IAPP Asia Pacific Dashboard Digest https://iapp.org/news/asia-pacific-dashboard-digest/ Asia Pacific Dashboard Digest - Your source for the most important privacy and data protection news from Asia and Australia-New Zealand. The key elements for understanding marketing privacy https://iapp.org/news/a/the-key-elements-for-understanding-marketing-privacy https://iapp.org/news/a/the-key-elements-for-understanding-marketing-privacy As data protection laws increase in complexity, "marketers must navigate this changing terrain with agility," Lime Legal founder Lisette Meij, CIPP/A, CIPP/E, CIPP/US, CIPM, CIPT, FIP, and Uplevel founder and Principal Raashee Gupta Erry, CIPP/US, CIPM, write. They said overlooked compliance areas include website modifications and legally integrating new clients and vendors. They also recommended privacy professionals better collaborate with marketing teams by looking at "legal requirements with a creative eye."
Full story

]]>
2024-03-18 11:44:49
IAB releases State of Data 2024 report https://iapp.org/news/a/iab-releases-its-state-of-data-2024-report https://iapp.org/news/a/iab-releases-its-state-of-data-2024-report IAB released its State of Data 2024 report to assess "privacy compliance and sustainable, consumer-friendly strategies." The report claimed the digital advertising industry is not prepared for data privacy changes after 82% of surveyed advertisers said the structure of their organizations have been impacted by legislation and user-tracking signal loss.
Full story

]]>
2024-03-15 11:40:03
Council of Europe finalizes AI framework https://iapp.org/news/a/coe-finalizes-ai-framework https://iapp.org/news/a/coe-finalizes-ai-framework The Council of Europe Committee on Artificial Intelligence completed the Artificial Intelligence, Human Rights, Democracy and the Rule of Law Framework Convention. "While this treaty has been elaborated by the Council of Europe with like-minded international partners, it will be a global instrument, open to the world," Council Secretary General Marija Pejčinović Burić said. Editor's note: Explore the IAPP AI Governance Center and subscribe to the AI Governance Dashboard.
Full story

]]>
2024-03-15 11:39:21
Notes from the Asia-Pacific region, 15 March 2024 https://iapp.org/news/a/notes-from-the-asia-pacific-region-15-march-2024 https://iapp.org/news/a/notes-from-the-asia-pacific-region-15-march-2024 Hi privacy pros. Greetings from Beijing.

I know many of you are thrilled about the European Parliament's 13 March passage of the groundbreaking Artificial Intelligence Act. In light of this exciting development, I'd like to highlight some significant AI developments in greater China.

On 7 March, the National Information Security Standardization Technical Committee of China issued the Basic Security Requirements for Generative AI Services. These guidelines offer some clarity and guidance for implementing China's regulations for AI-generated content issued in August 2023.

The TC260-003 AI requirements include detailed provisions covering security and accuracy of training data, large language model security, content monitoring, algorithm transparency and nondiscrimination, privacy and intellectual property protection, and responsibility and accountability expected for developers and service providers of AI-generated content. Although not legally binding, these requirements can serve as best practices and references for regulators enforcing the AI-generated content regulations.

In a significant legal development, the Guangzhou Internet Court of China recently ruled on a copyright infringement case involving generative AI service providers. The court found a company had used AI technology to create images resembling the iconic science fiction character "Ultraman" without proper authorization, violating the copyright holder's rights to reproduction and adaption. Additionally, the AI company failed to comply with statutory obligations under the AI-generated content regulations. The court ordered the cessation of infringement activities and compensation for damages. Notably, the damages awarded were mild at RMB10,000, reflecting the court's recognition of the nascent stage of AI-generated content technology and the need to balance rights protection with technological innovation and development.

In Hong Kong, the Office of the Privacy Commissioner for Personal Data recently completed compliance checks on 28 local organizations regarding their practices related to personal data collection, use, and processing in AI development or usage, as well as their AI governance structures. These checks covered various industries, including telecommunications, finance and insurance, retail, transportation, education, and government departments. According to the PCPD's findings, the majority of the organizations assessed have integrated AI into their day-to-day operations, established internal AI governance frameworks, conducted privacy impact assessments prior to the development or use of AI products and services, and implemented proper security measures, indicating a growing trend of AI deployment across public and private sectors to enhance operational efficiency.

The IAPP Global Privacy Summit 2024 in Washington, D.C., is just three weeks away. Can't wait to catch up with privacy pros around the world and exchange ideas in this rapidly changing data and privacy landscape.

Hope you have enjoyed this note. Until next time.

]]>
2024-03-14 13:45:04
NZ privacy commissioner discusses AI's privacy concerns https://iapp.org/news/a/nz-privacy-commissioner-discusses-ais-privacy-concerns https://iapp.org/news/a/nz-privacy-commissioner-discusses-ais-privacy-concerns In an interview with Voxy, New Zealand Privacy Commissioner Michael Webster discussed what AI privacy concerns his office is focused on. He noted the Privacy Act applies to data-driven AI tools and businesses are obligated "to make sure you're operating within the Privacy Act, including protecting the information you hold."
Full story

]]>
2024-03-14 13:10:14
Large language models present privacy risks https://iapp.org/news/a/large-language-models-present https://iapp.org/news/a/large-language-models-present The use of large language models is creating data privacy issues because they tend to disclose personal information they scrape from the internet without the consent of the data subject, Axios reports. Artificial intelligence data leaks come in many forms, such as an accidental disclosure or through malicious actions like building a model that circumvents privacy controls. Editor's note: Explore the IAPP AI Governance Center and subscribe to the AI Governance Dashboard. 
Full story

]]>
2024-03-14 11:42:41
European Parliament passes landmark AI Act https://iapp.org/news/a/world-sees-first-major-regulatory-framework-with-eu-ai-act-passage https://iapp.org/news/a/world-sees-first-major-regulatory-framework-with-eu-ai-act-passage The EU Artificial Intelligence Act was approved by European Parliament 13 March on a 523-46 vote. Despite the passage, the EU's new rules for AI development and use still have important steps to take before taking full effect. IAPP Staff Writer Caitlin Andrews reports on the detailed regulatory work ahead while exploring various reactions to Parliament's final vote.
Full story

]]>
2024-03-13 11:45:27
US House passes TikTok divesture bill https://iapp.org/news/a/us-house-passes-bill-that-could-ban-tiktok-unless-parent-company-fully-divests-its-ownership https://iapp.org/news/a/us-house-passes-bill-that-could-ban-tiktok-unless-parent-company-fully-divests-its-ownership The U.S. House passed the Protecting Americans from Foreign Adversary Controlled Applications Act, which could potentially ban TikTok in the U.S., NBC News reports. If passed, President Joe Biden would establish a process for the FBI and intelligence agencies to designate certain social media apps as national security threats if found to be controlled by a foreign adversary, unless ties with that entity are severed within 180 days.
Full story

]]>
2024-03-13 11:43:34
Privacy Sandbox faces challenges with competition markets https://iapp.org/news/a/privacy-sandbox-faces-challenges-with-competition-markets https://iapp.org/news/a/privacy-sandbox-faces-challenges-with-competition-markets Google's Privacy Sandbox is facing challenges from competition advocates looking to halt the sandbox due to its current antitrust trials, Digiday reports. "A concern for many is that Google may seek to use the Privacy Sandbox to circumvent the remedies that may be adopted by antitrust authorities in the ad tech cases it faces," Geradin Partners founding Partner Damien Geradin said.
Full story

]]>
2024-03-13 11:41:32
US House to vote on measure requiring TikTok parent to divest itself https://iapp.org/news/a/us-house-anticipated-to-vote-on-measure-requiring-tiktok-parent-to-divest-itself https://iapp.org/news/a/us-house-anticipated-to-vote-on-measure-requiring-tiktok-parent-to-divest-itself The U.S. House is expected to vote on legislation forcing TikTok's Chinese parent company, ByteDance, to relinquish ownership of the app or face a ban in the U.S. within 180 days of passage, The Washington Post reports. The bill would also apply to any company found to be controlled by a foreign adversary and requires an app to provide a download of all data before any operational change. Editor's note: TikTok will participate in an IAPP Global Privacy Summit 2024 breakout session 3 April dedicated to data localization.
Full story

]]>
2024-03-12 11:44:07
Airbnb bans indoor cameras in surveillance policy update https://iapp.org/news/a/airbnb-bans-indoor-cameras-in-surveillance-policy-update https://iapp.org/news/a/airbnb-bans-indoor-cameras-in-surveillance-policy-update Airbnb banned indoor surveillance devices, including cameras and audio recorders, in its rental properties as part of an update to security policies, NPR reports. The policy takes effect 30 April and will include outdoor cameras in places "where there's a greater expectation of privacy."
Full story

]]>
2024-03-12 11:40:44
Australia's new privacy commissioner discusses privacy background, expected focuses https://iapp.org/news/a/australian-privacy-commissioner-talks-about-her-new-role https://iapp.org/news/a/australian-privacy-commissioner-talks-about-her-new-role Australian Privacy Commissioner Carly Kind participated in a Q&A session regarding her appointment at the Office of the Australian Information Commissioner. Kind spoke about her career in privacy and what she hopes to do in her new role, including working to ensure unlawful privacy practices that have become "commonplace" are "properly regulated."
Full story

]]>
2024-03-11 11:42:24
South Korea's PIPC investigating data processing by foreign retailers  https://iapp.org/news/a/pipc-investigating-data-processing-by-foreign-retailers https://iapp.org/news/a/pipc-investigating-data-processing-by-foreign-retailers South Korea's Personal Information Protection Committee announced it is investigating personal data processing activities by foreign retailers. The PIPC aims to "check the adequacy of personal information processing policies, overseas transfers, and safety measure obligations under the Personal Information Protection Act."
Full story

]]>
2024-03-08 11:41:16
Notes from the Asia-Pacific region, 8 March 2024 https://iapp.org/news/a/notes-from-the-asia-pacific-region-8-march-2024 https://iapp.org/news/a/notes-from-the-asia-pacific-region-8-march-2024 Kia ora koutou,

Facial recognition is the "topic du jour" in New Zealand right now, with major supermarket chain Foodstuffs North Island launching a facial recognition technology trial in early February.

Foodstuffs said a 52% increase in retail crime and harmful behaviors, with 4,719 incidents reported across stores in the last quarter of 2023, prompted use of the technology. Foodstuffs hopes implementing facial recognition will reduce incidents while keeping staff and customers safe.

Under the trial, 25 owner-operated stores will test the effectiveness of facial recognition technology. Foodstuffs said all images will be instantly deleted unless an individual "committed a crime, has been aggressive, violent or threatening towards our team members or customers, or has actively assisted in such harmful behaviour." Matches made by the technology will be reviewed by a human. 

This is a trial, rather than a roll-out, since Foodstuffs appropriately engaged early with the Office of the Privacy Commissioner who asked for evidence that facial recognition technology is an effective and justified way to reduce crime in light of significant privacy impacts and risks, including accuracy and bias and proportionality.

Foodstuffs North Island General Counsel Julian Benefield said, "If you're an honest customer coming in, who is not a previous offender, that (image) will be immediately deleted, so those honest customers have nothing to be concerned about. It will only be a match if it is a previous offender." Global evaluations of facial recognition technologies show false matches are more likely to happen for people of color. The OPC was particularly concerned about the impact facial recognition technology would have on Māori, Pasifika, Indian and Asian customers, given the system was not trained on New Zealand's population. So, if you are an "honest customer" of color, then Foodstuff's comments may not provide much reassurance.

While Foodstuffs certainly has a legitimate interest in reducing retail crime and protecting its staff from harm, this must be proportional to the general intrusiveness of facial recognition technology. Privacy Commissioner Michael Webster put it perfectly when he said, "New Zealanders deserve to shop for their milk and bread without having their faces scanned unless it's really justified. We wouldn't accept being fingerprinted and checked at the door before shopping for groceries — that sounds ludicrous — but FRT is a similar biometric process that is faster, machine-run, happens in a nanosecond, and creates a template to compare your face to, now and in the future."

Despite varying views on the merits or risks of facial recognition technology, Foodstuffs approach should be applauded. The supermarket chain willingly engaged with the OPC and has been open and transparent with the public — including taking the commendable step of making its privacy impact assessment on the use of facial recognition technology publicly available. The company has also put real effort into identifying and assessing the risks and committed to producing an independent report on its trial.

The trial comes at an interesting time for the OPC, which is already working on issuing a biometrics code of practice that would regulate the use of biometrics in New Zealand, including facial recognition. There is no doubt the insights gathered during this trial — on the technology's implementation, effectiveness, public reaction and any harms — will usefully feed into the regulatory approach the OPC takes. The insights will also be highly valuable for other organizations considering using facial recognition technology in the future.

Biometrics will certainly be a topic of discussion at the IAPP ANZ Summit 2024 in Melbourne, Australia. The call for proposals is open until 5 May, and we're particularly interested in content on artificial intelligence governance, biometrics, children's privacy, indigenous privacy perspectives and, of course, local regulatory developments. You never know, we might be lucky enough to hear from Foodstuffs about the outcomes of their facial recognition trial.

Ngā mihi.

]]>
2024-03-07 13:49:16
NZ Supreme Court to determine if unauthorized police photos can be used for convictions https://iapp.org/news/a/nz-supreme-court-to-determine-if-unauthorized-police-photos-can-be-used-for-convictions https://iapp.org/news/a/nz-supreme-court-to-determine-if-unauthorized-police-photos-can-be-used-for-convictions Mahia Tamiefuna is aiming to appeal an aggravated robbery charge through the Supreme Court of New Zealand after an "improperly obtained" photo taken by a police officer was used for his conviction, RNZ reports. 
Full story

]]>
2024-03-07 13:15:57
EDPB 'pay or OK' decision implications for Australia https://iapp.org/news/a/edpb-pay-or-ok-decision-implications-for-australia https://iapp.org/news/a/edpb-pay-or-ok-decision-implications-for-australia The European Data Protection Board's pending decision surrounding Meta's "pay or OK" model could set a global industry standard for data collection, Salinger Privacy founder and Principal Anna Johnston, CIPP/E, CIPM, FIP, writes. The EDPB's decision could impact Australia's Privacy Act reform bill, with some concerned "pay or OK" could lead to aggressive data collection methods that "exists to support surveillance-based business models, including online behavioural advertising and data brokering." Editor's note: IAPP Staff Writer Lexie White recapped a LinkedIn Live exploring "pay or OK" implications.
Full story

]]>
2024-03-07 13:15:10
New Zealand's privacy commissioner calls for heavier data privacy fines https://iapp.org/news/a/new-zealand-privacy-commissioner-calls-for-heavier-data-privacy-fines https://iapp.org/news/a/new-zealand-privacy-commissioner-calls-for-heavier-data-privacy-fines New Zealand Privacy Commissioner Michael Webster said he wants steeper fines for data privacy violations, Scoop News reports. The remarks at the National Cyber Security Summit came after two surveys showed the public also believes entities should face stronger penalties for infractions.
Full story

]]>
2024-03-07 11:41:05
Microsoft to integrate Google Privacy Sandbox within advertising services https://iapp.org/news/a/microsoft-to-integrate-google-privacy-sandbox-within-its-advertising-services https://iapp.org/news/a/microsoft-to-integrate-google-privacy-sandbox-within-its-advertising-services Microsoft announced it will incorporate the Google Privacy Sandbox application programming interface within its advertising products, MediaPost reports. Microsoft will use Google's advertising privacy standards to continue to advance "innovation of privacy enhancing technologies to fully support the requirements of digital advertising."
Full story

]]>
2024-03-07 11:40:44
Platform aims to ease global children's privacy compliance for online video game developers https://iapp.org/news/a/platform-looks-to-ease-global-childrens-privacy-compliance-for-online-video-game-developers https://iapp.org/news/a/platform-looks-to-ease-global-childrens-privacy-compliance-for-online-video-game-developers As ensuring children's data privacy becomes a business necessity, the newly launched compliance platform k-ID is attempting to offer a streamlined solution for online video game developers to ease their global regulatory burdens. IAPP Staff Writer Alex LaCasse spoke with two k-ID co-founders CEO Kieran Donovan and Chief Legal Officer Timothy Ma, CIPP/E, CIPM, about how the platform will make children's privacy law compliance more seamless in more than 200 markets around the world.
Full story

]]>
2024-03-06 11:44:55
Study examines reliance on third-party cookies for advertisers https://iapp.org/news/a/study-examines-reliance-on-third-party-cookies-for-advertisers https://iapp.org/news/a/study-examines-reliance-on-third-party-cookies-for-advertisers MediaPost reports a study from 33Across found advertisers still rely primarily on third-party cookies, despite several internet browsers planning to deprecate them in 2024. Retail advertisers have made some shifts, investing 26% of programmatic budgets in alternative cookie technology.
Full story

]]>
2024-03-06 11:42:40