Latest Posts
Search for:
Author

Avi Toltzis

Browsing
In Artificial Intelligence

AI Innovation in California Prevails: California Governor Nixes Major AI Legislation

by , , , , , , and 4 Mins Read

On September 29, 2024, California Governor Gavin Newsom vetoed Senate Bill 1047, which would have enacted the Safe and Secure Innovation for Frontier Artificial Intelligence Models Act (the “Act”) to create a comprehensive regulatory framework for the development of artificial intelligence models. The veto embodies the dilemma that has emerged around the regulation of AI applications: how can laws prevent harms in the use and development of AI, while promoting innovation and harnessing the power…

In Artificial Intelligence

Minding Your Data: New Law Expands CCPA’s Sensitive Personal Information to Include Neural Data

by , , , , , , and 3 Mins Read

“Neural data” is the newest addition to the ever expanding California Consumer Privacy Act (CCPA). Signed into law on September 28, 2024, SB 1223 amends the CCPA to add “personal information that reveals neural data” to the categories of personal information that constitute sensitive personal information. It further amends the CCPA to define “neural data” as “information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is…

In Artificial Intelligence

Over Fifty Countries Sign on to the Council of Europe’s Framework Convention on Artificial Intelligence, the First Legally Binding International Treaty on AI

by , and 3 Mins Read

Background On September 5, 2024, the Council of Europe’s 46 member states, along with eleven non-members (Argentina, Australia, Canada, Costa Rica, the Holy See, Israel, Japan, Mexico, Peru, the US and Uruguay), signed the Council of Europe’s Framework Convention on Artificial Intelligence, the first legally binding international treaty to address AI technologies (the “Convention”). The Convention aims to ensure that AI is consistent with core principles like human rights, democracy and the rule of law,…

In Data Privacy

American Privacy Rights Act: A first glance at the US Congress’s newest comprehensive privacy bill

by , and 1 Min Read

Abstract The recently introduced American Privacy Rights Act (APRA) represents the latest attempt to pass a comprehensive federal privacy law in the US that would govern privacy generally across the country. The draft bill proposes novel compromises on controversial topics such as federal preemption and rights of private action, which need refinement and will likely be changed in the legislative process. The attempt to cover not-for-profit entities without accounting for their different purposes seems ill…

In California Privacy Law

Amendments to California’s CMIA Bring Health Data New Requirements

by , and 4 Mins Read

In Brief Various players in the health care industry are or will soon be subject to new requirements relating to sexual and reproductive health data under a pair of bills passed last year amending the California Confidentiality of Medical Information Act (the “CMIA”). Many of the central provisions of bills AB 254 and AB 352, which were both signed into law by Governor Gavin Newsom in September 2023, came into effect on January 1, 2024.…

In Artificial Intelligence

From Brussels to Boulder: Colorado Enacts Comprehensive AI Law on the Heels of EU’s AI Act with Significant Obligations for Business and Employers

by , , , , , and 4 Mins Read

In Brief On May 17, 2024 Colorado Governor Polis signed the landmark Colorado AI Act (Senate Bill 24-205) into law. Colorado is now the first US state with comprehensive AI regulation, adopting a classification system like the European Union’s recent AI Act. The law will take effect February 1, 2026. The law exempts small employers (fewer than fifty full-time employees) from some of its requirements but otherwise requires companies to take extensive measures to protect…

In Cybersecurity

Mission Critical: CIRCIA’s Regulations and the Race to Secure Critical Infrastructure

by , and 9 Mins Read

Today, April 4, 2024, Cybersecurity and Infrastructure Security Agency (“CISA”) officially published its long-awaited Notice of Proposed Rulemaking (“Proposed Rule”) for the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”). The Proposed Rule requests written comments from the public no later than June 3, 2024. CISA will then have 18 months to promulgate a final rule which is expected to be finalized and in effect by October 2025. CIRCIA Big Picture CIRCIA is…

In Cybersecurity

Hacker attempts to use SEC rules to further exploit victims

by , , and 2 Mins Read

In a shocking show of gumption, a ransomware gang has reportedly not only hacked a US public company’s (MeridianLink) IT systems, but also filed a complaint on the SEC’s Tips, Complaints, and Referrals page, regarding Meridian Link’s claimed failure to disclose the incident in an 8-K in violation of the SEC’s new cybersecurity rules. Even though public companies are not yet required to comply with the new cybersecurity disclosure rules (8-K requirement goes effective on…

In Cybersecurity

New York State Sets the Bar for Cybersecurity Requirements

by , , , , , and 8 Mins Read

Effective November 1, 2023, New York State Department of Financial Services (“DFS”) Strengthens Cybersecurity Requirements for Financial Services Companies. All companies should take account of these amendments, as these DFS regulations are increasingly referenced as key benchmarks for cybersecurity compliance programs. New York State’s Department of Financial Services (“DFS”) finalized significant amendments to 23 CRR-NY 500 NY-CRR, “Cybersecurity Requirements for Financial Services Companies” (“Part 500”). This follows two rounds of proposed amendments and public comment…

In Cybersecurity

CISOs, Internal Accounting Controls, Crown Jewels and Disclosure Procedures:  Peeling Back The Onion of the Solar Winds Enforcement Action

by , , , , , , and 12 Mins Read

In many ways, the Securities and Exchange Commission’s (“SEC”) October 30, 2023 enforcement action against software company SolarWinds Corporation (“SolarWinds”) and its chief information security officer (“CISO”) is a typical securities case. The first four counts involve alleged material misstatements by the public company related to widely reported operational turmoil that allegedly materially impacted the company. But aspects of the case may signal a change in how the SEC looks at cyber incidents, including internal…

Load More