DPOInsider

Share this post

DPOInsider #37

www.dpoinsider.com

DPOInsider #37

AI frameworks; Data breach notifications

DPOInsider
Feb 10
Share this post

DPOInsider #37

www.dpoinsider.com

The DPOInsider covers the latest news and developments in data compliance and privacy. The DPO's favourite weekly read ☕️


AI conflict of interests

The National Institute of Standards and Technology has released its AI Risk Management Framework, emphasizing the importance of trustworthy AI systems.

Thanks for reading DPOInsider! Subscribe for free to receive new posts and support my work.

The guidance aims to help those developing and implementing AI address the unique risks posed by the technology. The first version of the framework is focused on four high-level functions - govern, map, measure, and manage. These categories include suggestions on evaluating AI for legal and regulatory compliance, tracking AI risks, and allocating resources to mitigate potential risks.

However, the framework's release has sparked concerns over conflicting messages about US federal AI policy.

Two US House leaders wrote a letter to President Biden expressing their worries about the inconsistent and duplicative AI guidance being released. The Biden administration's AI Bill of Rights outlines five core principles for designing and using AI, including protecting against algorithmic discrimination.

We are concerned that the release of the Blueprint, and subsequent public statements by OSTP, are sending stakeholders, the American public, and the international community, conflicting messages about U.S. federal AI policy

Despite the conflicting messages, the guidance documents are complementary frameworks. The Office of Science and Technology Policy provided insight on NIST's framework and was involved in the development of the AI Bill of Rights. Alondra Nelson, the Office's Deputy Director, stated that AI presents challenges that are bigger and broader than any single effort or agency.

AI is currently a hot issue, with Google set to more publicly use its capabilities following the rise in the use of ChatGPT.

This will mean more data being used to train these tools, and more robust regulation as well. Definitely an interesting space to watch. For more info on this you can dive deeper here.


To notify, or not to notify, that is the question

It seems like data breach notifications are not being as transparent as they should be. According to the latest annual data breach report, two-thirds of data breach notices failed to provide enough information for individuals and businesses to gauge the potential risk.

In contrast, back in 2019, data breach notices that contained attack and victim details made up 72% of all written notifications, but last year it dropped to a five-year low of 34%.

ITRC CEO Eva Velasquez says in the report, "The result of these trends is less reliable data that impairs the ability of individuals, businesses and government officials to make informed decisions about the risk of a data compromise and the actions to take in the aftermath of one." With the number of potential victims jumping 41% YoY to 422 million, it's alarming that the details in the data breach notices are lacking.

According to ITRC, compromised businesses are making a conscious decision to withhold information and the group specifically calls out DoorDash, LastPass, and Samsung for not providing enough detail in their state-mandated breach notice. This lack of detail can cause severe problems, as we saw in the case of LastPass.

The potential damage caused by the breach at LastPass and its parent company GoTo escalated alarmingly when the password manager informed its customers that everything except their master passwords were compromised.

In conclusion, the inadequate information in data breach notices highlights the ineffectiveness of state data breach notification laws. And increasingly, it's not what we know, but what we don't know that is the most troubling.


Other data privacy news

Google Fi says hackers accessed customers’ information

4 Data Privacy Compliance Articles You Should Read

‘I’m not Snow White. I have to think like a criminal’: how I became a burglar for hire

That last one is a little bit different than usual but interesting none the less.


Post of the week

Twitter avatar for @RobertJBateman
Robert Bateman @RobertJBateman
Can anyone persuade me that the current crop of Large Language Models are, or can be made, GDPR compliant?
12:56 PM ∙ Feb 9, 2023

Thanks for reading DPOInsider! Subscribe for free to receive new posts and support my work.

Share this post

DPOInsider #37

www.dpoinsider.com
Comments
TopNew

No posts

Ready for more?

© 2023 DPOinsider
Privacy ∙ Terms ∙ Collection notice
Start WritingGet the app
Substack is the home for great writing