Tom Brown

The Vermont Data Privacy Act is no more. Governor Scott vetoed the bill last week, and after calling a special legislative session, the Vermont Senate failed to override the veto by just a single vote. What does the VDPA’s defeat mean for the future of consumer privacy laws? What should businesses take away from all of this? Learn more in my latest blog. https://lnkd.in/gkxwntiK

5

Avoid the dark side, you must. As noted in Luis’s summary, according to the CPPA Deputy Director Macko, “[d]ark patterns aren’t about intent, they’re about effect.” This follows on increased scrutiny of dark patterns by the FTC and other authorities. #ccpa #privacylaw

27

I found this Littler article regarding the Supreme Court’s decision in Loper Bright and its impact on potential federal legislation regarding AI. It's interesting in light of advanced efforts at the state level (e.g., in Colorado and, to an extent, California) that would seemingly withstand some of the non-delegation concerns raised in Loper Bright. Worth a read. https://lnkd.in/dj_E2ipA #ai #artificialintelligence #ailaw #loperbright #technology #techlaw #tech #regulation #policy #sb1047

5

Consumer privacy concepts and rules do not always translate well in the employment context (at least in the US). In CA, the CCPA and regulations issued by the CPPA use language that sometimes literally makes no sense when it comes to employees and job applicants. Employers are left wondering how the hell do I comply (some would even throw in an expletive or two in this question)? Last Friday, for what I think is the first time, a member of the CPPA board seemed to acknowledge the need for guidelines specific to how employers subject to the CCPA should handle employee data. Whether that will result in more rules for / burdens on employers vs. just clarification of existing obligations is yet to be seen. Perhaps a glimmer of hope. Here is the #FisherPhillips brief recap of the key moments from the May 10 CPPA board meeting. With David Shannon. https://lnkd.in/gXjAr4CQ

13

🚨 Latest CPPA Enforcement Advisory: California shines its spotlight on "Dark Patterns" 🛡️ On September 4, 2024, the 𝗖𝗮𝗹𝗶𝗳𝗼𝗿𝗻𝗶𝗮 𝗣𝗿𝗶𝘃𝗮𝗰𝘆 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗶𝗼𝗻 𝗔𝗴𝗲𝗻𝗰𝘆 (𝗖𝗣𝗣𝗔) Enforcement Division issued its second Enforcement Advisory: "𝗔𝘃𝗼𝗶𝗱𝗶𝗻𝗴 𝗗𝗮𝗿𝗸 𝗣𝗮𝘁𝘁𝗲𝗿𝗻𝘀: 𝗖𝗹𝗲𝗮𝗿 𝗮𝗻𝗱 𝗨𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱𝗮𝗯𝗹𝗲 𝗟𝗮𝗻𝗴𝘂𝗮𝗴𝗲, 𝗦𝘆𝗺𝗺𝗲𝘁𝗿𝘆 𝗶𝗻 𝗖𝗵𝗼𝗶𝗰𝗲." This follows their April Advisor on applying data minimization to consumer requests. 📄 ⚖️ As businesses face increased scrutiny, understanding these advisories is crucial for staying compliant. 🚨 Historically, an advisory serves as an omen future regulatory crackdowns. https://lnkd.in/evUyUYqy 🕶 "𝗗𝗮𝗿𝗸 𝗽𝗮𝘁𝘁𝗲𝗿𝗻𝘀" refer to deceptive design tactics used by websites and apps to manipulate users into making decisions they wouldn’t otherwise make. These tactics serve to benefit businesses at the expense of the user's freedom of choice. 🔍 𝗪𝗵𝗮𝘁 𝗱𝗼𝗲𝘀 𝘁𝗵𝗲 𝗘𝗻𝗳𝗼𝗿𝗰𝗲𝗺𝗲𝗻𝘁 𝗔𝗱𝘃𝗶𝘀𝗼𝗿𝘆 𝗦𝗮𝘆? 𝐓𝐚𝐤𝐞𝐚𝐰𝐚𝐲: Consumer agreement obtained via dark patterns does NOT equal consent. The CPPA defines clear principles for businesses obtaining consumer consent or handling CCPA requests. Failing to meet these standards may result in violations. 𝐅𝐢𝐯𝐞 𝐊𝐞𝐲 𝐂𝐨𝐧𝐬𝐞𝐧𝐭 𝐏𝐫𝐢𝐧𝐜𝐢𝐩𝐥𝐞𝐬: The regulations require businesses to design and implement methods for obtaining consumer consent or submitting CCPA requests, specifically that they must incorporate the following principles: 1. Easy to understand. 2. Symmetry in choice. 3. Avoid confusing language or elements. 4. Avoid choice architecture that impairs consumer decision-making. 5. Easy to execute. 𝐕𝐢𝐬𝐮𝐚𝐥𝐬 𝐚𝐧𝐝 𝐀𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭 𝐐𝐮𝐞𝐬𝐭𝐢𝐨𝐧𝐬: The advisory also provides three useful visual examples of dark patterns and five assessment questions businesses should ask themselves.

10

#BusinessLawToday | Antitrust enforcement agencies and private plaintiffs are pursuing notable challenges to companies within the same industry using common pricing algorithms. Read: https://lnkd.in/e6sV3AP2 #BusinessLaw #BusinessRegulation #RegulatedIndustries

4

Absolutely critical webinar next week folks. We will be teaming up with AC Evans and Drips to discuss the massive TCPA revocation rule change just ushered in by the FCC. This rule really will change everything you thought you knew about enterprise contact strategy and will require more coordination between origination and servicing arms than ever before. Truly game changing. We will dive deep into these issues as we explore the new rule and it's impacts. Join us next Tuesday October 22, 2024 at 10:00 am pacific! (Free for the first 500 attendees!) #webinar #tcpa #fcc #callcenter #contactcenter #revocation #consent #compliance #calls #sms #marketing #servicing #collection #debtcollection #crm #deservetowin

19

1 Comment

Today Future of Privacy Forum launched a new U.S. Legislation Retrospective 🔍 This new report is not a comprehensive discussion of every single lawsuit, FTC enforcement action, or state privacy enforcement that has happened over the last few years. Rather, we have chosen the SIX top enforcement trends that have recently addressed key questions and policy issues in the U.S. privacy landscape. In each section, we look case(s) representing the trend, give a summary of the facts of the case and analysis from the enforcer, and pull out key insights and observations on WHY the case matters. Why do this now? With a flurry of FTC activity and many states ramping up enforcement of their privacy laws (looking at you, Texas), we thought it was important to take a step back and look at what has happened over the last few years, sifting through all this activity to pull out what is most relevant and most representative of where the privacy landscape is headed. We wrote this report with privacy professionals in mind, but I think it can also be a useful guide for lawmakers. The report actually contains a mini-case study on how the Illinois legislature recently amended BIPA's private right of action in light of one of cases we discuss in the report. I'd love for folks to read the report, but as a tl;dr, I'll share the headings for each of our six sections: 1️⃣ DoorDash: The Right to Cure Under State Law is Not Absolute 2️⃣ GoodRx, BetterHelp, Premom: Unauthorized Disclosures of Health Information as Breaches 3️⃣ Betterhelp and Vitagene: Health Information (and Its Sensitivity) is Contextual and Situational 4️⃣ Epic Games: FTC Focuses on Impact of Design Choices on Teen Privacy 5️⃣ Cothron v. White Castle: Multiple Actionable Harms from Single Privacy Violations Spur Legislative Change 6️⃣ FTC v. Kochava: How Location Data Sales Impact Privacy Interests I'd also be remiss not to shout out the people who contributed to this report over the last few months. I picked up this project shortly after joining the U.S. Leg team, and I greatly benefited from the contributions of Jordan Francis, Jordan Wrigley, Keir Lamont, Tatiana Rice, and Felicity Slater! https://lnkd.in/gcEdVM2J

76

5 Comments

At some point in every financial institution's life, the subject of a lookback will come up. It may never be a happy subject, but for Fintechs new to the topic, we cut to the chase in this article (https://lnkd.in/eyYCM3aG): ▪ What even is a lookback? ▪ When should you consider doing a proactive lookback? ▪ What are the key elements of a successful lookback? ▪ And how do you make a lookback—which, no getting around it, is expensive—work for you? #amlcompliance #consumerprotectioncompliance #fintechcompliance

23

The Massachusetts Attorney General released guidance on AI developers, suppliers, and users' obligations under Massachusetts consumer protection, anti-discrimination, and data security laws. Nothing earth-shattering in the advisory notice and another example of how existing laws are being used to regulate AI. The advisory presents the below non-exhaustive list of acts and practices that may be considered to be unfair and deceptive under the Massachusetts Consumer Protection Act: - Falsely advertising the quality, value, or usability of AI systems - Supplying an AI system that is defective, unusable, or impractical for the purpose advertised - Misrepresenting the reliability, manner of performance, safety, or condition of an AI system - Offering for sale or use an AI system in breach of warranty, in that the system is not fit for the ordinary purposes for which such systems are used, or that is unfit for the specific purpose for which it is sold where the supplier knows of such purpose - Misrepresenting audio or video content of a person for the purpose of deceiving another to engage in a business transaction or supply personal information as if to a trusted business partner as in the case of deepfakes, voice cloning, or chatbots used to engage in fraud  - Failing to comply with Massachusetts statutes, rules, regulations or laws, meant for the protection of the public’s health, safety or welfare 

27

Look out for Abstract Idea Indicators for Software Inventions: 🚀 (Fed. Cir. June 21, 2024) - Federal Circuit Court Affirms Dismissal in Beteiro, LLC v. DraftKings Inc. Case 🎲 In a significant ruling, the United States Court of Appeals for the Federal Circuit has upheld the dismissal of Beteiro, LLC's patent infringement claims against DraftKings Inc. and several other defendants, including BetMGM and PointsBet USA. This decision marks an important precedent in the realm of patent law for technology in the gaming and gambling industries. 🔍 Case Overview: 1. Beteiro, LLC held multiple patents (U.S. Patent Nos. 9,965,920, 10,043,341, 10,147,266, and 10,255,755) aimed at facilitating remote gambling activities using devices equipped with GPS to ensure compliance with local gambling laws. However, both the District Court of New Jersey and the Federal Circuit found these patents to be abstract and lacking any inventive concept, thus failing the Alice/Mayo test for patent eligibility. 2. Claims recite generic steps, such as detecting, generating, receiving, determining, and processing information, which are of a kind frequently held to be abstract. 3. Used RESULT focused functional language and not HOW the invention achieves those results. 4. Used Computer as a tool and do not claim any improvement in computer related technology. 💡 Key Takeaways: Patents: Beteiro's patents described methods for remote gambling using GPS-enabled devices. Ruling: The courts ruled these patents as abstract ideas without sufficient inventive elements, making them ineligible for patent protection. Implications: This decision underscores the importance of demonstrating a concrete, innovative step beyond the abstract idea in patent claims, particularly in tech-driven sectors.

17

A very positive development and a welcomed regulatory framework.

2

For all of my #dataprivacy #policy folks, here’s a good read on the #GDPR: https://lnkd.in/g8rhFC4Q

7

1 Comment

With monetary whistleblower award programs being implemented in many government agencies -- DOJ, SEC, CFTC, FinCen -- to reward individuals for reporting wrongdoing out to the government, what is internal compliance to do to encourage internal reporting? My fellow co-panelists -- Ellen M. Hunt and Aaron Nicodemus (he/him) -- and I will discuss this and many more topics related to whistleblowing. See link below to join us in the discussion! #CCO #generalcounsel #riskandcompliance #DOJ #SEC #AML https://lnkd.in/gz5r-d9b

21

2 Comments

If you are interested in learning more about the DOJ, SEC, and FinCen whistleblower award programs and how it may impact your organization, please sign up to attend this session with Compliance Week. It starts at 1:00pmET today! #chiefcomplianceofficer #compliance #whistleblower Aaron Nicodemus (he/him)Ellen M. Hunt

13

Join Director Lestin Kenton at The AI Strategy Summit: IP, Data and Compliance, hosted by CenterForce USA on May 22, 2024, in Palo Alto, CA. Lestin is a speaker on the "Navigating Intellectual Property Challenges in AI-Driven Innovations" panel. Register here: https://lnkd.in/e-tXxeT8 The panel will discuss: 1️⃣ AI as Inventor: Legal Implications and Future Directions 2️⃣ Ownership and Licensing Strategies for AI-Generated IP 3️⃣ Harmonizing Global IP Laws for AI Innovations Don't miss out on this insightful discussion! #AI #IntellectualProperty

8

With all the new proposals coming out of the #SEC, this development may not be on your radar yet. The “American Privacy Rights Act of 2024” (APRA) was recently introduced in Congress and could impose a range of new compliance and operational obligations on financial services companies. As a very general summary, the APRA could impact companies in the following ways:   1️⃣ New Data Protection Regulatory Regime. Place new obligations on covered entities that collect and process data to provide affected consumers with notice of their data practices and with the ability to control (as well as prohibit) how that data is processed and used, depending on the sensitivity and nature of that information. 2️⃣ Data Minimization. Substantially restrict the ability of covered entities to collect, store, and use data – a concept known as “data minimization” – and prohibit the transfer of sensitive data to third parties without prior consumer consent. 3️⃣ Data Algorithm Limitations, including for #AI. Prohibit the use of personal information for artificial intelligence operations, as well as the use of collected data for purposes that discriminate against individuals and/or algorithmically encourage certain online behaviors (a practice known as “dark patterns”.) 4️⃣ Data Brokers. Impose additional obligations on covered entities that collect and process large amounts of data, including entities known as “data brokers”, while exempting small businesses that meet certain metrics established under the bill. 5️⃣ New #FTC Enforcement Authority. Designate the Federal Trade Commission as the primary federal entity with new regulatory and enforcement authority, further deputize state attorneys general to enforce against violations of the law, and provide consumers with a private right of action. 6️⃣ State Preemption, including California.  Preempt state laws that are covered by APRA’s provisions. Many of these changes, particularly the preemption provisions, could impact #brokerdealer and #adviser customer #privacy disclosures, which often incorporate state-specific provisions. In addition to regulatory advice, the Mintz ML Strategies team can provide access to influential policymakers on Capitol Hill and expertise on the draft legislation itself and substantive public policy. Christian Fjeld, ML Strategies, LLC, #ArtificialIntelligence #RegulatoryCompliance #Finance  

12

The brain is the new privacy frontier: Responding to developing technologies in the neurotech space, a number of American states have amended their privacy laws to include "neural data" in their definition of sensitive personal information. Some require opt-in consent for its collection, others simply the possibility for a data subject to opt out. Some have included employees' neural data in the definition, others not - with varying implications for privacy protection:

7

I find Michael Hsu, Acting Comptroller of the Currency, to be one of the most interesting financial regulators to listen to. (Shout out to Hsu's 2022 "Don't Chase" speech on FOMO in the Fintech world. https://lnkd.in/eKxH8nRR). Hsu testified today on the Hill, https://lnkd.in/eeYuzC47, and his remarks contained a few nuggets: ▪ You can see the effect of the CFPB's influence in comments on addressing fairness and discrimination, overdraft and insufficient funds fees, and financial inclusion. ▪ Regulators are like a dog with a bone on third party management issues in bank-fintech relationships. ▪ There has been a "notable increase in the number of generative AI pilots" at larger banks. Talk about FOMO . . . ▪ Hsu is not above a gratuitous dig at the crypto industry. In referencing tokenization initiatives, he said: "In contrast to crypto, tokenization is driven by solving real-world settlement problems and can be developed in a safe, sound, fair, and compliant manner." Ouch. 💥 #fintech #bankfintechpartnerships #regulatorycompliance

22