Archive: August 2024

On August 13, 2024, the New York Attorney General announced a settlement agreement, along with the Attorneys General of Connecticut and New Jersey, with Enzo Biochem Inc. and its subsidiary corporation, Enzo Clinical Labs, Inc., regarding a security incident that occurred in April of 2023. The settlement includes a $4.5 million payment to be divided among the three Attorneys General, as well as a series of actions Enzo must undertake relating to privacy and security. Notably, according to the agreement, Enzo had not implemented several security measures identified in a third party vendor HIPAA risk assessment in 2021, which may have prevented or minimized the impact of the 2023 incident and illustrates the importance of timely remediation of security gaps. Furthermore, entities covered by HIPAA and the SHIELD Act should keep in mind that the New York Attorney General may pursue enforcement actions based on potential violations of HIPAA, as the agreement found that Enzo violated the HIPAA Security Rule and Breach Notification Rule and that these violations would also constitute a violation of New York’s SHIELD Act. The agreement expressly states that it “is not intended, and should not be construed, as an admission of liability by” defendants, and they do not admit or deny the findings in the agreement.

In 2024, many organisations have been eager to look at how they can use the data they hold to debut or build on their AI programme. Many are looking to use that data to train AI models, or fine-tune third-party models. That data will almost certainly include personal data, meaning that the processing must comply with the General Data Protection Regulation (GDPR) in the EU or UK.

The case of Robert Kneschke v. LAION e.V. marks a significant milestone in the legal landscape concerning the use of copyright works for AI training.
As the first of its kind in Germany, the outcome of the case has the potential to reshape the intersection of AI development and copyright law, setting a precedent with broad implications for the AI industry and intellectual property protection.
With many stakeholders tracking the case closely, the decision in the case could influence similar legal battles across Europe and beyond.