Robert Bateman

@robertjbateman.bsky.social

3426 Followers 571 Following

• I post about privacy, data protection, security, AI • Regular updates on big tech shenanigans • Views absolutely represent those of my employer (me) • Consultancy and training services •

Good News For People Who Love Bad News by Modest Mouse album cover (2004)

Application
Each of the eight privacy laws taking effect in 2025 applies slightly differently, providing various exemptions and thresholds.

The laws apply to an entity that conducts business in the relevant state and fulfills one of two thresholds:

It controls or processes the personal data of at least 100,000 consumers per year (30,000 consumers per year in Delaware and Maryland), or
It controls or processes the personal data of at least 25,000 consumers (10,000 consumers in Delaware and Maryland) and derives a specified percentage of revenue from selling personal data:
Delaware: 20%
Iowa: 50%
Maryland: 20%
New Hampshire: 25%
New Jersey: Any amount
Tennessee: 50%

The exceptions are Minnesota and Nebraska’s laws, which apply generally to all businesses processing personal data in each state, except small businesses as defined by the US Small Businesses Association (SBA).

it depends

Article 13, opening words and first paragraph, point e, GDPR indicates that as and when applicable, the
controller provides information to data subjects about what the recipients or the categories of personal
data are. It has been stated in the GDPR (recital 58) that it is difficult to understand for a data subject by
whom and for what purposes their personal data are collected when it concerns information such as that of
online advertising services. In accordance with the principle of fairness, Netflix has to provide information
about the recipients that is most meaningful to the data subjects. In view of this, the Dutch DPA cannot see
why Netflix has not stated the names of recipients – who, by the way, are limited in number – in its
privacy statement. The Dutch DPA is of the opinion that Netflix should have done this and should have
provided this information in the event of a request for information. Netflix has wrongly omitted to do so,
and in this way violated the GDPR (Article 13, first paragraph, point e, and Article 15, first paragraph, point
c). On this point, the complaint of NOYB is, therefore, well-founded.

1) The “incidental” or “agnostic” processing of personal data still constitutes processing of personal data. Many generative AI developers claimed they did not intend to process personal data and that their processing of that data was purely incidental. Our view is clear: data protection law applies to processing of personal data (which includes special category data), regardless of whether this is ‘incidental’ or unintentional.

2) Common practice does not equate to meeting people’s reasonable expectations. Organisations should not assume that a certain way of processing will be within people’s reasonable expectations, just because it is seen as “common practice”. This applies particularly when it comes to the novel use of personal data to train generative AI in an invisible way or years after someone provided it for a different purpose (when their expectations were, by default, different).

3) “Personally identifiable information” (PII) is different to the legal definition of “personal data”. Many organisations focus their generative AI compliance efforts around PII. However, to ensure compliance in the UK they should be considering processing of any “personal data” (which is a broader and legally defined concept in the UK). Organisations must not undertake compliance based on a fundamental misunderstanding or miscommunicate their processing operations.

4) Organisations should not assume that they can rely on the outcome of case law about search engine data protection compliance when considering generative AI compliance. A few respondents sought to rely on these case outcomes, arguing that as the initial collection of data was substantively the same (ie crawling the web), the decisions should also apply to the generative AI context. However, while we can see there are similarities in terms of data collection, there are key differences which means that the logic of these decisions may not be applicable. For example, while a search engine intends to index, rank …

Under the current law, significant solely automated decision-making based on personal data is prohibited unless one of the following three conditions applies:

The data subject gives explicit consent, or
The decision is necessary for a contract between the data subject and a controller, or
The decision is required or authorised by a UK law that provides safeguards for rights and freedoms.

Under the new Article 22B, this prohibition would only apply where special category data is involved. The exceptions are also slightly different:

The data subject gives explicit consent, or
The processing is based on Article 9(2)(g) (“substantial public interest”), and either:
The decision is necessary for a contract between the data subject and a controller, or
The decision is required or authorised by law.

Controllers cannot rely on the new legal basis of “recognised legitimate interests” for automated decisions.

This would mean automated decision-making that only involves “non-special category data” is generally permitted, subject to certain safeguards.

Many providers monitored the accuracy and bias of their AI tools and took
action to improve them. However we did witness instances where there
was a lack of accuracy testing. Additionally, features in some tools could
lead to discrimination by having a search functionality that allowed
recruiters to filter out candidates with certain protected characteristics.
Others estimated or inferred people’s gender, ethnicity, and other
characteristics from their job application or even just their name, rather
than asking candidates directly. This inferred information is not accurate
enough to monitor bias effectively. It was often processed without a
lawful basis and without the candidate’s knowledge.
We were concerned to find tools that collected far more personal
information than was needed. In some cases, personal information was
scraped and combined with other information from millions of peoples’
profiles on job networking sites and social media. This was then used to
build databases that recruiters could use to market their vacancies to
potential candidates. Recruiters and candidates were rarely aware that
information was being repurposed in this way.
We found several instances where AI providers incorrectly defined
themselves as processors rather than controllers, and subsequently had
not complied with the data protection principles. Some had attempted to
pass all responsibility for compliance to recruiters using their tool. In
these cases the arrangements were usually subject to vague or unclear
contracts, that appeared to be deliberately broad or left recruiters in the
dark

LORD CLEMENT-JONES
After Clause 80, insert the following new Clause—

“Algorithmic Impact Assessments
(1) Prior to deployment of an algorithmic or automated decision-making system,
public authorities are responsible for completing an Algorithmic Impact
Assessment prescribed in regulations made under this Act.
(2) Subsection (1) does not apply when the algorithmic or automated decision-making system is—
(a) used solely forthe formulation of policy in relation to that public authority,
and
(b) is not expected to, in practice, fully or predominantly determine the content of the policy.
(3) The Algorithmic Impact Assessment must be updated when the functionality, or the scope, of the algorithmic or automated decision-making system changes.
(4) The final Algorithmic Impact Assessment must be published in accessible format within 30 days of the results being known.
(5) The Secretary of State must by regulations prescribe the form of an Algorithmic Impact Assessment framework with the aims of ensuring public authorities—
(a) procure, develop, and implement algorithmic and automated
decision-making systems such that the decisions made in and by a public authority are responsible and comply with procedural fairness and due process requirements, and its duties underthe Equality Act and the Human Rights Act 1998...

Me in like 2008 with more hair standing near some tents

Executive Summary
On 26 July 2024, the Council consulted the EDPS on the Council mandate for negotiations with
the European Parliament regarding the proposal for a Regulation of the European Parliament and
of the Council on the welfare of dogs and cats and their traceability (‘the Proposal’).
The objectives of the Proposal are to ensure a smooth functioning of the market of dogs and cats
and a rational development of the sector, as well as a high level of animal welfare. In order to
achieve these objectives, both national competent authorities and the Commission must be able
to process certain personal data. Against this background, the EDPS welcomes the inclusion of a
specific provision regarding data protection in the Proposal and the aim of ensuring a high level of
data protection.
With this Opinion, the EDPS provides a number of recommendations regarding the categories of
personal data to be processed by either national competent authorities or the Commission. In
particular, the EDPS recommends providing further clarifications regarding personal data
processed in the context of (1) the notification and registration of establishments; (2) the national
database of the identification and registration of dogs and cats (and their owners); (3) the online
system performing automated checks of the authenticity of the identification and registration
information; (4) the Union pet travellers’ database and (5) the list of approved breeding
establishments.
The EDPS also recommends explicitly designating the Commission as the controller responsible
for processing personal data through the online system performing automated checks of the
authenticity of the identification and registration of dogs and cats placed on the market.
Finally, the EDPS welcomes that the Proposal provides for maximum storage periods and explains
why these storage periods are considered necessary. However, he recommends re-evaluating
whether a shorter maximum storage period of personal data relating to…

Amiga 600

Screenshot from the CCPA's website, headline: "CPPA’s Enforcement Division to Review Data Broker Compliance with the Delete Act. News: October 30, 2024"