Almost 20 million Americans — 8 percent of the U.S. population — are blind or have visual impairments. Accordingly, organizations and businesses in nearly every industry stand to benefit from the use of vision related accessibility tools, which can increase employee productivity and provide a more inclusive user experience. To address this need, M365 incorporates a slew of tools and features – such as screen readers, text-to-speech, and color filters – that make it easier for end users with visual impairments to access, use, and benefit from M365 products. However, because these tools may collect and store user data in ways that may not be immediately apparent, businesses employing them must remain cognizant of the potential downstream risks associated with their use. Listen to our latest Tech Law Talks podcast episode, M365 accessibility: Vision-specific tools, as we discuss.Continue Reading M365 Accessibility: Considerations and Risks Associated with Vision Related Tools
Information Governance
UK government announces its proposals for regulating AI
On 18 July 2022, the United Kingdom (UK) government set out its new proposals for regulating the use of artificial intelligence (AI) technologies while promoting innovation, boosting public trust, and protecting data. The proposals reflect a less centralised and more risk-based approach than in the EU’s draft AI Act.
The proposals coincide with the introduction to Parliament of the Data Protection and Digital Information Bill, which includes measures to use AI responsibly while reducing compliance burdens on businesses to boost the economy. Continue Reading UK government announces its proposals for regulating AI
CJEU rules on interpretation of EU GDPR special categories of data
Background
On 1 August 2022, the Court of Justice of the European Union (“CJEU”) issued a decision (“Decision”) clarifying how the indirect disclosure of sexual orientation data is protected as special category data under Article 9 of the EU General Data Protection Regulation (“GDPR”). “Special Category Data” is defined within Article 9(1) of the GDPR and includes (for example) a data subject’s racial or ethnic origin or data concerning a natural person’s sex life or sexual orientation. The processing of such sensitive personal data is expressly prohibited, unless the processing is exempted from the prohibition in the sense of Article 9(2) GDPR.Continue Reading CJEU rules on interpretation of EU GDPR special categories of data
ICO25: ICO sets out its three year strategic plan
On 14 July 2022, the UK Information Commissioner’s Office (“ICO”) has launched a public consultation on its draft strategic three year plan, titled “ICO25”. The plan sets out a commitment to safeguard the information rights of the most vulnerable individuals with the aim of empowering people to confidently share their information to use today’s market products and services, with work particularly targeting:
- children’s privacy;
- AI-driven discrimination;
- the use of algorithms within the benefits system; and
- the impact of predatory marketing calls.
Continue Reading ICO25: ICO sets out its three year strategic plan
European Commission adopts two proposals for cybersecurity and information security regulations
On 22 March 2022, the European Commission (“EC”) adopted two new proposals for a Cybersecurity Regulation and an Information Security Regulation (available here and here). These regulations aim to set common priorities and frameworks in order to further strengthen inter-institutional co-operation, minimise risk exposure and further strengthen the EU security culture.
Continue Reading European Commission adopts two proposals for cybersecurity and information security regulations
EU sets out its eCommerce and privacy stall in WTO negotiations
The EU has published its initial eCommerce proposals (Proposal) to be discussed at the WTO negotiating meeting, which is ongoing at the time of writing. The EU has been a member of the WTO for more than 20 years. The 28 member states of the EU are also members of the WTO in their own…
Council of Europe issues recommendation on processing health-related data
The Council of Europe (CoE) recently issued its recommendation to member states on the protection of health-related data (Recommendation). The Recommendation guides member states to ensure that their law and practice reflect the principles of processing health-related data.
The recommendations stem from Convention 108 which was the first international treaty in the field of data protection. Like the General Data Protection Regulation 2016/679 (GDPR), Convention 108 sets out principles for processing health data, but contains fewer options than GDPR. The Recommendation’s principles related to health data align with GDPR, but in some cases provide more guidance about processing health-related data.
Some of the key recommendations on processing certain health-related data are below.Continue Reading Council of Europe issues recommendation on processing health-related data
Data Security: You Must Know Where the Data Is Located Before You Can Secure It
It is commonplace to turn on the television news and hear of a new data breach from a large retailer or someone else. No one wants the legal problems (not to mention the embarrassment and the hit to reputation) from having their systems breached. Consequently, data security is on everyone’s mind.
However, many companies have…