AI is becoming a common theme in new privacy laws

We are pleased to bring you news about Canada’s federal level Bill, the Digital Charter Implementation Act, 2022 which includes three pieces of legislation: the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act. The AI Act has been added after a revision and includes provision for a separate AI Commissioner. The new Privacy Commissioner is due to obtain fining powers following advocacy for this change by his predecessors.

In the UK, AI has been much discussed in the context of the new Data Protection and Digital Information Bill but there will not be – at least for now – a separate AI law, but regulator-led risk assessments and guidance. The EU is on course to adopt its AI Act. But businesses in the EU already have changes ahead of them in terms of the Digital Services Act and the Digital Markets Act.

The DPAs in the EU are trying to speed up GDPR enforcement by introducing novelties to their working methods at the European Data Protection Board. The EDPS is an active participant in the discussions for reforms, and other stakeholders are also voicing their opinions (p.9). The EU Commissioner who was responsible for the GDPR, Věra Jourová, has also been demanding operational changes. But most would agree that it is not sensible to start renegotiating a new GDPR text, as this would take years, and the current Commission’s mandate ends in two years.

The EU - US data transfer framework is said to be making progress. Our correspondents assess how useful the new agreement will be, and what companies can do in the meantime to secure the legal position of data in international data transfers. Standard Contractual Clauses, a well-used tool, are also being introduced in China. Even with their limitations, this is welcome news.

Also in this issue, we bring you an analysis of the draft regulations by the California Privacy Protection Agency implementing the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Laura Linkomies
Editor, Privacy Laws & Business

August 2022