Blog

AI Laws and Regulations Concept. Hand typing on laptop with digital icons representing artificial intelligence, legal standard, ethics, and regulatory compliance, Technology law and policy, copyright,

<h2>What Are the ICTS Regulations?</h2>The U.S. Department of Commerce has just issued a final rule to formalize the authorities and procedures of the Office of Information and Communications Technology and Services (OICTS). This is a critical step in implementing Executive Order 13873, which aims to address the national security risks posed by vulnerabilities in the information and communications technology and services (ICTS) supply chain.ICTS encompasses a wide range of technologies, including hardware, software, and services that facilitate data processing, communication, and storage. The regulations aim to mitigate risks posed by foreign influence or control over these critical technologies.<h2>Key Components of the ICTS Regulations</h2>The rule applies broadly to ICTS transactions involving hardware, software, and services related to areas like data processing, communications, critical infrastructure, and emerging technologies. The focus is on transactions where the ICTS is designed, developed, manufactured, or supplied by persons owned, controlled, or directed by foreign adversaries.Some key countries covered include China, Russia, and any other nations the Commerce Secretary deems to pose long-term threats to U.S. security. The rule is not limited to just one country, but rather takes a comprehensive approach to safeguarding against malicious foreign interference in American technology systems.<h2>What changed in relation to previous interim rule ?</h2>One of the key changes is removal of unit/user threshold requirement.&nbsp;In the interim rule, the Department of Commerce had included requirements that certain types of ICTS transactions would only be considered in scope for review if they involved over 1 million users or units. Specifically, this threshold applied to:<ul><li>Internet-enabled sensors, webcams, or other end-point surveillance/monitoring devices</li><li>Routers, modems, or other home networking devices</li><li>Software designed primarily for connecting to and communicating via the internet</li></ul>The idea behind these thresholds was that transactions involving a large number of users or units would be more likely to pose a true national security risk, versus smaller-scale transactions. The Department seemingly wanted to focus its limited resources on reviewing the most potentially impactful ICTS deals.However, in the final rule, the Commerce Department has decided to remove these numerical thresholds entirely. There are a few key reasons why they made this change:Risk is not always correlated with transaction volume - The Department recognized that an ICTS transaction could still pose significant national security risks even if it involves a relatively small number of users or units. For example, if the technology is being used to collect sensitive personal data on high-profile government officials, the risk could be very high despite the low transaction volume. Thresholds could enable strategic circumvention - If businesses knew their transactions would only be reviewed if they exceeded 1 million users/units, some might intentionally structure deals to stay under that limit, even if the underlying technology still posed risks. Threshold limitations conflict with the rule's objectives - By excluding transactions below the numerical limits, the Department felt it would be failing to address the full scope of vulnerabilities in the ICTS supply chain, as envisioned in Executive Order 13873.So in the final rule, the Commerce Department has taken a more holistic approach. Rather than relying on arbitrary user/unit thresholds, they will focus their reviews on ICTS transactions most likely to pose undue or unacceptable risks, based on a range of factors beyond just the transaction volume.This change means the final rule has a broader, more comprehensive scope when it comes to the ICTS transactions that are eligible for review. The goal is to give the Department maximum flexibility to identify and address national security vulnerabilities, wherever they may exist in the technology supply chain. <img id="ch8qszz1pm4g5zd8g" src="https://cdn.durable.co/getty/184D9u8VPLtw1TiNGoYxKIeBKoWkEayQwD874KROmiAzCLsyNTPoyZGfp96a3Xeh.jpeg" alt="business technology" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" data-mce-src="https://cdn.durable.co/getty/184D9u8VPLtw1TiNGoYxKIeBKoWkEayQwD874KROmiAzCLsyNTPoyZGfp96a3Xeh.jpeg" data-mce-style="aspect-ratio: 16/9;" style="font-family: var(--body-fontFamily); font-size: calc(18px * var(--body-fontSize, 1)); font-style: var(--body-fontStyle, normal); font-weight: var(--body-fontWeight, 400); aspect-ratio: 16 / 9;">Businesses should consider conducting a thorough review of their supply chains and partnerships to identify any potential risks associated with foreign adversaries. This proactive approach will help ensure compliance while maintaining operational integrity.<h2>Important definitions and processes&nbsp;&nbsp;</h2>&nbsp;Covered Transactions - The final rule applies to a broad range of ICTS transactions, including those involving hardware, software, and services related to information/communications, data hosting and computing, connected applications, critical infrastructure, and critical/emerging technologies. However, transactions already reviewed by the Committee on Foreign Investment in the United States (CFIUS) are generally excluded.Review Process - The Department can initiate reviews of ICTS transactions on its own or based on referrals from other agencies. It first assesses whether a transaction meets the criteria for a "covered ICTS transaction" and involves ICTS supplied by persons owned/controlled by foreign adversaries. If so, the Department evaluates whether the transaction poses an "undue" or "unacceptable" risk based on factors like the ICTS capabilities, the foreign nexus, the parties involved, and potential impacts on national security.Initial and Final Determinations - If the Department identifies undue or unacceptable risks, it will issue an initial determination proposing to prohibit the transaction or allow it with mitigation measures. Parties have 30-60 days to respond before the Department issues a final determination. Final determinations to prohibit a transaction will be published in the Federal Register, while notices of final determinations to allow transactions with mitigation may also be published.<figure id="figure-z53n0wl5lmm4g5zl90"><img id="z53n0wl5lmm4g5zl90" src="https://cdn.durable.co/getty/22FYpjM8ipvdhCWKMvJXMMoFSSxDVYE3dZ5oCzAPfQ0wdIznATjQHgvhHHdMYUEX.jpeg" alt="compliance" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9;" data-mce-src="https://cdn.durable.co/getty/22FYpjM8ipvdhCWKMvJXMMoFSSxDVYE3dZ5oCzAPfQ0wdIznATjQHgvhHHdMYUEX.jpeg" data-mce-style="aspect-ratio: 16/9;"></figure><h2>Penalties</h2>The rule specifies a range of prohibited activities related to covered ICTS transactions. Violations can result in substantial civil penalties up to $250,000 per incident or criminal penalties up to $1 million and 20 years imprisonment. These penalties apply not just to direct participants, but also to those who aid, abet, or make false statements.More information here:&nbsp;<a href="https://www.bis.gov/press-release/commerce-issues-final-rule-formalize-icts-program" data-mce-href="https://www.bis.gov/press-release/commerce-issues-final-rule-formalize-icts-program">https://www.bis.gov/press-release/commerce-issues-final-rule-formalize-icts-program</a>

Understanding the Department of Commerce's New ICTS Regulations

🌐 Major Development in Data Governance: Council Adopts the Data ActIn a landmark move, the European Union's Council has adopted the new Data Act, introducing a transformative framework for fair access to and use of data. This legislation is poised to significantly impact how data is managed, shared, and utilized, particularly in key industries.Highlights of the Data Act:<ol><li>Fair Access &amp; Usage: The Data Act ensures equitable data access, fostering transparency across the EU.</li><li>Data Sharing Mechanisms: It introduces mechanisms for data sharing, both in business-to-business (B2B) and business-to-government (B2G) contexts.</li><li>Data Privacy Commitment: Aligns with existing data protection laws, reinforcing the protection of personal data.&nbsp;</li><li>Standards for Interoperability: Encourages the development of common standards for seamless data sharing.</li><li>Economic Growth &amp; Innovation: Aims to boost innovation and economic development within the digital sector.</li></ol>Industries Primarily Impacted:<ul><li>Automotive: The Act is expected to have a profound impact on data sharing related to connected vehicles and smart transportation systems.</li><li>Tech and Telecommunications: Companies in these sectors will likely see significant changes in how they handle data sharing and data-driven services.</li><li>Healthcare: Enhanced data access could revolutionize patient care and medical research.</li><li>Manufacturing: The Act could facilitate more efficient supply chain management and production processes through improved data access.</li></ul>Implementation &amp; Compliance:
Businesses and organizations across these sectors should prepare for the implementation of the Act, ensuring compliance and adapting their data strategies accordingly.The Data Act marks a critical step in the EU's commitment to a digital economy where data is a key driver of innovation and growth. It's crucial for professionals and companies in the impacted industries to stay informed and adapt to these new regulations.#DataAct #DigitalStrategy #DataGovernance #EU #DataProtection #Innovation #TechNews #Automotive #Healthcare #Manufacturing #Telecommunications

Data Act adopted by the Council  

For all of those looking for a full text of the AI Executive Order here is the <a data-mce-href="https://acrobat.adobe.com/id/urn:aaid:sc:EU:5a5580ef-f88a-41aa-98f4-7c993b5819f7" href="https://acrobat.adobe.com/id/urn:aaid:sc:EU:5a5580ef-f88a-41aa-98f4-7c993b5819f7" title="Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence" target="_blank" rel="noopener">PDF</a> file with usefull table of contents prepared by our team.&nbsp;We are excited, and will provide a short summary of most important issues including "Syntehic Content"&nbsp; regulation by the end of the week.

AI Executive Order full text (PDF)

An interesting reference to intellectual property and trade secret rights can be found in the draft Commission Delegated Regulation (EU) .../... supplementing Directive 2013/34/EU. &nbsp;.7 Classified and sensitive information, and information on intellectual property, know-how or results of innovation &nbsp;105. The undertaking is not required to disclose classified information or sensitive information, even if such information is considered material.&nbsp;106. When disclosing information about its strategy, plans and actions, where a specific piece of information corresponding to intellectual property, know-how or the results of innovation is relevant to meet the objective of a Disclosure Requirement, the undertaking may nevertheless omit that specific piece of information if it: (a) is secret in the sense that it is not, as a body or in the precise configuration and assembly of its components, generally known among or readily accessible to persons within the circles that normally deal with the kind of information in question; (b) has commercial value because it is secret; and (c) has been subject to reasonable steps by the undertaking to keep it secret.&nbsp;107. If the undertaking omits classified information or sensitive information, or a specific piece of information corresponding to intellectual property, know-how or the results of innovation because it meets the criteria established in the previous paragraph, it shall comply with the disclosure requirement in question by disclosing all other required information.&nbsp;108. The undertaking shall make every reasonable effort to ensure that beyond the omission of the classified information or sensitive information, or of the specific piece of information corresponding to intellectual property, know-how or the results of innovation, the overall relevance of the disclosure in question is not impaired.&nbsp;Brussels, 31.7.2023&nbsp; C(2023) 5303 final ANNEX 1&nbsp; ANNEX&nbsp; to the&nbsp; Commission Delegated Regulation (EU) .../... supplementing Directive 2013/34/EU of the European Parliament and of the Council as regards sustainability reporting standards &nbsp;🔑 Practical Takeaways:
1️⃣ Companies must have a trade secret policy. It's challenging to prove the criteria of a trade secret under the Trade Secrets Directive.
2️⃣ The term "sensitive" information isn't defined, raising questions about its interpretation. This needs to be fixed before going live with the regulation.&nbsp;3️⃣ Significant consequences await companies that don't correctly mark trade secret information, potentially leading to loss of protection under trade secret laws.&nbsp;Stay informed and ensure your company's compliance! 💼#TradeSecrets #IntellectualProperty #EURegulations #Compliance #BusinessStrategy #SustainabilityReporting #Directive201334EU

ESG Reporting may impact your IP and trade secret policies

A quick reminder for the #AdTech and #MarTech community. Case C-604/22 at the European Court of Justice is moving forward. Today at 9:30 the EU's top court will hear the parties. A judgment in this case, expected in 2024, will undoubtedly set the stage for personalized advertising in the EU. To recap the questions posed by the referring court in Brussels:a) Must Article&nbsp;4(1) of Regulation (EU) 2016/679&nbsp;<a href="https://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=268704&amp;pageIndex=0&amp;doclang=en&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=136297#1" data-mce-href="https://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=268704&amp;pageIndex=0&amp;doclang=en&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=136297#1">1</a>&nbsp;of the European Parliament and of the Council of 27&nbsp;April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, read in combination with Articles&nbsp;7 and 8 of the Charter of Fundamental Rights of the European Union, be interpreted as meaning that a character string that captures the preferences of an Internet user in connection with the processing of his or her personal data in a structured and machine-readable manner constitutes personal data within the meaning of the said provision in respect of (1) a sectoral organisation which makes available to its members a standard whereby it prescribes to them how that string should be generated, stored and/or distributed practically and technically, and (2) the parties that have implemented that standard on their websites or in their apps and thus have access to that string?(b)&nbsp;&nbsp;&nbsp;&nbsp;Does it make a difference in that regard if the implementation of the standard means that this string is available together with an IP address?(c)&nbsp;&nbsp;&nbsp;&nbsp;Does the answer to questions 1(a) and 1(b) lead to a different conclusion if this standard-setting sectoral organisation does not itself have legal access to the personal data that are processed within this standard by its members?(a) Must Articles&nbsp;4(7) and 24(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27&nbsp;April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, read in combination with Articles&nbsp;7 and 8 of the Charter of Fundamental Rights of the European Union, be interpreted as meaning that a standard-setting sectoral organisation must be classified as a controller if it offers its members a standard for managing consent which contains, in addition to a binding technical framework, rules setting out in detail how those consent data&nbsp;– which constitute personal data&nbsp;– must be stored and disseminated?(b)&nbsp;&nbsp;&nbsp;&nbsp;Does the answer to question 2(a) lead to a different conclusion if this sectoral organisation itself does not itself have legal access to the personal data that are processed within this standard by its members?(c)&nbsp;&nbsp;&nbsp;&nbsp;If the standard-setting sectoral organisation must be designated as a controller or a joint controller for the processing of Internet users’ preferences, does that (joint) responsibility of the standard-setting sectoral organisation therefore automatically extend to the subsequent processing by third parties for which the Internet users’ preferences were obtained, such as targeted online advertising by publishers and vendors?

Blog

Understanding the Department of Commerce's New ICTS Regul...

Data Act adopted by the Council

AI Executive Order full text (PDF)

ESG Reporting may impact your IP and trade secret policies

The ECJ will decide on the TCF (soon)