With the use of artificial intelligence (“AI”) becoming more pervasive every day, it should not surprise our readers that regulators are increasingly focused on the use of AI and its associated consumer data privacy implications. For example, recently announced regulations expanding on the requirements of the New Jersey Data Privacy Act (the “NJDPA”) attempt to address AI privacy concerns. Below, we briefly discuss the NJDPA, the proposed regulations concerning AI privacy, and their effects on businesses.
AI Privacy Regulations
With its use becoming commonplace, AI implicates privacy concerns that have been the focus of federal and state lawmakers and regulators. One such example of this AI privacy scrutiny is illustrated by recently proposed NJDPA regulations. Like states that have enacted their own data privacy laws, such as California, Virginia, and Florida, the NJDPA imposes data privacy obligations on companies that meet certain threshold requirements. The NJDPA applies to entities that do business in New Jersey or produce products or services targeted to New Jersey residents and during a calendar year, either: (a) “control or process the personal data of at least 100,000 consumers, excluding personal data processed solely for the purpose of completing a payment transaction; or (b) control or process the personal data of at least 25,000 consumers and the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data.”
While companies may use collected data for internal research purposes, the NJDPA’s proposed regulations explicitly state that using data to train AI shall not be considered internal research unless the consumer affirmatively consents to such use. Consent must be obtained through a disclosure that, among other things, is “understandable and accessible to consumers” and is “accurate, and not written or presented in a way that is unfair, deceptive, or misleading.” The disclosure(s) must also provide a level of detail that gives consumers a meaningful understanding of how each category of personal data is used, and if the data is used for more than one purpose, the disclosure must specify each purpose containing enough detail to allow consumers to understand each said purpose.
What Do The NJDPA’s AI Privacy Regulations Mean For You?
The FCC already has declared that an AI-generated call is an artificial or prerecorded voice call for purposes of the Telephone Consumer Protection Act (“TCPA”). Telemarketers subject to the NJDPA, and who utilize AI, must tread carefully to ensure that their use of consumer data does not extend to using said data to train AI, as doing so requires obtaining consumer consent beforehand through highly detailed disclosures.
Companies that use AI and/or those that incorporate AI-generated calls and/or texts into their marketing operations should consult with legal counsel to ensure that their practices comport with the latest federal and state rulemakings.
The attorneys at Klein Moynihan Turco (“KMT”) are well-informed of federal and state marketing regulations and stay on top of the rapidly-shifting AI privacy landscape. In addition, KMT’s attorneys have decades of experience in defending companies involved in marketing-related lawsuits. If you need a law firm that has an extensive history in the data privacy and telemarketing fields, please email us at info@kleinmoynihan.com or call us at (212) 246-0900.
The material contained herein is provided for informational purposes only and is not legal advice nor is it a substitute for seeking legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.
Attorney Advertising
Photo by Igor Omilaev on Unsplash
Similar Blog Posts:
Is TCPA Consent Rule Really Dead?! Maybe Not, Say 28 States
