Common Uses for AI in Beauty & Associated Risks

Kelly Bonner and Agatha Liu of Duane Morris LLP shared their insights and experience with CosmeticsDesign on the risks of incorporating AI technology into business practices, and how can beauty companies protect themselves.

While “today’s AI technology can save a fair amount of time in not only performing conventional services, but also uncovering hidden insight into consumer motivation and behavior,” Liu noted, “on the other hand, today’s AI technology generally lacks transparency and suffers from hallucination and thus still requires a considerable amount of human review.” Therefore, she recommended that “while companies are encouraged to incorporate AI technology into their offerings, they should closely monitor how it is utilized and what it produces and make adjustments or take remedial steps as appropriate.” […]

Continue reading “Common Uses for AI in Beauty & Associated Risks”

Vietnam: New Decree on Personal Data Protection

On 17 April 2023, Decree No. 13/2023/ND-CP on personal data protection (PDPD) was officially issued by the Vietnamese Government. The long-awaited and controversial decree is set to be the first ever legal document with comprehensive regulations on both personal data and its protection in Vietnam. With an exception being the grace period of 2 years for SMEs, after 1 July 2023, the PDPD will be applicable to all entities located in Vietnam and/or outside Vietnam but directly con-ducting activities in relation to the processing of personal data in Vietnam.

To read the full text of this blog post by Duane Morris Vietnam partner Dr. Oliver Massmann, please visit the Duane Morris Vietnam Blog.

Preservation of Ephemeral Messaging for Business Purposes

Ephemeral messaging is short-lived, yet the data preservation and regulatory obligations remain.

Ephemeral messaging apps – like WhatsApp and SnapChat – are a form of digital communication available for a limited time and then deleted.  The two key characteristics of ephemeral messaging are: (1) automated deletion of message content for both the sender and the receiver and (2) end-to-end encryption which enhances privacy by making it more difficult for hackers and others to read the encrypted data while it is in transition between devices.

The three degrees of ephemerality in messaging apps are:

  1. Pure which involves the permanent and automated deletion of messages;
  2. Quasi which permits preservation of messages in certain circumstances; and
  3. Non-ephemeral in which messages usually remain on a source (such as a server) and may not include end-to-end encryption.

The benefits of ephemeral messaging include:

  • Information governance: Data storage and records preservation/management are reduced by ephemeral messaging.
  • Legal compliance: Encryption and automatic deletion of personal data help reduce exposure if a data breach occurs.
  • Data security: Even if a mobile device is lost, the automatic deletion of data will likely protect against hackers.

The legal risks of ephemeral messaging include: (1) complying with subpoenas and (2) preservation of data when litigation is “reasonably anticipated”.

Subpoenas often define documents and communications broadly to capture all communications, including ephemeral messaging.  Thus, the failure to preserve documents may result in an inability to fully comply with a subpoena and/or a criminal exposure, particularly if the subpoena was issued by the government.

Regarding the preservation of data, legal hold policies may need to be amended to address ephemeral messaging, including when a company is dealing with government regulators.  See e.g., Federal Trade Commission v. Noland, et al., Case No. CV-20-00047-PHX-DWL (D. Ariz. 2021) (sanctioning defendants for installing and using ephemeral messaging after learning they were investigation targets).

Some regulators caution against the use of ephemeral messaging.  For example:

  • The U.S. Securities and Exchange Commission (“SEC”) issued a guidance in 2018 that prohibits business use of apps which permit automatic destruction of messages.
  • The U.S. Department of Justice (“DOJ”) updated its Evaluation of Corporate Compliance Programs in March 2023 which discusses the factors that prosecutors should consider in conducting an investigation of a corporation including the adequacy and effectiveness of the corporation’s compliance program at the time of the offence as well as at the time of the charging decision.

Accordingly, establishing adequate and effective corporate compliance programs are important, including:

  1. establishing a corporate compliance program which is monitored, updated, and works in practice, and
  2. reviewing the company’s document-retention policies and procedures, including whether they address ephemeral messaging and mobile device data.

In sum, although ephemeral messaging is short-lived, the consequences – of failing to comply with data preservation and regulatory obligations – may be long lasting.

 

 

Will Website Chat Feature Wiretapping Lawsuits Rise?

Entering the conversation, the United States District Court for the Central District of California recently denied a motion to dismiss claims alleging that a website’s chat features and use of session replay software violate the California Invasion of Privacy Act (CIPA). Notably, this court rejected a forum selection clause in the website’s terms of use and went on to hold that allegations that the plaintiff shared “personal information” in the chat were sufficient to maintain a claim.

Read the full Alert on the Duane Morris LLP website.

30-Year-Old Video Tape Statute Fueling New Class Action Lawsuits

Perhaps you are old enough to recall when consumers used to have to go to video stores like Blockbuster Video to rent a movie. And perhaps you recall the excitement of scoring a copy of the always limited “new release.” It was during these “archaic” times that Congress passed the federal Video Privacy Protection Act in response to a newspaper publishing Robert Bork’s video rental history during his U.S. Supreme Court nomination.

Read the full Alert on the Duane Morris LLP website.

Does Tracking User Activity on Websites Violate Electronic Interception Laws?

A new wave of class action lawsuits filed in California, Pennsylvania and Florida target companies that use technologies to track user activity on their websites, alleging such practices, when done without obtaining a user’s consent, violate electronic interception provisions of various state laws. The two technologies at issue are: 1) session replay software and 2) coding tools embedded in chat features. Session replay software tracks a user’s interactions with the website—their clicking, scrolling, swiping, hovering and typing—and creates a stylized recording of those interactions and inputs. Coding tools create and store transcripts of the conversations users have in a website’s chat feature. The plaintiffs in this new string of class actions allege that recording their interactions with a website and sending that recording to a third party for analysis without their consent is an illegal invasion of their privacy.

Read the full Alert on the Duane Morris LLP website.

CJEU Declares Privacy Shield Invalid but Upholds Validity of Model Clauses (Sort Of)

A sense of déjà vu descended over the international data transfer landscape on July 16, 2020. In a landmark ruling, the Court of Justice of the European Union (CJEU) announced that Privacy Shield, one of the main mechanisms used by companies to transfer personal data from the EU to the United States, is invalid.

To read the full text of this Duane Morris Alert, please visit the firm website.

© 2009- Duane Morris LLP. Duane Morris is a registered service mark of Duane Morris LLP.

The opinions expressed on this blog are those of the author and are not to be construed as legal advice.

Proudly powered by WordPress