Elaine Call

weekly #privacy updates: the #FTC finalized an order against GM and OnStar over geolocation data, while the #CNIL provided final guidance on multi-device consent. https://lnkd.in/gViBpC-K

7

weekly #privacy updates: California regulations are officially approved, with the first compliance deadline coming January 1, 2026 (including a requirement to display the user's opt-out preference status and whether the GPC is honored); and the ICO issues a statement welcoming Meta's pay or consent model. https://lnkd.in/dQTZykzT

9

“The law introduces new obligations for AI developers, establishes incident reporting mechanisms, creates research initiatives, and provides robust whistleblower protections.” https://lnkd.in/ej3qviAD

3

On Tuesday, In-House Privacy, Inc. submitted both oral and written comments to the California Privacy Protection Agency on the 'Delete Act' Rulemaking. As a recap, the Delete Act and existing regulations define 'data broker' quite broadly, and the proposed regulations incorporate a 'subjective intent' standard that, in my opinion, implicates all third party ad networks including large public companies like Google and The Trade Desk. Our comments include; 1) there should be an explicit exemption for ad/marketing agencies and SaaS platforms that 'make available' 3rd party data as instructed with a client 'service provider' agreement, 2) there should be a 'cure period' for erroneous applications of the 'Accessible Delete Mechanism' (aka; 'DROP'), and 3) the regulations should be simplified to enable small businesses and less technical data brokers to more easily and consistently implement the DROP than the regulations currently indicate. Our full set of comments can be read on our website here; https://lnkd.in/ghj969Tj #databroker #dataprivacy #adtech

15

2 Comments

Just published this Law360 article on what to watch out for when drafting "AI" terms for your vendors. PDF version attached for non-subscribers. https://lnkd.in/eRR_R8wT

52

2 Comments

Our eData Team’s latest LawFlash examines recent decisions shaping how attorney-client privilege and work product protections apply to AI-generated or AI-influenced materials. Read on for an excellent summary of the Heppner case, and an overview of a rapidly expanding area of the law. #eData #wearemorganlewis

9

Concerning that, even with an authoritative dataset and #RAG, LexisNexis and Thomson Reuters' #Westlaw #artificialintelligence systems still hallucinate so much: "the Lexis+ AI and Ask Practical Law AI systems produced incorrect information more than 17% of the time, while Westlaw’s AI-Assisted Research hallucinated more than 34% of the time." https://lnkd.in/dBFYpqra Credit again to Stanford Institute for Human-Centered Artificial Intelligence (HAI) and the authors Faiz Surani and Daniel Ho.

4

5 Comments

Assembly Bill 1355 would require opt-in consent for collecting and sharing geolocation data, a targeted approach that reflects growing national concern over surveillance and use of sensitive data.

2

Privacy Isn’t a Policy, It’s a Design Choice The $530,000 settlement between California’s Attorney General and Sling TV is a wake-up call: privacy failures often start in design, not in fine print. Sling TV buried its opt-out behind cookie settings that didn’t actually stop data sharing. Users had to hunt for hidden links and fill out redundant forms even when the company already had their info. No in-app opt-out, no clarity, no generosity toward the user. Now the company must redesign its interfaces to make privacy controls simple and visible the way they should’ve been all along. Because real privacy isn’t written in 30-page policies. It’s built into the experience. #PrivacyByDesign #UXDesign #DataEthics #CCPA #UserExperience #Trust https://lnkd.in/eH8RjNDU

3

Anthropic released a legal plugin for Claude last week. It automates contract review, NDA triage, and compliance workflows - all open-source and customizable to your organization's playbook. I've been testing it out. Here's what stood out: This is foundation work, not a finished product: This handles contract review, but legal teams need approval workflows, version control, e-signatures, and matter management integration. Building that yourself means significant technical resources, ongoing maintenance, and integration work. Yes, it can integrate via MCP, but the difference between this and mature legal operations platforms is established trust, compliance certifications, proven security frameworks, and years of domain expertise baked into workflow design. Legal ops leaders may find that the hidden costs add up quickly. This should worry vendors whose product is Claude wrapped in a nice UI, but end-to-end legal operations platforms with security frameworks, compliance track records, and deep workflow expertise are probably fine. The real opportunity here is what gets built on top of this foundation. I'm genuinely excited to see what in-house legal teams create with this - and how vendors use it as a starting point to build more comprehensive solutions. Open-source foundations like this could accelerate a lot of interesting work in legal tech. #LegalTech #LegalOps #Claude #AI

42

2 Comments

This concern applies similarly for those of us in in-house roles. Part of educating and upskilli g your workforce must include reminders about how and when these legal privileges apply and that queries about legal subjects on publicly available models can be useful when following g governance guidelines , but without properly defined safeguards can unintentionally create legal risk. I suspect we will see more of these cases.

11

📢 Global Privacy & AI Laws Evolving Fast! Here's a quick rundown of key recent developments you need to know: 👇 California's CIPA & Chat Communications: The Ninth Circuit Court of Appeals has clarified that California's Invasion of Privacy Act (CIPA) Section 631(a) only applies to telephone communications, not internet-based chats. This is a significant ruling for businesses using website chat functionalities, affirming that services like Salesforce operating such chats don't violate this specific section of CIPA. 📞💬 EU Copyright Law & Generative AI: A new study from the European Parliament Research Services (EPRS) sheds light on a critical issue: only works with identifiable human input can gain copyright protection in the EU, leaving AI-generated content in a legal grey area. The study also highlights challenges with AI training on copyrighted data and unclear opt-out mechanisms. Lawmakers are urged to clarify rules to keep pace with generative AI. 🤖✍️🇪🇺 California's New AI Employment Rules: Big news for HR and tech! California is set to enforce new rules prohibiting the use of AI tools in employment decisions if they lead to discrimination based on protected traits like age, gender, or disability. This applies to everything from resume screening to job ads, aiming to ensure fair AI usage and uphold anti-discrimination laws. 💼⚖️🚀 Spanish DPA Fines ASNEF for GDPR Breach: The Spanish data protection authority (AEPD) has fined ASNEF €200,000 for unlawful processing of personal data and failing to respond to an erasure request under GDPR. This underscores the importance of proper data notification, accurate record-keeping, and fully honoring individuals' data rights. A stark reminder for all organizations! 🇪🇸🔒💰 #DataPrivacy #AILaw #GDPR #California #EUCopyright #EmploymentLaw #TechRegulation #LegalUpdate #StayInformed #PrivacyCompliance #DPO #LegalHead

6

When an MSA says the vendor owns all IP - 𝘳𝘦𝘨𝘪𝘴𝘵𝘦𝘳𝘦𝘥 𝘢𝘯𝘥 𝘶𝘯𝘳𝘦𝘨𝘪𝘴𝘵𝘦𝘳𝘦𝘥 - it can sound a bit intimidating. In SaaS heavy relationships, so much of the product sits in the grey space of unregistered IP: underlying code, opensource tools, interfaces, documentation, basically everything that isn't formally patented or trademarked. The clause ends up looking disproportionately broad, and a lot of customers instinctively pushback because it feels like they are signing away something. But most of the time, this language is simply vendor protecting the full stack of what they've built, not an attempt to claim rights over your data or processes. The real question as a customer is not '𝘸𝘩𝘺 𝘥𝘰 𝘵𝘩𝘦𝘺 𝘸𝘢𝘯𝘵 𝘵𝘩𝘪𝘴' but '𝘸𝘩𝘢𝘵 𝘥𝘰𝘦𝘴 𝘵𝘩𝘪𝘴 𝘮𝘦𝘢𝘯 𝘧𝘰𝘳 𝘮𝘦'. The answer is very practical You can absolutely accept broad IP language if your usage rights, data rights and exit rights are drafted clearly. The clause becomes problematic only when the breadth of 'unregistered IP' is used to blur who owns what - your data, your customizations or anything derived from your data. That's where negotiation becomes important. But in a well balanced contract, vendor ownership over both registered and unregistered IP is a harmless boilerplate. #InHouseLegal #ContractNegotiation #IPRights #SaaSContracts #LegalInsights

14

2 Comments

From Bloomberg Law's Titus Wu: California Privacy Agency Head Looks to Mend Industry Relations Insightful excerpt: New director says he will have ‘open door’ to stakeholders Agency relationship with industry, lawmakers strained The California Privacy Protection Agency will proactively work to improve its relationship with the business community that has repeatedly criticized its rulemaking for overreach, executive director Tom Kemp said in an interview with Bloomberg Government. https://lnkd.in/gsj3citS

4

California has once again raised the bar for privacy protection with two new bills that signal a major shift towards more explicit consumer control and stronger accountability for organizations handling personal data. Learn more in this blog:

9

One of my big predictions for 2026 and beyond is that data will become the most valuable form of IP. With the rise of AI, we’re going to see more patenting around data management, and even further acceleration of the trade secrets trend. That’ll mean legal and engineering teams collaborating more closely than they ever have before to develop these patents and their trade secret protection playbooks. Two pieces of new Tradespace content will be diving deeper into data as IP and trade secret protection in the age of AI soon — stay tuned! In the meantime, catching up with your organization’s technology partners isn’t a bad idea. #intellectualproperty #IPstrategy #inhouseIP

26