On Episode 20 of Covington’s Inside Privacy Audiocast, Dan Cooper, Co-Chair of Covington’s Data Privacy and Cyber Security practice, and Christian Ahlborn, Partner in Covington’s Competition practice, discuss the recently enacted EU Digital Markets Act (DMA) in the first part of our “Competition and Privacy” mini series.
For
EMEA Tech Regulation
EDPS Issues Opinion on Negotiating Directives for Council of Europe’s AI Convention
By Dan Cooper, Lisa Peets, Sam Jungyun Choi & Laura Somaini on
Posted in Artificial Intelligence (AI), EMEA Tech Regulation
On October 13, 2022, the European Data Protection Supervisor (“EDPS”) released its Opinion 20/2022 on a Recommendation issued by the European Commission in August 2022 calling for a Council Decision authorising the opening of negotiations on behalf of the European Union for a Council of Europe convention on artificial intelligence…
Continue Reading EDPS Issues Opinion on Negotiating Directives for Council of Europe’s AI ConventionEuropean Commission Publishes Directive on the Liability of Artificial Intelligence Systems
On September 28, 2022, the European Commission published its long-promised proposal for an AI Liability Directive. The draft Directive is intended to complement the EU AI Act, which the EU’s institutions are still negotiating. In parallel, the European Commission also published its proposal to update the EU’s 1985 Product Liability Directive. If adopted, the proposals will change the liability rules for software and AI systems in the EU.
The draft AI Liability Directive establishes rules applicable to non-contractual, fault-based civil claims involving AI systems. Specifically, the proposal establishes rules that would govern the preservation and disclosure of evidence in cases involving high-risk AI, as well as rules on the burden of proof and corresponding rebuttable presumptions. If adopted as proposed, the draft AI Liability Directive will apply to damages that occur two years or more after the Directive enters into force; five years after its entry into force, the Commission will consider the need for rules on no-fault liability for AI claims.
As for the draft Directive on Liability of Defective Products, if adopted, EU Member States will have one year from its entry into force to implement it in their national laws. The draft Directive would apply to products placed on the market one year after it enters into force.Continue Reading European Commission Publishes Directive on the Liability of Artificial Intelligence Systems
EU Adopts Digital Services Act
On October 4, 2022, the EU adopted the Digital Services Act (“DSA”), which imposes new rules on providers of intermediary services (e.g., cloud services, file-sharing services, search engines, social networks and online marketplaces). The DSA will enter into force on November 16, 2022 — although it will only fully apply as of February 17, 2024. Continue Reading EU Adopts Digital Services Act
The Digital Markets Act for Privacy Professionals
Posted in EMEA Tech Regulation, European Union
This post is the first of a series of blog posts about the Digital Markets Act (“DMA”), which was adopted on July 18, 2022, and it deals specifically with those provisions of the DMA that are relevant to organizations’ privacy programs.Continue Reading The Digital Markets Act for Privacy Professionals
Nearing the Finish Line: Updates on the Digital Services Act
Posted in Digital Services Act, EMEA Tech Regulation
The Digital Services Act (“DSA”) is nearing final approval. The DSA imposes new rules on providers of intermediary services (e.g., cloud services, file-sharing services, search engines, social networks and online marketplaces). As we reported in July, the European Parliament voted to adopt the DSA on 5 July 2022. As we wait for the Council to adopt it, there have been a couple of updates in recent weeks, which we set out below. We will keep this blog updated as the finish line approaches.Continue Reading Nearing the Finish Line: Updates on the Digital Services Act
EU Publishes Draft Cyber Resilience Act
On September 15, 2022, the European Commission published a draft regulation that sets out cybersecurity requirements for “products with digital elements” (PDEs) placed on the EU market — the Cyber Resilience Act (CRA). The Commission has identified that cyberattacks are increasing in the EU, with an estimated global annual cost of €5.5 trillion. The CRA aims to strengthen the security of PDEs and imposes obligations that cover:
- the planning, design, development, production, delivery and maintenance of PDEs;
- the prevention and handling of cyber vulnerabilities; and
- the provision of cybersecurity information to users of PDEs.
The CRA also imposes obligations to report any actively exploited vulnerability as well as any incident that impacts the security of a PDE to ENISA within 24 hours of becoming aware of it.
The obligations apply primarily to manufacturers of PDEs, which include entities that develop or manufacture PDEs as well as entities that outsource the design, development and manufacturing to a third party. Importers and distributors of PDEs also need to ensure that the products comply with CRA’s requirements.
The requirements apply for the lifetime of a product or five years from its placement on the market, whichever is shorter. Due to the cross-border dimension of cybersecurity incidents, the CRA applies to any PDEs that are placed on the EU market—regardless of where they are manufactured—and imposes new mandatory conformity assessment requirements. The proposed regulation will now undergo review and potential approval in the Council of the EU and the European Parliament. Its provisions would apply fully within two years after entry into force, potentially in late 2026. We set out more detail and commentary below based on our initial review of the proposal.Continue Reading EU Publishes Draft Cyber Resilience Act
UK Government Sets Out Sector-Specific Vision for Regulating AI
The UK Government recently published its AI Governance and Regulation: Policy Statement (the “AI Statement”) setting out its proposed approach to regulating Artificial Intelligence (“AI”) in the UK. The AI Statement was published alongside the draft Data Protection and Digital Information Bill (see our blog post here for further details…
Continue Reading UK Government Sets Out Sector-Specific Vision for Regulating AIEuropean Parliament Adopts DSA
By Dan Cooper, Sam Jungyun Choi & Laura Somaini on
On July 5, 2022, the European Parliament adopted the Digital Services Act (“DSA”) with 539 votes in favor, 54 votes against and 30 abstentions, following the political deal reached on April 23, 2022 (see our previous blog here).
Key aspects
The DSA is addressed to providers of intermediary services…
Continue Reading European Parliament Adopts DSAPolitical Agreement Reached on New EU Horizontal Cybersecurity Directive
By Mark Young & Tomos Griffiths on
In the early hours of Friday, 13 May, the European Parliament and the Council of the EU reached provisional political agreement on a new framework EU cybersecurity law, known as “NIS2”. This new law, which will replace the existing NIS Directive (which was agreed around the same time as GDPR, see here) aims to strengthen EU-wide cybersecurity protection across a broader range of sectors, including the pharmaceutical sector, medical device manufacturing, and the food sector.Continue Reading Political Agreement Reached on New EU Horizontal Cybersecurity Directive