegal BlueStar Scott Collister Donna M. Deidra Sarego Tim Morenc CEDS Michael Gantz Greg Estes Mark Cheatham Jesse Evans #HIinLegalAI

22

4 Comments

On April 5, the U.S. Congress proposed the American Privacy Rights Act, a comprehensive federal consumer data privacy bill. It addresses some of the issues lawmakers had with the previous proposed law, the American Data Privacy and Protection Act (ADPPA), and appears to have bipartisan and bicameral support. It would require qualifying entities to present users with a comprehensive privacy policy and includes provisions for establishing technical specifications for a “centralized mechanism” individuals can use to exercise their opt-out rights. Learn more about the ins and outs of this potential new U.S. federal law right here 👉 https://hubs.ly/Q02tKgKB0

1

On April 5, the U.S. Congress proposed the American Privacy Rights Act, a comprehensive federal consumer data privacy bill. It addresses some of the issues lawmakers had with the previous proposed law, the American Data Privacy and Protection Act (ADPPA), and appears to have bipartisan and bicameral support. It would require qualifying entities to present users with a comprehensive privacy policy and includes provisions for establishing technical specifications for a “centralized mechanism” individuals can use to exercise their opt-out rights. Learn more about the ins and outs of this potential new U.S. federal law right here 👉 https://hubs.ly/Q02z1BrL0

4

1 Comment

What does the American Privacy Rights Act mean for AI Governance? ▪ Congress introduced the American Privacy Rights Act (APRA) by Senator Maria Cantwell and Representative Cathy McMorris Rodgers, targeting the establishment of comprehensive federal privacy laws that will have huge implications for AI governance. ▪ APRA mandates stringent oversight on AI, requiring "large data holders" to perform annual impact assessments on algorithms that could harm specific demographics, and necessitates preemptive risk mitigation in algorithm design. ▪ The legislation empowers individuals to opt out of AI-driven decisions affecting life aspects, such as healthcare and employment opportunities, and establishes robust enforcement mechanisms via the Federal Trade Commission and state attorneys general, with provisions for personal lawsuits. ▪ APRA faces resistance due to its preemption of state laws, which may undermine localized privacy protections like those in California, presenting a significant challenge in balancing national AI regulation with existing state laws. We discuss this in our latest Trustible newsletter plus: 🇯🇵 The Rise of Non-English LLMs 🔄 AI-Ception – When models are trained on AI content 📈 Why AI Governance is going to get a lot harder 🤖 Stanford HAI Summarizes the World of AI Read more here 👉 https://lnkd.in/eSfkWV53

9

1 Comment