The European Parliament approved the Artificial Intelligence Act<\/a> (EU AI Act) on 13 March 2024. It has been hailed as the world\u2019s first comprehensive and binding piece of legislation on AI, although many of its provisions won\u2019t be enforced for at least a year or two. Rather than attempting to regulate specific technologies, the focus of the EU AI Act is on the element of risk posed by the way in which AI systems are used. So, for example, the use of AI in video games is considered low risk whereas social scoring systems (such as that used in China<\/a>) is deemed unacceptable risk. The Act also attempts to tackle some of the inherent copyright issues<\/a> associated with training generative AI (GenAI) products, by imposing a certain level of transparency for systems it terms General Purpose AI (GPAI).<\/p>\n\n\n\n Not a day seems to go by without a barrage of press releases about law firms adopting AI products, supposedly to \u201cimprove efficiency\u201d (but arguably just to increase profits and jump on the AI bandwagon). In the midst of all the legal AI fanfare, American firm Carlton Fields ruffled a few feathers and generated some heat on LinkedIn when it announced a firm-wide ban on the use of GenAI<\/a> for research and writing. Making the announcement, Peter J. Winders, General Counsel at the firm, concluded that GenAI \u201csimply can\u2019t be used to produce competent legal product[s] intended to aid a client or assist a court in the important work of fairly deciding disputes and developing the law.\u201d Interestingly, he also argues that, even if a large language model (LLM) is trained on reliable legal information (as is the case with the new Lexis+ AI<\/a> product), it can still result in so called \u201cdigital hallucinations\u201d: \u201cWhat about a generative AI program trained only on a large library of only reliable material, such as the West system or the preserved research and output of a large law firm? This might cut down on the risk that the generative AI tool has scraped rubbish off the internet at large, but it will do nothing to stop its resort to the fabrication of cases.\u201d These shortcomings of supposedly hallucination-free AI are highlighted in this LinkedIn post<\/a>.<\/p>\n\n\n\n GenAI companies such as OpenAI and Google are facing legal challenges<\/a> from a variety of publications and writers who are concerned with the unlicensed use of their copyright material for the training of LLMs. The UK 4 developers by drawing up a voluntary code of practice. Unfortunately, it recently abandoned this initiative<\/a>, claiming that the working group was unable to reach any consensus. However, there is still a chance of getting this issue back on the government agenda, thanks to the Artificial Intelligence (Regulation) Bill<\/a>, a private members\u2019 bill sponsored by Lord Holmes of Richmond. Separately, the House of Lords recently produced a report<\/a> in which it calls on the government to tackle the issue of LLMs being trained on copyrighted materials.<\/p>\n\n\n\n Cybersecurity has been in the news recently following the apparent spear phishing attempt targeting a number of MPs<\/a>. One piece of legislation which attempts to reduce the cybersecurity vulnerabilities of consumer connected devices is the Product Security and Telecommunications Infrastructure Act<\/a>, the provisions of which are due to come into force on 29 April 2024. The Act requires manufacturers, importers, and distributors of relevant products to take steps to minimise the exposure of consumers to cyberattacks. It\u2019s designed to tighten up the notoriously lax security protocols related to the Internet of Things (IoT), preventing malicious hackers breaking into a home network via an insecure smart speaker which comes with a default password of \u201c1234\u201d etc.<\/p>\n\n\n\n A\u00a0recent judgment handed down by the European Court of Justice<\/a>, in a Belgian case (C-604\/22) regarding the auctioning of personal data for advertising purposes, clarified the definition of \u201cpersonal data\u201d in the context of the General Data Protection Regulation (GDPR). The court had to consider whether a \u201cTransparency and Consent String\u201d (TC String) which is used by advertisers, in conjunction with cookies, to trade supposedly anonymised user data, fell outside the scope of personal data under the GDPR. It concluded that \u201cthe TC String contains information concerning an identifiable user and therefore constitutes personal data within the meaning of the GDPR.\u201d This rather technical judgment should serve as a warning to online advertisers who trade user data, and encourage them to conduct fresh audits to ensure they are not inadvertently breaching any of their data protection obligations. According to the\u00a0TLT data protection team<\/a>, although this is an EU ruling, it has the potential to impact UK companies \u201cwhether by virtue of those organisations being directly caught by the EU GDPR\u2019s extra-territorial scope, or as a helpful indication of how similar UK GDPR concepts may be interpreted.\u201d<\/p>\n\n\n\n Alex Heshmaty is technology editor for the Newsletter. He runs\u00a0Legal Words<\/a>, a legal copywriting agency based in the Silicon Gorge. Email\u00a0alex@legalwords.co.uk<\/a>.<\/em><\/p>\n\n\n\n Photo by\u00a0Marc-Olivier Jodoin<\/a>\u00a0on\u00a0Unsplash<\/a><\/em>.<\/p>\n","protected":false},"excerpt":{"rendered":" EU AI Act passed The European Parliament approved the Artificial Intelligence Act (EU AI Act) on 13 March 2024. It has been hailed as the world\u2019s first comprehensive and binding piece of legislation on AI, although many of its provisions won\u2019t be enforced for at least a year or two. Rather than attempting to regulate specific technologies, […]<\/p>\n","protected":false},"author":61,"featured_media":6589,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,106,151,48],"tags":[],"class_list":["post-6587","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-artificial-intelligence","category-copyright","category-cybercrime","category-data-protection"],"yoast_head":"\r\nLaw firm bans GenAI<\/h3>\n\n\n\n
UK AI and copyright code abandoned<\/h3>\n\n\n\n
Product Security and Telecommunications Infrastructure Act 2022<\/h3>\n\n\n\n
Clarification of the term \u201cpersonal data\u201d<\/h3>\n\n\n\n