Mcle Self-study Article: Privacy Law Issues Associated With Developing and Deploying Generative Ai Tools

• Citation: Vol. 1
• Publication year: 2024
• Author: Written by Jonathan Tam

MCLE SELF-STUDY ARTICLE: PRIVACY LAW ISSUES ASSOCIATED WITH DEVELOPING AND DEPLOYING GENERATIVE AI TOOLS

Written by Jonathan Tam^*

The past couple of years have seen significant technological advancements in artificial intelligence ("AI") and legal developments applicable to organizations that develop and deploy (i.e., adopt and use) AI. This article outlines examples of developments related to privacy law and AI at the U.S. federal and California state level and examines at a high level some privacy issues that organizations should consider before developing or deploying generative AI ("GenAI") tools, which are a subset of AI technologies that generate new content in response to a user instruction or prompt.

EXAMPLES OF DEVELOPMENTS RELATED TO PRIVACY LAW AND AI AT THE FEDERAL AND CALIFORNIA STATE LEVEL

On October 30, 2023, President Biden issued the "Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence" ("EO 14110").¹ The order defines "AI" as "a machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems use machine-and human-based inputs to perceive real and virtual environments; abstract such perceptions into models through analysis in an automated manner; and use model inference to formulate options for information or action."² EO 14110 also defines "generative AI" as "the class of AI models that emulate the structure and characteristics of input data in order to generate derived synthetic content," and "synthetic content" as "information, such as images, videos, audio clips, and text, that has been significantly modified or generated by algorithms, including by AI."³

As a side note, these definitions arguably do not cover all systems that many people would consider to be GenAI systems. For example, many people would consider chatbots and tools that can create text responses, images, audio clips or videos based on user prompts to constitute GenAI. But if such a tool can only be used to create artwork, summarize other works, or develop harmful materials such as misinformation, the tool arguably falls outside EO 14110's definition of "AI" because such output does not constitute "predictions, recommendations, or decisions". Another argument is that the definition of "AI" is too broad. If one interprets its elements expansively—for example, by construing the word "decision" to mean any algorithmic output—then the definition arguably covers any software that runs on a machine, was designed or used by a human, and generates algorithmic output. This side note is intended to suggest that the terms "AI" and "GenAI" are not easily defined and there may be competing theories on how they should be defined.

EO 14110 calls out the need for the Federal Government to protect Americans' privacy. The order pursues this

[Page 5]

objective in various ways, including by: (i) ordering the Office of Management and Budget to develop guidance on how federal agencies should procure and process "commercially available information" in a privacy-protective way; (ii) promoting the adoption of "differential-privacy guarantees" so that datasets about groups of entities that an organization shares with another cannot easily be used to identify specific entities from that dataset; and (iii) ordering the creation of a government-funded body called the Research Coordination Network dedicated to advancing privacy research and developing privacy-enhancing technologies.⁴

On October 4, 2022, the White House issued the Blueprint for an AI Bill of Rights ("Blueprint"),⁵ which sets forth five non-legally-binding principles intended to protect people from the harms of automated systems. One of these principles is centered on data privacy.⁶ The Blueprint notes, among other things, that designers, developers and deployers of automated systems should: (i) set privacy defaults so that they conform with users' reasonable expectations; (ii) only collect personal information that is strictly necessary for the specific context; (iii) seek permission to process personal information where appropriate; (iv) provide privacy notices and consent requests in a plain language; (v) implement special protections for sensitive data; and (vi) avoid unchecked surveillance.

The Federal Trade Commission ("FTC") has also published various guidance documents focused on AI issues,⁷ including one that describes GenAI as follows:⁸

"Generative AI" is a category of AI that empowers machines to generate new content rather than simply analyze or manipulate existing data. By using models trained on vast amounts of data, generative AI can generate content—such as text, photos, audio, or video—that is sometimes indistinguishable from content crafted directly by humans. Large language models (LLMs), which power chatbots and other text-based AI tools, represent one common type of generative AI. Many generative AI models are developed using a multi-step process: a pre-training step, a fine-tuning step, and potential customization steps. These steps may all be performed by the same company, or each step may be performed by a different company.

The FTC has the authority to take privacy-related enforcement actions against companies, including under the Children's Online Privacy Protection Act and its regulations ("COPPA"), and Section 5 of the Federal Trade Commission Act ("FTC Act"), which prohibits unfair or deceptive acts or practices in or affecting commerce. The FTC has warned that AI, including GenAI, can be used to engage in privacy infringements,⁹ and published statements focused on the intersection of AI and biometric information.¹⁰

At the state level, California Governor Newsom published an executive order on GenAI on September 6, 2023.¹¹ The order requires, among other things, that a handful of state government agencies issue general guidelines for public sector procurement, uses and required trainings of GenAI that address applicable privacy risks. The order does not enumerate new privacy risks but refers to risks already outlined in the White House's Blueprint.¹²

On November 16, 2023, the California Bar's Board of Trustees approved Practical Guidance for the Use of Generative Artificial Intelligence in the Practice of Law.¹³ The guidance does not categorically prohibit lawyers from using AI, but identifies a number of ways in which lawyers' ethical and professional obligations apply to the use of GenAI. For example, the guidance reminds lawyers that GenAI raise privacy law issues and lawyers cannot counsel a client to engage in a violation of laws, or assist in any such violations, when using GenAI tools.¹⁴

On August 29, 2023, the California Privacy Protection Agency ("CPPA") published draft regulations regarding risk assessments.¹⁵ By way of background, the California Consumer Privacy Act of 2018 ("CCPA"),¹⁶ contemplates that businesses (i.e., entities that do business in California, determine the means and purposes of processing personal information and meet certain quantitative...