Eduardo Ustaran

Eduardo Ustaran

@eustaran.bsky.social

Privacy, data protection and digital regulation lawyer, pragmatic thinker and author

290 followers98 following373 posts

As a runner, I don’t interpret “pacing” as slowing down even if pacing oneself correctly means going more slowly than one could possibly run. As every marathon runner knows, getting the pace right is probably the single most important aspect of a successful outcome. The same principle applies to AI.

To reiterate two key points I made: 🌎 There is a risk that if we position the rules around international data transfers as a digital sovereignty issue, we may lose track of the fact that the real intention should be for the protection to follow the data as it flows.

🌍 Adequacy (by the EU and the UK) should ideally be positioned as a way of promoting the ongoing protection of data globally, rather than the pursuit of convergence towards any given standards. All debatable, of course, so other views welcome (either if you see me here in Venice or digitally).

Doing some domestic filing, I came across this article I wrote as a newly qualified lawyer in June 1996 for the internal newsletter of the first law firm I worked for. Aside from being a blast from the past, the similarities with how we approach the use of AI at law firms today are pretty striking.

Data protection is not just about compliance. It is also about demonstrating compliance, and this is particularly important for regulatory investigations, we hear at #IAPPIntensive26. Transparency is therefore key alongside the ability to maintain confidentiality.

Not getting the wider strategy right when faced with a regulatory investigation is regarded as the most critical mistake. It sounds obvious but when operating in crisis mode, having the space to think is lacking precisely when it is most important. Wise views at #IAPPIntensive26.

A complaint that is not amicably resolved and is escalated to a regulator is seen as one of the most common triggers of a formal regulatory investigation at #IAPPIntensive26. So avoiding escalation should be seen as a priority in practice.

Fascinating session at #IAPPIntensive26 focused on the sensitive topic how to handle regulatory investigations. First lesson to learn is that from the very first interaction with a regulator, no matter how informal or casual, the right attitude matters.

The number of people attending this #IAPPIntensive26 session on international data transfers and the number of questions being asked shows what a big area of concern this still is for organisations.

Interesting panel session at #IAPPIntensive26 comparing the (slight) simplification of the UK’s international data transfers regime with the EU’s (growing) toughening of its own approach.

On a fleeting visit to San Francisco, local companies are very keen to know how far the European digital regulatory simplification will go. You could call that part of the “Brussels Effect”.

A few reflections on AI Governance.👇 A very common pattern I keep seeing is businesses feeling under pressure to implement AI tools and those with responsibility for AI governance becoming sidelined by those businesses for fear that they will slow things down. We need to change this dynamic.

View full thread

Devising a clear, sensible and workable risk triage process is equally essential in practice. The trick is to reach consensus on what the real risks could be, but the most obvious business risk of AI is to invest into AI that doesn’t deliver its benefits because it doesn’t work or is unlawful.

And since AI governance needs to work across jurisdictions with different legal regimes, as has been the case with privacy governance for years, it is also crucial to identify a common denominator (not too low and not too high) that can be used a global standard (even if local tweaks are needed).

A few reflections on AI Governance.👇 A very common pattern I keep seeing is businesses feeling under pressure to implement AI tools and those with responsibility for AI governance becoming sidelined by those businesses for fear that they will slow things down. We need to change this dynamic.

The number one mission of those with responsibility for AI governance is to convey the message that “AI governance is an enabler, not a blocker”. This obviously has to be a genuinely believed message which has to be backed up by actions that show it’s true.

One of the ways in which the UK is expected to specifically regulate #AI is in relation to live facial recognition for law enforcement purposes. Not a bad idea given the level of privacy intrusiveness, but very unlikely to become a “prohibited AI practice” as in the EU.

This is very telling and may lead to split the section of the #AI Act Omnibus dealing with timings from the section dealing with material changes, as otherwise it may not pass on time before the high-risk AI systems obligations kick in this Summer.👇

Luca Bertuzzi@lucabertuzzi.bsky.social

The Council’s first compromise on the AI omnibus is out, and it pushes back hard on the Commission’s original approach. The text favors fixed deadlines for high-risk AI obligations & reinstates a simplified registration requirement, among other changes. www.mlex.com/mlex/artific...

Those developing or seeking to deploy high-risk #AI systems now need to decide whether to spend the next 6 months preparing for compliance or to take the view that implementation will be delayed and stay put for now. Not an easy decision but at least a middle ground approach would be prudent.

Nothing beats optimism backed by scientific evidence. If the unhealthy geopolitical noise around us ever makes you think that the world is going backwards, don’t despair. Many efforts are still going in the right direction and good things are happening.

Call me a data protection nerd but the real question is not whether you are happy with your ‘listening age’, but whether this wonderful conversation starter that Spotify has come up with is compliant with Art. 5(1)(d) GDPR… 🤔