Data & Privacy Matters: Legal Updates – August 2024

First up the team discusses the EU AI Act coming into force on the 2^nd August 2024 and how further provisions of the Act will gradually come into force over the next 6 to 36 months. For more information about the EU AI Act, do check out the Fieldfisher blog and more detailed webinars on this topic. In addition to this, the team discuss the latest ICO consultation in relation to generative AI. The fifth consultation launched by the ICO, is attempting to review any risks and help organisations and members of the public to benefit from generative AI in a responsible way. The consultation will examine the roles and responsibilities in the generative AI supply chain and provides a non-exhaustive list of scenarios of processing activities.

The Government's latest research project with the Department for Science, Innovation and Technology, is then discussed, followed by an update on the ICO placing 11 social media and video sharing platforms on notice to improve their children's privacy practices. The ICO has identified areas using its Age Appropriate Design Code and requested information from the social media and video sharing platforms in order to explain their approach and ensure compliance with the code. Continuing with the ICO, the team then explore the new second generation privacy notice generator which was launched by the ICO on the 20^th August. The generator is designed to ease the transparency compliance burden for small to medium businesses.

To bring the jam-packed episode to a close, the team also touch on the review of ICO fees, a €290 million fine issued to Uber and a £6 million provisional fine against a software provider following a ransomware attack in August 2022 which disrupted the NHS and social care services.

Whilst many of our listeners will have enjoyed a well-deserved break, summer 2024 has seen numerous data protection developments and this episode is a must-listen podcast to catch up on the latest data and privacy news ready for your return to the office.

Sources of the news discussed:

EU AI Act

• AI Act: Have Your Say on Trustworthy General-Purpose AI | Shaping Europe’s digital future (europa.eu)

ICO News

• ICO 5^th consultation - Generative AI fifth call for evidence: allocating controllership across the generative AI supply chain | ICO
• Poor children's privacy practices - Social media and video sharing platforms put on notice over poor children’s privacy practices | ICO
• Privacy notice creator - New tool helps small businesses create privacy notices | ICO
• Review of ICO fees - Data protection fee regime: proposed changes - GOV.UK (www.gov.uk)
• Fieldfisher webinars and blogs - Data and Privacy | Fieldfisher
• Parent and pupil research - Research on parent and pupil attitudes towards the use of AI in education - GOV.UK (www.gov.uk)

Enforcement

• Provisional decision to impose £6m fine on software provider following 2022 ransomware attack that disrupted NHS and social care services | ICO
• Dutch DPA imposes a fine of 290 million euro on Uber because of transfers of drivers' data to the US | Autoriteit Persoonsgegevens
• Action taken against Labour Party for failing to respond to requests for personal information on time | ICO
• Newsletter of 9 August 2024 - Oncological oblivion, from the Italian Data Protection Authority... - Italian Data Protection Authority (garanteprivacy.it)