New York City Adopts Final Rules on Automated Employment Decision Tools

The New York City Department of Consumer and Worker Protection has adopted rules to implement the New York City law from 2021 regarding automated employment decision tools (“AEDT”). This first-of-its-kind municipal law prohibits private and public-sector employers and employment agencies in New York City from using an automated employment decision tool unless the tool has been subject to a bias ...

China Publishes Regulatory Policy for Artificial Intelligence Services

China’s Cyber Administration published for public comments a draft of administrative measures for artificial intelligence (AI) services. This is a plan aimed at regulating AI services provided to the public in China, across a wide range of areas such as privacy protection, prevention of discrimination, bias control, content management, security, algorithmic transparency, etc. It applies to all research, development, and ...

California Formally Adopts New Privacy Rules; Three New States in the U.S. Nearly Finalize Privacy Laws

Following a rulemaking process that began in mid-2022, the California Office of Administrative Law has formally approved the California Privacy Protection Agency’s regulations implementing portions of the California Privacy Rights Act of 2020 (CPRA). The new rules are effective immediately, but enforcement of various elements of the new rules will not begin until July 1, 2023.

The new regulations include ...

The European Union Coordinates Action Against ChatGPT

The European Data Protection Board (EDPB) has announced the establishment of a dedicated task force for ChatGPT. Some see this as the EU’s first step towards creating a comprehensive privacy policy on artificial intelligence. The purpose of the task force is to promote cooperation and information sharing regarding enforcement action by data protection authorities of the member states of the ...

Arkansas Follows Utah in Legislation Restricting Social Media Accounts for Minors

A new law in the State of Arkansas, set to come into effect on September 1, 2023, requires social network operators to verify the age of users. If the user is a minor under the age of 18, they are not allowed to open an account without explicit consent from their parents. Arkansas is now the second state to restrict ...

EU Announces the First Batch of Companies Regulated under the Digital Service Act

The European Commission has adopted the first designation decisions under the Digital Services Act (DSA), which aims to enhance consumer rights and protections in the digital world and increase legal certainty, fairness, and harmonization of the rules that apply to digital service providers. The EU Commission designated 17 Very Large Online Platforms (VLOPs), including YouTube, Amazon store, Alibaba/AliExpress, Google Play, ...

U.S. Government Proposes New Rules to Protect Privacy of Women Seeking Reproductive Healthcare

The U.S. Department of Health and Human Services is proposing amendments to the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA), to limit healthcare providers from disclosing medical information related to abortion and pregnancy at the request or demand of law enforcement agencies. The proposed amendments would prohibit the use or disclosure of medical information by healthcare ...

China Publishes Uniform Contract for Cross-Border Data Transfers

The head of China’s Cyberspace Administration (CAC) announced the completion of the uniform contract for transferring information from China. The contract will serve as the basis for organizations in the country desiring to export the personal data of Chinese residents for processing by organizations outside of China. Organizations are required to adopt the contract in its entirety, and it is ...