Search results

[…] the means to reasonably identify the individuals: if they do not process personal data, the GDPR does not apply.  On the other hand, pseudonymization is not a free pass. A dataset may still qualify as personal data: (1) if the recipient has reasonable means to re-identify the individual; (2) for the controller who holds […]

[…] May 2025.  Finally, reform must further the EU’s values. As Article 2 and 3(1) TEU set out, the EU was founded on values such as “human dignity, freedom, democracy, equality, the rule of law and respect for human rights”, which are also at the heart of the GDPR (see Recital 4). Any reform must […]

[…] heightened risk of harm to a consumer. C.R.S. § 6-1-1309(1). Where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons. Art. 35(1). DPAs are required where processing activities pose some heightened risk of harm. A key difference between these regulations is whether that […]

[…] been “reasonably prevented.” SB 53 lacks these qualifiers, applying a broader standard for when risk triggers compliance. Requirements: SB 53 establishes four major obligations, dividing some responsibilities between all frontier developers and the narrower subset of “large frontier developers.” Frontier AI Framework: Large frontier developers must publish an annual Frontier AI framework describing how […]

[…] to opt-out, and appeal adverse decisions. It would also prohibit use of a high-risk AI system that produces algorithmic discrimination or has not passed an independent audit. Virginia HB 2094 (Veto’ed by Governor) Del. Maldonado (D) High-Risk AI / Automated Decisionmaking Would regulate AI systems used in consequential decisions, requiring entities to use reasonable […]

[…] strong concern that replicating the EU AI Act could create regulatory overreach. However, civil society groups argue that even comprehensive frameworks like the Colorado AI Act or Virginia’s HB 2094 (vetoed) are significantly narrower in scope and that highlighting that superficial similarities with the EU AI Act, such as shared definitions or structural references, […]

[…] AI development and deployment.  Enforcement tools and defense strategies: Legislatures expanded Attorney General investigative powers (such as civil investigative demands) in bills including Texas’ TRAIGA (enacted) and Virginia HB 2094 (vetoed). A variety of other defense mechanisms were introduced, including specific protections for whistleblowers, as represented in California’s SB 53 (enrolled). Looking Ahead to […]

[…] Washington Privacy Act style-framework, provides comprehensive privacy protections to consumers in Colorado that are enforced by the state Attorney General’s office, which also has rulemaking authority. In 2024, the Colorado legislature passed an amendment to the CPA providing heightened protections to minors in the state by establishing a duty of care owed to minors […]

[…] Washington Privacy Act style-framework, provides comprehensive privacy protections to consumers in Colorado that are enforced by the state Attorney General’s office, which also has rulemaking authority. In 2024, the Colorado legislature passed an amendment to the CPA providing heightened protections to minors in the state by establishing a duty of care owed to minors […]