Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

On October 24, the Austria, Berlin, Frankfurt, Hamburg, Leipzig, Luxembourg, Munich, Rhine-Ruhr, Stuttgart and Switzerland <a href="https://iapp.org/about/" target="_blank" rel="noreferrer noopener">IAPP</a> (formerly known as the International Association of Privacy Professionals) KnowledgeNet chapters joined together for a daylong <a href="https://my.iapp.org/nc__event?id=a0lTS000000IKoHYAW" target="_blank" rel="noreferrer noopener">conference</a> exploring the state of privacy, artificial intelligence (AI), information governance and the application of regulation for European organizations and multinationals doing business in Europe and abroad.

core/paragraph

In the panel titled <a href="https://www.bakerlaw.com/insights/james-sherer-presents-at-in-person-dach-and-luxembourg-joint-knowledgenet/" target="_blank" rel="noreferrer noopener">“Global Privacy and AI Challenges: U.S. and EU Perspectives,”</a> two Americans, a German and a Canadian living abroad led an hour of lively discussion and some jokes that <em>may</em> have landed – at least those jokes dealing with <a href="https://handbookgermany.de/en/works-council" target="_blank" rel="noreferrer noopener">German Works Council</a> oversight.

The panel mirrored the entirety of the KnowledgeNet conference and explored four key themes:

The European/American perspective and potential divide – what are both sides of the Atlantic doing about AI and privacy in their respective regions, and how can both work more effectively across borders?

core/list-item

What happens where law meets compliance? What do organizations do with limited resources and the impossibility of perfection?

What big transformations are confronting global organizations, what is driving these transformations and which regions are hotbeds of activities?

What are some war stories from the frontlines of privacy, information governance, security and AI?

core/list

The audience provided lively participation, asking questions regarding the uneven application of privacy law in various U.S. states and whether there is realistic hope on the horizon for a one-size-fits-all solution. Absent global or even regional reassurances from the panel, the questions turned to the specifics: What standards could multinational organizations embrace that might help in the near term, especially when advanced and newer technologies are introduced into organizations through the back door without approvals by procurement, privacy impact assessments or new contracting terms?

The panel referenced guidance by regulators and lawmakers in the U.S. who had themselves pointed to specific standards as indicators of compliance, at least facially. The privacy and security guidance first examined when then-California Attorney General Kamala Harris referenced the <a href="https://www.cisecurity.org/controls/cis-controls-list" target="_blank" rel="noreferrer noopener">Center for Internet Security’s Top 20 Critical Security Controls (CSC)</a> (now known as the Center for Internet Security (CIS) Controls) in the 2016 California Data Breach Report as a baseline indicator of whether an organization was meeting basic standards. The discussion then led to the <a href="https://www.jdsupra.com/legalnews/naic-adopts-model-bulletin-on-5680240/" target="_blank" rel="noreferrer noopener">guidance from</a> the <a href="https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf" target="_blank" rel="noreferrer noopener">National Association of Insurance Commissioners’ Model Bulletin on AI Adoption</a> that specifically referenced the <a href="https://leg.colorado.gov/bills/sb24-205" target="_blank" rel="noreferrer noopener">National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (RMF)</a> as a model for an insurer’s existing enterprise risk management (ERM) program. The recitation ended with how the upcoming <a href="https://leg.colorado.gov/bills/sb24-205">Colorado AI Act </a>also prospectively references both the NIST RMF and the <a href="https://www.iso.org/standard/81230.html" target="_blank" rel="noreferrer noopener">International Organization for Standardization (ISO)/International Electrochemical Commission (IEC) 42001:2023 standard</a> as examples of a reasonable risk management policy related to AI use, as well as considerations for ERM requirements.

Outside general standards and high-level regulatory advice, of particular interest to European counsel for multinational organizations with locations and presence in the U.S. was how plaintiffs’ counsel in the U.S. approach private rights of action, especially regarding the “zombie technologies” associated with websites running legacy technologies, such as pixels, video plug-ins and chatbots – even when these technologies come from “white label” providers.

BakerHostetler has certainly covered these issues before in <a href="https://www.bakerdatacounsel.com/blogs/dsir-deeper-dive-plaintiffs-attorneys-are-trying-to-assert-a-new-cause-of-action-against-universities-based-on-an-old-law-regulating-videotape-service-providers/" target="_blank" rel="noreferrer noopener">blog posts</a> and <a href="https://www.bakerlaw.com/insights/privacy-litigation-trends-meta-pixels-cookie-opt-out-and-sale-of-data/" target="_blank" rel="noreferrer noopener">treatments</a>, but the panel was another fantastic opportunity to remind organizations to engage in some end-of-the-year hygiene for online websites and other outward-facing “presences,” including applications. Not only have California plaintiffs’ counsel been busy examining the “outer layer of the onion,” i.e., the parts of organizations visible from the outside, but multinational organizations have also been confronting new actions commenced or filed in other states by attorneys general (California and Texas) and other state plaintiffs’ attorneys (including Florida). Ultimately, the panel and discussion combined views on federated approaches in the U.S. to applicable law, the application of U.S. and international standards (e.g., CIS Controls, the NIST RMF, ISO/IEC 42001:2023), and real-world experience with regulators and plaintiffs’ counsel – or what actually happens when theory meets practice.

IAPP’s DACH and Luxembourg Joint KnowledgeNet: More Zombie Technologies in Time for Halloween!