Navigating Data Privacy

🚨 BREAKING: An extremely important lawsuit in the intersection of PRIVACY and AI was filed against Otter over its AI meeting assistant's lack of CONSENT from meeting participants. If you use meeting assistants, read this: Otter, the AI company being sued, offers an AI-powered service that, like many in this business niche, can transcribe and record the content of private conversations between its users and meeting participants (who are often NOT users and do not know that they are being recorded). Various privacy laws in the U.S. and beyond require that, in such cases, consent from meeting participants is obtained. The lawsuit specifically mentions: - The Electronic Communications Privacy Act; - The Computer Fraud and Abuse Act; - The California Invasion of Privacy Act; - California’s Comprehensive Computer Data and Fraud Access Act; - The California common law torts of intrusion upon seclusion and conversion; - The California Unfair Competition Law; As more and more people use AI agents, AI meeting assistants, and all sorts of AI-powered tools to "improve productivity," privacy aspects are often forgotten (in yet another manifestation of AI exceptionalism). In this case, according to the lawsuit, the company has explicitly stated that it trains its AI models on recordings and transcriptions made using its meeting assistant. The main allegation is that Otter obtains consent only from its account holders but not from other meeting participants. It asks users to make sure other participants consent, shifting the privacy responsibility. As many of you know, this practice is common, and various AI companies shift the privacy responsibility to users, who often ignore (or don't know) what national and state laws actually require. So if you use meeting assistants, you should know that it's UNETHICAL and in many places also ILLEGAL to record or transcribe meeting participants without obtaining their consent. Additionally, it's important to have in mind that AI companies might use this data (which often contains personal information) to train AI, and there could be leaks and other privacy risks involved. - 👉 Link to the lawsuit below. 👉 Never miss my curations and analyses on AI's legal and ethical challenges: join my newsletter's 74,000+ subscribers. 👉 To learn more about the intersection of privacy and AI (and many other topics), join the 24th cohort of my AI Governance Training in October.

HUGE AI LEGAL NEWS! The European Data Protection Board (EDPB) has published its much anticipated Opinion on AI and data protection. The opinion looks at 1) when and how AI models can be considered anonymous, 2) whether and how legitimate interest can be used as a legal basis for developing or using AI models, and 3) what happens if an AI model is developed using personal data that was processed unlawfully. It also considers the use of first and third-party data. The opinion also addresses the consequences of developing AI models with unlawfully processed personal data, an area of particular concern for both developers and users. The EDPB clarifies that supervisory authorities are empowered to impose corrective measures, including the deletion of unlawfully processed data, retraining of the model, or even requiring its destruction in severe cases. On the issue of anonymity, the opinion grapples with the question of whether AI models trained on personal data can ever fully transcend their origins to be considered anonymous. The EDPB highlights that merely asserting that an AI model does not process personal data is insufficient. Supervisory authorities (SAs) must assess claims of anonymity rigorously, considering whether personal data has been effectively anonymised in the model and whether risks such as re-identification or membership inference attacks have been mitigated. For AI developers, this means that claims of anonymity should be substantiated with evidence, including the implementation of technical and organisational measures to prevent re-identification. On legitimate interest as a legal basis for AI, the opinion offers detailed guidance for both development and deployment phases. Legitimate interest under Article 6(1)(f) GDPR requires meeting three cumulative conditions: pursuing a legitimate interest, demonstrating that processing is necessary to achieve that interest, and ensuring the processing does not override the fundamental rights and freedoms of data subjects. For third-party data, the opinion emphasises that the absence of a direct relationship with the data subjects necessitates stronger safeguards, including enhanced transparency, opt-out mechanisms, and robust risk assessments. The opinion’s findings stress that the balancing test under legitimate interest must consider the unique risks posed by AI. These include discriminatory outcomes, regurgitation of personal data by generative AI models, and the broader societal risks of misuse, such as through deepfakes or misinformation campaigns. The opinion also provides examples of mitigating measures that could tip the balance in favour of controllers, such as pseudonymisation, output filters, and voluntary transparency initiatives like model cards and annual reports. The implications for developers are significant: compliance failures in the development phase can render an entire AI system non-compliant, leading to legal and operational challenges.

As an investigative reporter, when I come across things that I think are wrong in the world, I start looking into them and if the facts suggest that there is indeed a problem, I write a story, hoping that it will lead to change. Last year, the thing that I looked at was automakers collecting data about how and where people were driving their cars. And change has come. The most egregious practice I found was at General Motors, which was collecting information -- as often as every 3 seconds -- from people's cars about when they sped, slammed on the brakes, or made harsh turns, as well as when, where, and how far they drove. G.M. was selling that information to the insurance industry which was using it to give people risk scores that could affect whether they could get auto insurance and how much they would pay for it. The vast majority of consumers had NO IDEA this was happening until I reported it in March of last year: https://lnkd.in/eAc_cTSh This line of reporting has had real impact. There is a federal class action lawsuit happening, but also, this week the Federal Trade Commission banned G.M. from selling individual drivers' behavior and location for five years, and put the automaker under a 20 year consent decree saying, essentially, it can't do creepy stuff like this with people's data without their explicit consent: https://lnkd.in/ey6FxP4q Another happening this week: The Texas attorney general, which has also sued G.M. for privacy violations, filed a lawsuit against an Allstate subsidiary called Arity: https://lnkd.in/ec2EEKQp. Arity was doing something similar -- gathering data about people's driving from smartphone apps, such as Life360, and selling it to insurance companies, a practice I wrote about in June: https://lnkd.in/eucJKfnX I'm not opposed to people's driving being monitored to determine their insurance rates if they are aware and consent to it. It could lead to safer roads. BUT THEY NEED TO KNOW THAT IT IS HAPPENING.

This new white paper by Stanford Institute for Human-Centered Artificial Intelligence (HAI) titled "Rethinking Privacy in the AI Era" addresses the intersection of data privacy and AI development, highlighting the challenges and proposing solutions for mitigating privacy risks. It outlines the current data protection landscape, including the Fair Information Practice Principles, GDPR, and U.S. state privacy laws, and discusses the distinction and regulatory implications between predictive and generative AI. The paper argues that AI's reliance on extensive data collection presents unique privacy risks at both individual and societal levels, noting that existing laws are inadequate for the emerging challenges posed by AI systems, because they don't fully tackle the shortcomings of the Fair Information Practice Principles (FIPs) framework or concentrate adequately on the comprehensive data governance measures necessary for regulating data used in AI development. According to the paper, FIPs are outdated and not well-suited for modern data and AI complexities, because: - They do not address the power imbalance between data collectors and individuals. - FIPs fail to enforce data minimization and purpose limitation effectively. - The framework places too much responsibility on individuals for privacy management. - Allows for data collection by default, putting the onus on individuals to opt out. - Focuses on procedural rather than substantive protections. - Struggles with the concepts of consent and legitimate interest, complicating privacy management. It emphasizes the need for new regulatory approaches that go beyond current privacy legislation to effectively manage the risks associated with AI-driven data acquisition and processing. The paper suggests three key strategies to mitigate the privacy harms of AI: 1.) Denormalize Data Collection by Default: Shift from opt-out to opt-in data collection models to facilitate true data minimization. This approach emphasizes "privacy by default" and the need for technical standards and infrastructure that enable meaningful consent mechanisms. 2.) Focus on the AI Data Supply Chain: Enhance privacy and data protection by ensuring dataset transparency and accountability throughout the entire lifecycle of data. This includes a call for regulatory frameworks that address data privacy comprehensively across the data supply chain. 3.) Flip the Script on Personal Data Management: Encourage the development of new governance mechanisms and technical infrastructures, such as data intermediaries and data permissioning systems, to automate and support the exercise of individual data rights and preferences. This strategy aims to empower individuals by facilitating easier management and control of their personal data in the context of AI. by Dr. Jennifer King Caroline Meinhardt Link: https://lnkd.in/dniktn3V

Isabel Barberá: "This document provides practical guidance and tools for developers and users of Large Language Model (LLM) based systems to manage privacy risks associated with these technologies. The risk management methodology outlined in this document is designed to help developers and users systematically identify, assess, and mitigate privacy and data protection risks, supporting the responsible development and deployment of LLM systems. This guidance also supports the requirements of the GDPR Article 25 Data protection by design and by default and Article 32 Security of processing by offering technical and organizational measures to help ensure an appropriate level of security and data protection. However, the guidance is not intended to replace a Data Protection Impact Assessment (DPIA) as required under Article 35 of the GDPR. Instead, it complements the DPIA process by addressing privacy risks specific to LLM systems, thereby enhancing the robustness of such assessments. Guidance for Readers > For Developers: Use this guidance to integrate privacy risk management into the development lifecycle and deployment of your LLM based systems, from understanding data flows to how to implement risk identification and mitigation measures. > For Users: Refer to this document to evaluate the privacy risks associated with LLM systems you plan to deploy and use, helping you adopt responsible practices and protect individuals’ privacy. " >For Decision-makers: The structured methodology and use case examples will help you assess the compliance of LLM systems and make informed risk-based decision" European Data Protection Board

𝟔𝟔% 𝐨𝐟 𝐀𝐈 𝐮𝐬𝐞𝐫𝐬 𝐬𝐚𝐲 𝐝𝐚𝐭𝐚 𝐩𝐫𝐢𝐯𝐚𝐜𝐲 𝐢𝐬 𝐭𝐡𝐞𝐢𝐫 𝐭𝐨𝐩 𝐜𝐨𝐧𝐜𝐞𝐫𝐧. What does that tell us? Trust isn’t just a feature - it’s the foundation of AI’s future. When breaches happen, the cost isn’t measured in fines or headlines alone - it’s measured in lost trust. I recently spoke with a healthcare executive who shared a haunting story: after a data breach, patients stopped using their app - not because they didn’t need the service, but because they no longer felt safe. 𝐓𝐡𝐢𝐬 𝐢𝐬𝐧’𝐭 𝐣𝐮𝐬𝐭 𝐚𝐛𝐨𝐮𝐭 𝐝𝐚𝐭𝐚. 𝐈𝐭’𝐬 𝐚𝐛𝐨𝐮𝐭 𝐩𝐞𝐨𝐩𝐥𝐞’𝐬 𝐥𝐢𝐯𝐞𝐬 - 𝐭𝐫𝐮𝐬𝐭 𝐛𝐫𝐨𝐤𝐞𝐧, 𝐜𝐨𝐧𝐟𝐢𝐝𝐞𝐧𝐜𝐞 𝐬𝐡𝐚𝐭𝐭𝐞𝐫𝐞𝐝. Consider the October 2023 incident at 23andMe: unauthorized access exposed the genetic and personal information of 6.9 million users. Imagine seeing your most private data compromised. At Deloitte, we’ve helped organizations turn privacy challenges into opportunities by embedding trust into their AI strategies. For example, we recently partnered with a global financial institution to design a privacy-by-design framework that not only met regulatory requirements but also restored customer confidence. The result? A 15% increase in customer engagement within six months. 𝐇𝐨𝐰 𝐜𝐚𝐧 𝐥𝐞𝐚𝐝𝐞𝐫𝐬 𝐫𝐞𝐛𝐮𝐢𝐥𝐝 𝐭𝐫𝐮𝐬𝐭 𝐰𝐡𝐞𝐧 𝐢𝐭’𝐬 𝐥𝐨𝐬𝐭? ✔️ 𝐓𝐮𝐫𝐧 𝐏𝐫𝐢𝐯𝐚𝐜𝐲 𝐢𝐧𝐭𝐨 𝐄𝐦𝐩𝐨𝐰𝐞𝐫𝐦𝐞𝐧𝐭: Privacy isn’t just about compliance. It’s about empowering customers to own their data. When people feel in control, they trust more. ✔️ 𝐏𝐫𝐨𝐚𝐜𝐭𝐢𝐯𝐞𝐥𝐲 𝐏𝐫𝐨𝐭𝐞𝐜𝐭 𝐏𝐫𝐢𝐯𝐚𝐜𝐲: AI can do more than process data, it can safeguard it. Predictive privacy models can spot risks before they become problems, demonstrating your commitment to trust and innovation. ✔️ 𝐋𝐞𝐚𝐝 𝐰𝐢𝐭𝐡 𝐄𝐭𝐡𝐢𝐜𝐬, 𝐍𝐨𝐭 𝐉𝐮𝐬𝐭 𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞: Collaborate with peers, regulators, and even competitors to set new privacy standards. Customers notice when you lead the charge for their protection. ✔️ 𝐃𝐞𝐬𝐢𝐠𝐧 𝐟𝐨𝐫 𝐀𝐧𝐨𝐧𝐲𝐦𝐢𝐭𝐲: Techniques like differential privacy ensure sensitive data remains safe while enabling innovation. Your customers shouldn’t have to trade their privacy for progress. Trust is fragile, but it’s also resilient when leaders take responsibility. AI without trust isn’t just limited - it’s destined to fail. 𝐇𝐨𝐰 𝐰𝐨𝐮𝐥𝐝 𝐲𝐨𝐮 𝐫𝐞𝐠𝐚𝐢𝐧 𝐭𝐫𝐮𝐬𝐭 𝐢𝐧 𝐭𝐡𝐢𝐬 𝐬𝐢𝐭𝐮𝐚𝐭𝐢𝐨𝐧? 𝐋𝐞𝐭’𝐬 𝐬𝐡𝐚𝐫𝐞 𝐚𝐧𝐝 𝐢𝐧𝐬𝐩𝐢𝐫𝐞 𝐞𝐚𝐜𝐡 𝐨𝐭𝐡𝐞𝐫 👇 #AI #DataPrivacy #Leadership #CustomerTrust #Ethics

$632,500 for making consumer privacy rights too difficult to exercise. That’s the fine Honda received from the California Privacy Protection Agency (CPPA). It’s a wake-up call for companies still treating privacy rights as a checkbox exercise. It’s also something I’ve seen repeatedly in privacy assessments - companies making it unreasonably difficult for consumers to exercise their privacy rights. Here are some areas regulators flagged: ❗ Requiring up to 8 fields of information just to opt out (excessive!) ❗ Creating a convoluted submission process for privacy rights requests ❗ Consumers had to directly confirm they authorized an agent to submit a request to opt out of sale/sharing or request to limit (illegal under CCPA) ❗ Failing to train employees handling privacy requests ❗ Ignoring Global Privacy Control (GPC) signals ❗ Creating multiple steps to opt out while enabling one-click opt ins ❗ Sharing data with vendors without proper documentation The lesson? Privacy rights must be PRACTICALLY accessible, not just technically available. Is your company vulnerable to similar issues? Ask: ✅ Can consumers opt out in 2 steps or fewer? ✅ Does your site recognize GPC signals? ✅ Do you have contracts with all vendors covering CCPA obligations? ✅ Is your team trained to process all types of privacy requests? ✅ Is opting out just as simple as opting in? I'm seeing regulators across states increasingly focus on the how, not just the what of privacy compliance. The days of hiding opt-out buttons or creating friction-filled privacy request processes are over. Make it easier for people to exercise their privacy rights. What's been your experience with consumer privacy rights implementations? Have you seen examples of companies doing this particularly well (or poorly)? Read more about the critical compliance areas companies should review in my latest article for the IAPP: https://lnkd.in/e4aH7Qna

What does privacy mean in the age of AI? In this month’s Dean’s Call, I speak with IESE Business School Prof. Tawfiq Alashoor about data privacy risks and why it is becoming increasingly critical as organizations rely more on data and AI. As Tawfiq explains, data privacy should concern all of us. We are all constant generators of data, and today’s technologies allow organizations to capture, process and create value from it at an unprecedented scale. This raises important questions about ownership, responsibility and protection. My takeaways: - Being compliant is not the same as being secure. - Most privacy and security risks do not come from technology, but from human behavior. Not everything needs to be shared, and we all must learn to assess the risks and benefits before disclosing information. - Privacy decisions are often the starting point of broader security risks. Recent developments show how easily vulnerabilities can emerge when data is exposed. As AI continues to evolve, managing privacy is not just about systems and controls, but about how each of us understands and handles the data we create.

🧭 The role of the Data Protection Officer (DPO) is undergoing a profound transformation. Once viewed primarily as a compliance steward for the General Data Protection Regulation (#GDPR), the DPO is now emerging as a central #architect of digital governance. This evolution is driven by the convergence of multiple EU regulatory frameworks: namely the #NIS2 Directive, the Digital Operational Resilience Act (#DORA), and the #AIAct, just to name the most relevant, and each introducing new layers of accountability, risk management, data governance and ethical oversight. Together, these instruments form a complex regulatory ecosystem that demands a multidisciplinary approach. The modern DPOs are no longer just legal compliance officers, they now operate at the dynamic crossroads of #law, #cybersecurity, operational #resilience, and AI #ethics. As digital ecosystems grow more complex, the DPO is evolving into a true #DataProtectionEngineer, equipped not only to interpret regulations but to architect privacy-aware systems. 📌This role demands a deep understanding of how emerging technologies such as AI, #IoT, #cloudinfrastructure, which affect the fundamental rights and freedoms of individuals. It’s not just about safeguarding data; it’s about safeguarding dignity, autonomy, and #trust in the digital age. ⚠️ Key Challenges for Organisations As regulatory expectations intensify, organisations face a series of strategic and operational hurdles that underscore the importance of a well-educated and experienced DPO. 1️⃣ Regulatory Fragmentation and Overlap Multiple frameworks introduce overlapping obligations, definitions, and enforcement mechanisms. Without centralised coordination, organisations risk inconsistent compliance and exposure to regulatory sanctions. The DPO serves as the 'central figure' for harmonising these requirements across legal, technical, and operational domains. 2️⃣Accountability and Demonstrable Compliance Supervisory authorities increasingly demand evidence-based compliance. Organisations must maintain detailed records of data flows, AI development processes, and incident responses. The DPO must champion a culture of #accountability, supported by robust governance structures and documentation protocols. 3️⃣ Technical and Organisational Complexity DORA mandates rigorous digital resilience testing and ICT risk assessments. The AI Act imposes strict data quality, explainability, and human oversight requirements. These obligations require cross-functional collaboration and significant investment in infrastructure, training, and tooling. At the end of the day, the DPO must act as a change agent, fostering alignment between compliance, innovation, and business objectives. The challenge is formidable, but so is the opportunity to redefine the role as a cornerstone of ethical, secure, and forward-looking digital governance.

Most new privacy professionals with fresh CIPP certifications are unprepared for this conversation "We want to track what customers look at on our website and send them targeted emails about those products. That’s fine since they’re already our customers, right?" You know the legal framework. You understand GDPR. You passed your certification. But now you're facing a room of marketing stakeholders who need answers that help them do their jobs. Knowledge tells you: This involves processing personal data for marketing - need to check lawful basis, likely legitimate interests with balance test, plus consider ePrivacy rules for tracking. Judgment asks: Does this specific use case make sense? → What exactly are they tracking? Page views or detailed behavior? → What does “personalization” mean here, recommendations or aggressive targeting? → What did customers expect when signing up? → Can they easily opt out? → Is this helpful to the customer or just to marketing? The legal answer is the same. The practical approach varies completely. This gap isn’t discussed enough in privacy education. We learn the "what" and "why" in certification programs, but day-to-day privacy work is all about the "when" and "how." → When to push back vs. find creative workarounds → How to get buy-in without a budget or authority → When "perfect" compliance isn’t realistic—and what to do instead → How to speak business language while holding privacy lines Many privacy professionals struggle here because we're: → Waiting for perfect info before acting → Speaking only in compliance terms → Afraid to make the wrong call and get blamed But here’s the reality: Judgment comes from experience and imperfect action beats perfect paralysis. The most effective privacy professionals aren’t those who memorize every regulation. They’re the ones who navigate gray areas and keep the business moving. Real examples of knowledge vs. judgment: → The Marketing Automation Dilemma Knowledge: Needs lawful basis, tracking consent, LI balancing test Judgment: Start with product category suggestions, include opt-out, test customer response before expanding → The Vendor Assessment Crisis Knowledge: DPA + security questionnaire needed Judgment: Vendor handles minimal data, go live now with essentials, full review in parallel → The Data Retention Debate Knowledge: Delete data when no longer needed Judgment: Tier retention by sensitivity/business value with review points, not a one-size policy Certifications teach you to spot problems. Experience teaches you to solve them. What’s the biggest gap you’ve faced between privacy theory and real-world practice? P.S. If you’re feeling this tension, you’re right on track. This isn’t a flaw in your education. It’s the start of real expertise. The most effective privacy professionals I know all went through this same shift.