ICO blogs on AI and data subject rights

By Cynthia O’Donoghue and Daniel Millard on 4 November 2019 Posted in Privacy & Data Protection

On 15 October 2019, the Information Commissioner’s Office (ICO) released the latest in its series of blogs on developing its framework for auditing artificial intelligence (AI). The blog (here) focuses on AI systems and how data subjects can exercise their rights of access, rectification and erasure in relation to such systems. Below, we summarise some of the key takeaways and our thoughts on the subject.

Rights relating to training data

Organisations need data in order to train machine learning models. While it may be difficult to identify the individual to whom the training data relates, it may still be personal data for the purposes of the General Data Protection Regulation (GDPR), and so will still need to be considered when responding to data subject rights requests under the GDPR. Provided no exception applies and reasonable steps have been taken to verify the identity of the data subject, organisations are obliged to respond to data subject access requests in relation to training data. The right of rectification may also apply but, as an individual inaccuracy is less likely to have a direct effect on an individual data subject that is part of a large data set, organisations should prioritise rectifying personal data that may have a direct effect on the individual.

Complying with requests from data subjects to erase training data may prove more challenging. If an organisation no longer needs the personal data as the machine learning model has already been trained, the ICO advises that the organisation must fulfil the request to erase. However, organisations may need to retain training data where the machine learning model has not yet been trained. The ICO advises that organisations should consider such requests on a case-by-case basis, but do not provide clarity on the factors organisations should consider.

At odds no more: can regulatory collaboration bring innovation and data privacy closer together?

By Cynthia O’Donoghue and Howard Womersley Smith on 31 October 2019 Posted in Privacy & Data Protection, Regulatory

In July 2019, the UK’s Financial Conduct Authority (FCA) held a week-long Global Anti-Money Laundering and Financial Crime TechSprint (FCA TechSprint) event. The FCA TechSprint looked at ways to effectively combat financial crime and money laundering within the financial services industry. On 16 October 2019, the Information Commissioner’s Office (ICO) released a blog (here) that focuses on the lessons learnt from the FCA TechSprint.

Background

The FCA TechSprint brought together teams from all over the world to explore how encryption techniques known as privacy enhancing technologies (PETs) can facilitate data and knowledge sharing among financial institutions, regulators and law enforcement agencies to detect and prevent money laundering and financial crime, while remaining compliant with data protection and privacy laws.

The teams worked towards developing solutions to the following use cases:

how can a network of market participants use PETs and data analytics to interrogate financial transactions stored in databases within institutions to identify credible suspicions without compromising data privacy legislation?
how can market participants efficiently and effectively codify topologies of crime which can be shared and readily implemented by others in their crime controls?
how can a market participant check that the company or individual they are performing due diligence on has not raised flags or concerns within another market participant, and/or verify that the data elements they have for the company or individual match those held by another market participant?
how can technology be used to assist in identifying an ultimate beneficiary owner across a network of market participants and a national register?

ICO’s Regulators’ Business Innovation Privacy Hub was present at the FCA TechSprint to offer guidance on the data protection implications of implementing PETs.

IAB issues CCPA compliance framework for public comment

By Keri S. Bruce and Gerard Stegmaier on 30 October 2019 Posted in Privacy & Data Protection, Regulatory, Social, Mobile, Analytics & Cloud (SMAC)

Given the vast challenges California’s sweeping new privacy law, the California Consumer Privacy Act (CCPA), poses for digital marketing, the Interactive Advertising Bureau (IAB) released for public comment a draft of its proposed Compliance Framework for Publishers & Technology Companies (the Framework) on October 22.

“Selling” and CCPA challenges for digital. Those who have been actively preparing for CCPA’s implementation on January 1 know by now that pursuant to section 1798.115(d) of the CCPA, a company that has personal information about a consumer may not onward “sell” (as defined in the CCPA) such information to another party without the consumer (1) having received explicit notice of the sale of the personal information and (2) being given the right to opt out pursuant to section 1798.120. Under the CCPA, even if consumers opt out of having their personal information sold, the information may be shared with third parties acting as “service providers” for limited purposes, but the party disclosing the personal information (that is, the “business”) is very specifically limited in its ability to use any data it received that is deemed “personal information.”

Current information sharing practices. Currently, in the programmatic advertising ecosystem, publishers may pass personal information about visitors to their website to downstream participants (the Downstream Participants) who then may pass such information on to others in the supply chain. These Downstream Participants include providers such as:

supply-side platforms (SSPs)

demand-side platforms (DSPs)

ad exchanges

ad networks

ad tech platforms

data management platforms (DMPs)

Downstream Participants also include the advertiser who ultimately purchases the ad, funds the ecosystem, and, in many cases, expects to have ready and trusted access to information associated with its advertising activity and consumer behavior in response to such advertising.

Courts continue to consider intersection of Fourth Amendment and technology: without a warrant, retrieval of car’s electronic data unconstitutional, but surveillance on hunting property permissible

By Brian J. Willett on 30 October 2019 Posted in In the Courts

The Fourth Amendment has received significant attention in recent court rulings involving surveillance, electronic data retrieval, and other types of technology. Two rulings issued on October 21, 2019 demonstrate how difficult it can be to anticipate the outcome of Fourth Amendment disputes relating to technology. In one, the Georgia Supreme Court found the warrantless search of electronic data from a car following a fatal accident to be unconstitutional. In the second, the U.S. Court for the Western District of Tennessee held that the Fourth Amendment permitted the warrantless placement of a government surveillance camera on a man’s private hunting and fishing property.

Mobley v. State (Ga. Oct. 21, 2019)

In Mobley, the Georgia Supreme Court ruled that a trial court erred in denying a motion to suppress evidence that law enforcement retrieved from the electronic data recorder in the defendant’s car. In coming to this conclusion, the Mobley court ruled that – regardless of any reasonable expectation of privacy – the physical entry of a police officer into the defendant’s car to retrieve the electronic data was a search for Fourth Amendment purposes.

The Mobley case arose after a car driven by defendant Mobley collided with a car that pulled out of a private driveway; both occupants of the latter car died. Before the cars were removed from the accident scene, a police investigator entered both cars, and attached a crash data retrieval device to data ports in the cars to download available data. The data revealed that shortly before the collision, Mobley’s car was traveling almost 100 miles per hour. The next day, law enforcement applied for a warrant to seize the electronic data recorders. The warrant was issued, but no additional data was retrieved from the recorders. A grand jury indicted Mobley on a number of counts, including vehicular homicide.

Uncertainty hangs over the life sciences and healthcare industries in draft regulations of The California Consumer Privacy Act

By Catherine David, Brad Rostolsky, Kimberly Gold and Alexis Cocco on 25 October 2019 Posted in Privacy & Data Protection, Regulatory

On October 10^th, the Attorney General of California, Xavier Becerra, delivered the highly anticipated text of the proposed California Consumer Privacy Act (CCPA) regulations. However, untouched and unexplained were the Health Insurance Portability and Accountability Act, California Medical Information Act, and clinical research exemptions. The industry has and will continue to grapple with these exemptions, which lack crucial definitions and still remain ambiguous.

For further analysis of this matter, please visit Life Sciences Legal Update.

Implications for employers and the biometric landscape under New York’s expanded data security law

By Kimberly Gold, Mark S. Goldstein, Alexandra Manfredi and Jim Barbuto on 25 October 2019 Posted in Privacy & Data Protection, Regulatory

Over the past several years, legislators from coast to coast have increasingly made data privacy and cybersecurity top priorities. The result has been a spike in the number and stringency of laws that impose proactive and reactive responsibilities – covering, for instance, data security and breach notifications – on companies that collect personal information, whether from their customers, their employees, end users, or others. That legislative trend has recently expanded previous obligations of companies conducting business in New York state.

On October 23, 2019, New York’s Stop Hacks and Improve Electronic Data Security (SHIELD) Act went into effect. The law broadens the state’s existing breach notification laws and imposes new security obligations on companies doing business in New York, including an expanded focus on how companies handle biometric data. The SHIELD Act also applies to employee information, as long as there is at least one employee in New York state – regardless of the size or location of the company. As such, the law will have a significant impact on businesses across the country that have private information about consumers and employees based in New York.

For more information about the ramifications of the SHIELD Act, visit ReedSmith.com.