Category: Uncategorized

News

NYC’s school board is delaying a vote on a proposal regulating how the Education Department “collects, stores, and shares private student data, including names, emails, phone numbers, home addresses, and birth dates” in light concern related to a second Trump presidential term.

Democratic Senators are discussing how Trump “cannot ignore law requiring ByteDance to divest TikTok by next year”.

The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) issued an alert to help financial institutions identify fraud schemes associated with the use of deepfake media created with generative artificial intelligence (GenAI) tools. Servinj Norvuoza wrote an article expanding on the impact of this.

DOJ is working on enforcing the court decision for Google to sell “Chrome”.

There is growing concern that NHS patients are dying because of “problems sharing medical records” according to coroners in the UK and Wales.

Events

The spring semester PRG will begin on Wednesday, January 29, 2025, the second Wednesday of the semester. 

(Compiled by Student Fellow Molly Pushner)

News

A U.S. District Court in San Francisco dismissed without prejudice a lawsuit claiming that Meta “misled shareholders in [its] proxy statement about their ability to ensure the safety of children who use Facebook and Instagram.” The judge noted that the plaintiffs failed to show that these disclosures lead to economic losses for shareholders. Meta, however, still must deal with a bevy of other suits centering on children’s safety concerns. To wit, a Suffolk County Superior Court judge held that Meta had to stand trial in a case filed by the Massachusetts Attorney General’s Office concerning allegations that the company lied about the dangers its products present to teenagers’ mental health and purposefully instituted features meant to increase addiction to its platforms. Meta argued that it was immune from liability under Section 230 of the Communications Act, but the judge held that the Act applied neither to false claims nor to a business’ own design choices. 

X recently revised its privacy policies to, among other changes, incorporate a provision telling users that, unless they opt out, third party companies may scrape their data to train AI models. X also adjusted provisions on data retention, telling users that their different types of user content may be kept for different periods of time, “in order to provide [users] with our products and services, to comply with our legal requirements and for safety and security reasons.” 

CFPB finalized a rule covering the rights that consumers have over their personal financial data. The rule mandates that certain financial entities, including banks and credit card companies, transfer consumer data at the request of the consumer for free. Furthermore, the rule’s privacy provisions require that companies may only use consumer data in ways authorized by the consumer. The Bureau envisions that this rule will facilitate greater consumer choice and provide users with greater control over their financial data. 

The Massachusetts Supreme Court has agreed to hear Commonwealth v. Govan, a case involving a defendant subject to pretrial monitoring in which law enforcement used data collected from such monitoring in an unrelated case. The case implicates the right to privacy in one’s location data and the extent of pretrial protections for defendants, among other state and 4th Amendment privacy issues. 

A Florida teenager died by suicide following months spent speaking with chatbots generated by Character.AI, an app that allows users to create A.I.-generated characters and chat with them or bots generated by other users. The teenager’s mother has sued the company, arguing that it was responsible for her son’s death. The incident comes amid growing fears that technology is contributing to adolescent mental health struggles and that unregulated A.I. may exacerbate the issue. 

The California Civil Rights Department proposed adjustments to its hiring discrimination rules that account for employers relying on A.I. technology in their hiring processes. Notably, following industry pushback, the revised rules would reduce liability for third parties that create these tools. 
The American Law Institute will launch a Principles of the Law project for Artificial Intelligence to be led by NYU Law Professor Mark Geistfeld. The project, which will be directed to legislatures, private actors, administrators, and courts, will focus solely on physical harms. ALI noted that other types of harm will be addressed in forthcoming Principles projects, but may revisit the scope of the project to determine if a more comprehensive approach is more appropriate.

(Compiled by Student Fellow Shreyas Iyer)

News

Book recommendation: The Right to Oblivion – Privacy and the Good Life by Lowry Pressly.
In this book, Pressly argues that even though the hardship our modern technological reality, we still can and should strive for privacy. Pressly offers a new perspective on the right to privacy – not just a right to be protected but a tool for making life meaningful. Pressly presents the right to privacy as essential for agency, trust, self-discovery, and deeper relationships.

Play recommendation: McNEAL
McNeal is a Broadway play by Ayad Akhtar, starring Robert Downey Jr. Downey plays Jacob McNeal, a celebrated writer who discovers on the same day that he won the Nobel Prize, and that he is terminally ill. The play explores McNeal’s fascination with artificial intelligence, his strained relationship with his son, and the ethical challenges of artistic creation and AI’s role in art. ​

The U.S. Federal Trade Commission’s tentative settlement in the Marriott-Starwood data breach case, announced on October 9, 2024, introduces a new “right to be forgotten” provision. This is the first time the FTC has required a company to offer customers a link to request deletion of personal data tied to an email or loyalty rewards number, even if the data still serves a purpose. This 20-year obligation builds on the FTC’s recent focus on data minimization, seen in past settlements with Chegg, Drizly, and InMarket Media. While similar rights are already mandated by California’s Consumer Privacy Act and the EU’s GDPR, this settlement is notable as it marks the first time such a requirement has been imposed by a U.S. federal agency in the realm of cybersecurity.

The Oklahoma City Council approved $856,000 to purchase 50 new drones for police and fire departments, raising privacy concerns from some council members. The funds will be allocated over five years, adding to the 38 drones already in use. Police and fire officials emphasized the safety benefits of drones, due to their ability to provide real-time situational awareness to the forces before arriving to the scene of hazard. However, some councilors questioned the lack of clear policies on drone deployment and data usage, raising civil liberties concerns.

The genetic testing company 23andMe is facing bankruptcy due to, among other reasons, a drop in the number of test kits being ordered. This decline followed a data breach last year that targeted Jewish and Chinese customers. According to the company’s transparency report, under its current management, the company refused to provide DNA data to authorities in 15 cases. Its current status raises questions such as: would the company be required to change its privacy policy for financial reasons? What will happen to the DNA data if the company is sold to a different entity, and who would that be? Should there be governmental intervention to prevent a sale to a foreign actor?

This adds to other DNA privacy news: a class action has been filed against another DNA testing platform, Nebula Genomics, accusing the company of sharing customers’ genetic information with Meta Platforms Inc., Microsoft Corp., and Google LLC without users’ knowledge or consent.

(Compiled by Student Fellow Nofar Kadosh)

News

Thirteen states and the District of Columbia sued TikTok on October 8th, accusing the company of violating their consumer protection laws by creating an intentionally addictive app that harmed children and teenagers. They said that the company had designed features to prompt heavy, compulsive use of TikTok and that many children were using the app late at night when they would otherwise have been asleep. TikTok said that it strongly disagreed with the claims in the lawsuits and that it provided “robust” safeguards for young users. The action is similar to a set of lawsuits that states brought against Meta in the last year.

In a similar manner, the Korea Communications Commission prepared to launch an investigation into possible violations of Korea’s personal data protection law by TikTok. The company is accused of not giving users the option to opt out from receiving various promotional materials and not allowing new users to review the full terms and conditions when they sign on.

The U.S. Justice Department on Tuesday set out the changes it would like to see at Google after a federal district court judge ruled in August that the company was guilty of antitrust abuses in the search and search-advertising markets. The department’s suggested fixes would deprive Google of some of the data that it normally draws on when delivering AI-powered search results. The first suggestion involved allowing websites to opt out from having data compiled by Google’s web crawlers used in any of its AI products. The DOJ also proposed prohibiting Google from “using contracts or other practices to undermine rivals’ access to web content.”

Brazil’s National Telecommunications Agency sent orders to service providers to unblock X, formerly Twitter, ending a five-week ban of the social media company. This follows the Brazilian Supreme Court allowing X to resume activities in the country after determining that it “met all the necessary requirements to return.” The company was banned due to failing to designate a new legal representative in the country.

An independent candidate running for Virginia’s 8th congressional district has challenged the Democratic incumbent to a debate, and prepared an AI chatbot to stand in for the incumbent in case he refuses. Bentley Hensel said he was frustrated by Don Beyer’s refusal to appear for additional debates, and has trained an AI called DonBot on Beyer’s official websites, press releases, and data from the Federal Election Commission. Hensel also plans to create an AI version of the Republican candidate, Jerry Torres as well, should he refuse to debate. Beyer’s spokeswoman did not address whether his campaign would try to prevent the debate from happening beyond saying he had no plans to participate.

John J. Hopfield and Geoffrey E. Hinton received the Nobel Prize in Physics on October 8th for work in the late 1970s and early 1980s on machine learning that uses artificial neural networks, providing the building blocks for developments in artificial intelligence. In a call during the Nobel announcement, Dr. Hinton expressed worries over machine learning and said it would have an extraordinary influence on society, extolling its improvements to productivity while considering potential bad consequences. In a news conference on the same day, Dr. Hopfield compared advances in A.I. with the splitting of the atom.

Lowry Pressly, a professor of political science at Stanford, has released a new book entitled “The Right to Oblivion: Privacy and the Good Life,” in which he posits an “ideology of information.” According to Pressly, this is a fundamental “idea that information has a natural existence in human affairs, and that there are no aspects of human life which cannot be translated somehow into data.” This ideology, in Pressly’s view, informs the purpose of privacy, which is to prevent the creation of information. The book’s title is reflective of the dichotomy between privacy and information; to the author, “Oblivion” refers to an opaque realm which disappears once information is created. Pressly maintains that Oblivion provides a restorative refuge for the mind, and is essential for human dignity.

(Compiled by Student Fellow Jerome David)

News

California has passed a bill mandating car manufacturer and vehicle connected services providers to develop software allowing drivers of vehicles to be notified and given the option to disable any person outside the vehicle trying to access their vehicle location. The legislation comes on the heels of news reports about abusers using connected cars to stalk their victims, highlighting victim’s inability to obtain efficient redressal.

The much debated Safe and Secure Innovation for Frontier Artificial Intelligence Models Act has been passed by the California State Assembly. The Act seeks to guard against proliferation of deepfakes and similar other AI misuses. It requires developers to implement precautions before they train a sophisticated AI model such as implementing the capability to enact a full shutdown promptly, implementing and preserving a written safety and security protocol, etc.

Neural data, i.e., data relating to the activity of the brain, is now classified as sensitive personal information under the California Consumer Privacy Act (CCPA). On September 30, 2024, the CCPA was amended to extend the protective umbrella of ‘sensitive personal information’, to information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from non-neural information. The amendment is effective immediately.

In a development that preserves childrens’ privacy as to sexual orientation, California governor has signed a bill prohibiting schools from outing transgender and gay students to their parents. The law overrides existing school board policies throughout the State which require staff to inform parents if their child starts using a name or pronoun that doesn’t match their sex assigned at birth.

(Compiled by Student Fellow Nirali Sanghavi)

News

Californians can now add their driver’s licenses and state IDs to their digital wallets on both
Apple and Android devices. Other states – including Louisiana and Colorado – have rolled out
their own digital IDs that can be used during traffic stops and other police interactions. Showing
these IDs may waive privacy protections in interactions with law enforcement.

LinkedIn revealed that it had been training its AI model on user data. Under its new privacy
policy, LinkedIn now informs users that “we may use your personal data… [to] develop and train
artificial intelligence (AI) models, develop, provide, and personalize our Services, and gain
insights with the help of AI, automated systems, and inferences, so that our Services can be more
relevant and useful to you and others.” Users can opt-out of future data collection, but not
remove their information from past training datasets.

Meta will not voluntarily join the EU’s AI Pact, a temporary measure before the AI Act comes
into force in 2026.

Telegram has tweaked its policies to be able to share more data with government authorities, in a
reversal of longstanding policy

The US Commission on Civil Rights issued a report on the civil rights implications of the federal
use of Facial Recognition Technology. The report identified that there are no laws that expressly
regulate the use of FRT or other AI by the federal government, and no constitutional provisions
governing its use.

(Compiled by Student Fellow Anthony Perrins)

News

A study found that drivers are more likely to be distracted while using partial automation tech.

OpenAI’s safety committee announced it will oversee security practices as an independent body.

Instagram announced new privacy and parental controls for Instagram accounts of users under 18. It will port certain Instagram accounts to private by default “Teen Accounts”.

A Politico piece describes how Andrew Kingman, outside counsel for the State Privacy and Security Coalition, has played a key role in shaping business-friendly data privacy laws across numerous states by lobbying against stricter regulations and promoting industry-favorable provisions.

Exploding devices modified by Israel somewhere along the supply chain during manufacture or transit raise questions about the security of hardware.

Events 

Kate Crawford’s and Vladan Joler’s MoMA exhibit Anatomy of an AI System “analyzes the vast networks that underpin the “birth, life, and death” of a single Amazon Echo smart speaker, painstakingly compiling and condensing this huge volume of information into a detailed high-resolution diagram.” 

The Privacy Research Group will be hosting the event “Surveillance, Geofence Warrants, and the Fourth Amendment: Recent Developments” in Furman Hall Room 120 from 1:30 to 2:30 pm on Tuesday, September 24th (in-person only). You can RSVP here. It’ll include a lecture by Albert Fox Cahn, a Q&A, and snacks & coffee. 

On October 1, 2024, the AI(M) for the Future will feature six sessions, with options for both in-person and online attendance. Register here.

The Engelberg Center has several events at NYU in the next week: a book launch event for the book Feminist Cyberlaw next Monday and a conference on the Hatch-Waxman Act next Thursday and Friday.

(Compiled by Student Fellow Rebecca Kahn)

News

The California Privacy Protection Agency issues a bulletin advising businesses to implement strong data minimization principles, including when processing consumer requests under the CCPA itself. [April 2]

Google settles a class action lawsuit alleging it illegally stored data about users’ “incognito” browsing by agreeing to destroy billions of records and alter its tracking policies moving forward. [April 1]

OpenAI announces — but does not release — a new “Voice Engine” model which can recreate a person’s voice based on only 15 seconds of audio. [March 29]

OMB announces new guidance for federal agencies using AI, requiring agencies that cannot implement certain mandatory evaluation and monitoring safeguards by December 2024 to cease using AI systems until they can comply.

The European Court of Justice rejects a request from Amazon to temporarily suspend the application of the Digital Services Act while the company litigates whether or not it is a “very large online platform” subject to the Act’s heightened requirements. [March 27]

The Department of Justice and 16 states sue Apple for restricting competition by, among other things, artificially constraining messaging features between iPhones and Android devices and preventing third party developers from competing with Apple’s tap-to-pay digital wallet feature. [March 21]

(Compiled by Student Fellow Micah Musser)

News

Florida signed into law a social media ban for minors 13 and under, with 14-15 needing parental consent

Portugal’s data regulator has ordered Worldcoin to stop collecting biometric data for 90 days, given concerns about unauthorized data collection from minors, as well as Worldcoin’s lack of consent or data deletion mechanism.

The NTIA finishes up its public comment period on open-source AI models on 3/29.

The FTC opened a new investigation into TikTok into alleged unfair and deceptive business practices as well as violations of the Children’s Online Privacy Protection Act.

A man in Montana pleaded guilty earlier this month to wildlife trafficking charges as part of an effort to create cloned giant sheep hybrids.

In its investigation of the 2020 SolarWinds cyberattack, the SEC is asking technology and telecom companies for internal communications as to how they handled the hack, prompting business pushback.

Events

Professor Strandburg is speaking on a panel as part of the Journal of Law & Business’s spring symposium, Artificial Intelligence and Antitrust: Global Regulatory Changes, from 6-8pm on 4/3.

(Compiled by Student Fellow Stephanie Chen)

News

The House of Representatives will be performing a Full Committee markup of H.R. 7521, the Protecting Americans’ Data from Foreign Adversaries Act on March 7, 2024. This is a response to privacy concerns in national security with sensitive data, including health data, about Americans traveling abroad being collected and sold, particularly to foreign adversaries. President Biden issued an Executive Order last week discussing steps being taken to protect Americans’ sensitive data from exploitation by foreign adversaries, including genetic and biometric information.

The National Institute of Standards and Technology, responsible for promoting innovation and new technologies in the US, is struggling with funding. The agency is unable to do foundational work because it is so underfunded. President Biden’s AI Executive Order rests heavily on the NIST to oversee AI models and the data privacy and security of such models. The Washington Post article describes the NIST building as absolute decay, with black mold forcing an evacuation, leaks, and struggling technology.

A bill introduced in Florida banning all minors under the age of 16, with or without parental consent, from addictive social media platforms was vetoed by Governor Ron DeSantis. Governor DeSantis previously seemed on board with the bill, having concerns about privacy for minors. Governor DeSantis is now believed to support a bill that would ban access for younger minors but allow access, with parental consent, for minors 14 and older.

Google and Reddit came to an agreement allowing Google to use Reddit posts to train its AI in addition to other services. Reddit is then allowed to use Google’s AI model for its own site improvement. The $60 million deal set a precedent for tech companies to obtain data for AI models in the future. As part of the deal, Google must comply with Reddit’s privacy policy and fully delete data once a user has deleted a post, not allowing Google to keep shadow data.

Germany is amending its Federal Data Protection Act. The amendment draft institutionalizes the German Data Protection Conference and aims to improve data protection law enforcement. The German press release states that there will additionally be legal certainty for consumer protective scoring, which has been developed with the Federal Ministry for the Environment and Consumer Protection.

(Compiled by Student Fellow Paulina Andrews)