Data Privacy and AI: Global Legal Update 2024

The global regulatory landscape for artificial intelligence (AI) and data privacy is rapidly evolving. With the increasing integration of AI into various industries, the need for comprehensive legal frameworks has become critical. This update, led by Fiona Coombe, Director of Legal and Regulatory Research at Staffing Industry Analysts (SIA), provides a detailed overview of recent developments in AI and data privacy regulations across different regions.

Key Global Developments

On August 1, 2024, the European Union (EU) marked a significant milestone by enacting the AI Act, the world’s first comprehensive legal framework for AI. The AI Act focuses on fostering trustworthy AI systems, ensuring they respect fundamental rights, safety, and ethical principles. This law is expected to impact businesses far beyond the EU’s borders, influencing global AI regulations. Similar to the impact of the General Data Protection Regulation (GDPR), this act will apply to AI systems placed on the market or used within the EU, targeting providers, deployers, and users of AI technologies.

Across the globe, countries are now crafting their own strategies for AI regulation. For example, while the US lacks federal AI legislation, several states have introduced consumer privacy laws incorporating AI usage restrictions. India, a prominent player in the AI and data privacy space, passed the Digital Personal Data Protection Act (DPDPA) in 2023 and continues to develop a broader regulatory framework through the proposed Digital India Act.

Region-by-Region Overview

Americas

In the US, AI regulation is fragmented, with no binding federal laws specifically governing AI. However, individual states like Colorado have introduced laws to regulate AI in sectors like employment, housing, and healthcare. In October 2023, President Biden issued an executive order to address AI development, focusing on transparency, worker empowerment, and protecting labor rights. Meanwhile, Canada is debating Bill C-27, which would enact the Consumer Privacy Protection Act (CPPA) and the Artificial Intelligence and Data Act (AIDA). These laws aim to update outdated data protection legislation and regulate high-impact AI systems, particularly in employment-related decisions.

Europe, Middle East, and Africa (EMEA)

The EU continues to lead AI regulation efforts with the AI Act, which takes a risk-based approach to classifying AI technologies. Systems that pose unacceptable risks, such as social scoring, are banned, while high-risk AI systems, including those used in recruitment, are subject to stringent compliance requirements. Enforcement of the AI Act will begin in phases, with full implementation by 2027, accompanied by hefty penalties for non-compliance, up to 7% of global revenue or EUR 35 million.
The UK, post-Brexit, is taking a more flexible approach to AI regulation, preferring guidance over statutory rules to avoid stifling innovation. However, the recent change in government may lead to stricter AI laws aligned more closely with the EU.

Asia-Pacific (APAC)

In the APAC region, India’s DPDPA, which came into effect on September 1, 2023, regulates personal data processing, aligning closely with GDPR principles. India is also developing AI-specific regulations through the proposed Digital India Act and AI advisory groups. Countries like China and Japan are also actively drafting AI governance frameworks, while others like Singapore have introduced best practices for responsible AI development.

Latin America

Latin American countries are rapidly progressing in AI regulation. Brazil is leading the way with a comprehensive AI Bill, which would create a dedicated regulatory body and impose civil liabilities on AI developers and deployers. Argentina and Colombia are similarly working on bills to regulate AI systems, while Mexico and Chile are focused on ethical AI development and protecting human rights.

Conclusion

The global trend toward stricter data privacy and AI regulation is evident across all regions. The implications for businesses, particularly those in the staffing and employment sectors, are profound. Employers and staffing firms, which process vast amounts of personal data, must stay abreast of these regulations to ensure compliance. The 2024 AI Act in the EU, India’s DPDPA, and various state laws in the US represent just the beginning of a broader movement toward responsible AI and data privacy governance.