Clifford Chance

Big Tech players continued to make bold moves in the Artificial Intelligence ("AI") space. Elon Musk founded a new company, X.AI, dedicated to AI and shared his plan to create "TruthGPT": "a maximum truth-seeking AI that tries to understand the nature of the universe." Amazon Web Services unveiled Amazon Bedrock, a new service which gives customers access to a range of foundation models (the ultra-large machine learning models that generative AI relies on), allowing them to select the models that best meet their specific needs. Google promised to release new AI-powered search tools as early as next month.

Meanwhile, legislators and regulators around the world have rushed to grapple with current and future issues posed by AI. The European Data Protection Board ("EDPB") set up a dedicated ChatGPT task force, as legislators from the European Parliament published an open letter calling on European Commission President Ursula von der Leyen and U.S. President Joe Biden to organise a “high-level global summit on artificial intelligence".

After its dramatic decision to block ChatGPT from operating in Italy, the Italian regulator, the Garante, may lift its ban if OpenAI makes changes.

The pre-occupation with AI has extended beyond Europe: China's Cyberspace Administration issued a consultation draft on generative AI and its Electronics Standardization Institute published guidelines on AI ethics; four federal U.S. agencies released a joint statement pledging their commitment to combating discrimination and bias in automated systems; and Canada's Office of the Privacy Commissioner launched an investigation into OpenAI.

APAC (excluding China)

Vietnam issues its personal data protection decree

On 18 April 2023, Vietnam issued its first ever comprehensive legislation regulating personal data protection: Decree No. 13/2023/ND-CP on the Protection of Personal Data (the "PDPD"). The law will generally apply to both local and offshore businesses engaging in personal data and is largely based on the European Union's privacy law, the GDPR. Its provisions establish data protection principles, data subject rights, and data controller and data processor obligations. It also requires impact assessments and notifications to be submitted to the implementing agency (the cybersecurity department of the Ministry of Public Security) for cross-border transfers.

India's upcoming common regulatory framework for crypto

After a series of bankruptcies and business failures in the industry last year, crypto is critical to India's Group of 20 (G20) presidency. On Monday 3 April, India's Finance Minister, Nirmala Sitharaman said: "Cryptocurrencies are a very important part of the discussion under the G20 presidency, given so many collapses and shocks. We seek to develop a common framework for all countries to deal with this matter." The Financial Stability Board is expected to submit recommendations on the regulation of cryptoassets and stablecoin by this July and is scheduled to release a joint paper with the International Monetary Fund on cryptoassets in September.

Australian senator submits a new crypto bill

Australian Senator, Andrew Bragg, has submitted a new Bill, the "Digital Assets (Market Regulation) Bill 2023", to Parliament. Although Australia's government has made some progress in regulating digital assets, Bragg has expressed frustration at the slow pace of its actions. His Bill proposes new regulations for cryptocurrency firms, including requirements in relation to digital asset exchange, digital asset custody and stablecoin issuance.

Hong Kong's commitment to regulating the Web3 industry

There was some discussion about the regulation of Web3 and DeFi at the recent four-day Web3 Festival. Paul Chan Mo-po, said "The premise of Web3 development is that the stability of the financial system and investor protection should not be damaged … I believe that everybody has learned from recent events that appropriate regulations are a must to create a sustainable development environment." Meanwhile, Keith Choy, interim Head of the Intermediaries Division at the Securities and Futures Commission ("SFC") said that the SFC viewed the regulatory requirements which apply to traditional financial activity as also applying to DeFi activity: "as long as DeFi activity holds within the scope of securities and futures, it would be subject to the same regulatory requirements applicable to traditional financial activity."

China

CAC publishes a consultation draft on generative AI

On 11 April 2023, the Cyberspace Administration of China ("CAC") issued a consultation draft of the Administrative Measures on Generative Artificial Intelligence Services. The draft proposes a set of obligations covering content security, data security, algorithm security and cybersecurity for AI-Generated Content ("AIGC") for providers of generative AI systems offered to consumers in China. The draft measures provide, among other things, that AIGC products or service-providers should ensure that AIGC is authentic and accurate and take measures to prevent disinformation. AIGC providers are responsible for the legitimacy of the source of the pre-training data used and the data used for optimized training. They also need to submit applications to internet regulators for security review and register algorithms with regulators. Violations may lead to fines of up to RMB 100,000 and the suspension or termination of services in serious cases. Comments on the consultation draft are due by 10 May 2023.

China Electronics Standardization Institute publishes guidelines on AI ethics

On 13 April 2023, the China Electronics Standardization Institute published the Standardization Guidelines on Ethical Governance of Artificial Intelligence. The guidelines consist of six chapters, focusing on the concept and scope of AI ethics, the ethical risk assessment of AI, ethical governance techniques and tools, the construction of a standard system for the ethical governance of AI, the construction of key standards, and recommendations.

EU

European Parliament reach provisional deal on EU AI Act

On 27 April, members of European Parliament reached provisional political agreement about the EU Artificial Intelligence Act, the EU's legislative proposal to regulate AI. The text may still be subject to small adjustments before a vote on 11 May, but it is expected to go to a plenary vote in June. A European Parliament official reportedly said "We have a deal now in which all groups will have to support the compromise without the possibility of tabling alternative amendments". Among other things, the Act is concerned with AI's potential to cause harm and the current draft classifies AI tools in accordance with their perceived risk level. Companies deploying generative AI tools, such as ChatGPT, will also need to disclosure any copyrighted material used to develop their systems.

EU Chips Act: Agreement reached

European legislators struck a provisional deal on the proposed new EU Chips Act on 18 April 2023. The aim of the new Regulation is to create the conditions for the development of an industrial base that can double the EU’s global market share in semiconductors from 10% to at least 20% by 2030. The Act is expected to raise €43 billion in public and private investment, with €3,3 billion of EU money. A new Chips Joint Undertaking will be responsible for the selection of centres of excellence. The text must now be finalised, endorsed, and formally adopted by both the European Parliament and Council.

Data transfers: European Parliament Committee criticises proposed new EU-US Data Privacy Framework ("DPF")

On 13 April 2023, the European Parliament's Civil Liberties Committee voted to oppose the adoption of a new draft adequacy decision proposed by the European Commission on the EU-US DPF. MEPs argued that the DPF does not provide sufficient safeguards as it still allows for the bulk collection of personal data in certain cases, does not make bulk data collection subject to independent prior authorisation and does not provide clear rules on data retention. MEPs also criticised the proposed new Data Protection Review Court which is intended to provide redress to EU data subjects because (i) its decisions would be secret and would therefore violate data subjects' right to access and rectify their personal data and (ii) the US President can dismiss its judges and overrule its decisions. The Committee's opinion will now go to a plenary session of the European Parliament. The Parliament's opinion is advisory only; it is up to the Member States to greenlight the decision which is adopted by the Commission.

ChatGPT: EDPB creates task force

Following the unilateral enforcement actions undertaken last month by the Italian Data Protection Authority (DPA) and the Spanish DPA's preliminary investigation announcement regarding Open AI’s ChatGPT service, the EDPB has decided to set up a dedicated task force to foster cooperation and exchange information on possible enforcement actions conducted by DPAs across the EU. Meanwhile, France's Digital Minister Jean-Noël Barrot, has said that ChatGPT should not be banned per se, but that the aim of any action should be to frame the technology in order for it to become compliant with data protection rules.

New EU Algorithmic Transparency agency

On 17 April 2023, the new European Centre for Algorithmic Transparency ("ECAT") was set up in Seville, Spain. ECAT is tasked with providing the European Commission with in-house technical and scientific expertise to ensure that algorithmic systems used by the Very Large Online Platforms ("VLOPs") and Very Large Online Search Engines ("VLOSEs") comply with the risk management, mitigation and transparency requirements of the new Digital Services Act ("DSA"). ECAT researchers will identify and address systemic risks stemming from VLOPs and VLOSEs, but also investigate the long-term societal impact of algorithms.

UK

Heads of encrypted chat apps cry out against Online Safety Bill

On 17 April 2023, the heads of Whatsapp, Signal and five other encrypted chat apps published an open letter to the UK government describing the Bill as "an unprecedented threat to the privacy, safety and security of every UK citizen". The executives explain that "the Bill provides no explicit protection for encryption, and if implemented as written, could empower OFCOM to try to force the proactive scanning of private messages on end-to-end encrypted communication services – nullifying the purpose of end-to-end encryption as a result and compromising the privacy of all users". However, a No 10 spokesperson is quoted as saying that the Bill "does not represent a ban on end-to-end encryption, nor will it required services to weaken encryption".

UK Parliament calls for written evidence on the Data Protection and Digital Information (No. 2) Bill

The Data Protection and Digital Information (No. 2) Bill ("the DPDI Bill"), which, amongst other things, amends the UK GDPR and Data Protection 2018 in areas such as automated decision making, data protection impact assessments ("DPIAs"), data protection officers, privacy and electronic communications (e.g. cookies) and introduces frameworks for the regulation of customer and business data, was introduced to the House of Commons on 8 March and was debated at second reading on 17 April 2023. On 18 April 2023, the UK Parliament invited those with relevant expertise and experience or a special interest in the DPDI Bill to submit their views to the House of Commons Public Bill Committee as soon as possible. The Public Bill Committee is expected to sit on 10 May and will scrutinise the Bill further.

ICO publishes its response to the government's AI White Paper

The UK Information Commissioner's Office ("ICO") published its largely supportive response to the government's White Paper on AI, "A Pro-Innovation Approach to AI regulation", on 11 April 2023. The ICO welcomed the government's "vision to make the UK the best place in the world to found and grow an AI business and translate AI's potential into growth and societal benefits". The ICO also agreed that the government's approach to AI governance should be "context-specific, risk-based, coherent, proportionate and adaptable." However, it did suggest further clarity on points such as the respective roles of government and regulators in the issuing of any guidance about a proposed joint regulatory sandbox.

Americas

Bipartisan tech antitrust bills reintroduced in US Senate

Two bipartisan bills aimed at limiting the control of "Big Tech" over online platforms and advertising markets were reintroduced this term after failing to receive a floor vote last term.

The first, called the "Advertising Middlemen Endangering Rigorous Internet Competition Accountability (AMERICA) Act," is intended "to prevent conflicts of interest and promote competition in the sale and purchase of digital advertising." The bill, introduced by Sen. Mike Lee (R-UT) on 30 March 2023, would prohibit large digital advertising companies from owning both supply-side and demand-side platforms within the digital advertising ecosystem and would place several fiduciary obligations on digital advertising companies. The bill is substantively identical to the "Competition and Transparency in Digital Advertising Act" bill that Senator Lee introduced in May 2022, which (similar to its US House equivalent) saw no action after being referred to the Senate Judiciary Committee.

The second, entitled the "Journalism Competition and Preservation Act," is intended to "provide a temporary safe harbor for publishers of online content to collectively negotiate with dominant online platforms regarding the terms on which content may be distributed." The bill, which was introduced by Sen. Amy Klobuchar (D-MN) and John Kennedy (R-LA) on 31 March 2023, would permit eligible providers of digital journalism to coordinate in dealing with digital platforms, including by jointly denying access to content and jointly negotiating pricing, terms, and conditions, without violating any federal or state antitrust laws. A substantively identical bill passed the Senate Judiciary Committee in the previous term by a bipartisan vote of 15-7.

Federal agencies release statement pledging to protect the public from AI basis

On 25 April 2023, the Equal Employment Opportunity Commission, the Federal Trade Commission, the U.S. Department of Justice and the Consumer Financial Protection Bureau released a joint statement outlining the potentially discriminatory effects of automated systems and AI and pledging to "promote responsible innovation" and "protect individuals' rights" going forward. The statement describes automated systems as having "the potential to perpetuate unlawful bias, automate unlawful discrimination, and produce other harmful outcomes" and stresses that existing legal authorities apply to the use of automated systems and new technologies.

Bill introduced to require online platforms to report drug activity to government

A new bill introduced in the US Senate would establish a duty for social media companies and other electronic communication service providers to report information on the sale or distribution of controlled substances in violation of the Controlled Substances Act to federal law enforcement. In introducing the bill, the senators' announcement described the bill as "requir[ing] Big Tech companies to take a more proactive role against drug dealers preying on America’s youth on social media." The bill was referred to the Senate Judiciary Committee for review.

Middle East

Presight AI signs memorandum of understanding with Senegalese ministry

On 8 April, the Senegalese Minister in charge of Communication, Telecommunications and the Digital Economy announced the signing of a Memorandum of Understanding ("MoU") with Presight AI, a Group 42 company (Group 42 is an AI and cloud computing company founded in Abu Dhabi). The MoU aims to accelerate digital transformation initiatives and their corresponding economic benefits for Senegalese citizens. The Ministry will work closely with Presight AI to use big data analytics and AI technology to transform government services and enhance the efficiency of government operations. Thomas Pramotedham, Presight AI's CEO, said “Presight is very pleased to be supporting Senegal’s MCTEN in advancing its digital initiatives. Our company's deep expertise in big data analytics powered by AI will be utilized to better serve MCTEN's strategic objectives and drive Senegal's digital transformation initiatives forward. We look forward to working closely with MCTEN to deliver tangible benefits for the people of Senegal.”

UAE Council discuss the adoption of AI technologies in digital services

The UAE Council for Artificial Intelligence and Blockchain held its first meeting at the Ministry of Finance in Dubai. Omar Sultan Al Olama, the Minister of State for Artificial Intelligence, Digital Economy and Remote Work Applications stated that the UAE leadership believes in promoting collaboration between federal government entities and local government entities, as well as building stronger bonding with the private sector. He said that the UAE government remained committed to advancing its operational frameworks, finding solutions to challenges, and speeding up the process of digital transformation. Younis Haji Al Khouri, the Undersecretary of the Ministry of Finance and a Council member said: "the Ministry of Finance is committed to collaborating with all relevant entities to accomplish the Council's objectives and fulfil the visionary leadership's ambitions of positioning the UAE as a global leader in artificial intelligence by 2031."

Africa

Rwandan Parliament approves draft digital identity card law

The General Assembly of the Chamber of Deputies in Rwanda has approved the revision of a draft law that will allow the government to start issuing digital identity cards for all Rwandans, including those in diaspora. The scheme aims to address problems faced by stateless and other undocumented people in the country. The proposal was tabled by Paula Ingabire, the Minister of ICT and Innovation, on 20 April 2023 who said: “the enactment of the new law relating to registration in a single digital identity system will enable the country to fill the existing gaps in the current population identification system for a more advanced, effective and efficient service delivery in private and public sectors.”

Kenya rolls out fibre optic cable connectivity to marginalised areas

On 18 April 2023, Kenya's Communications Authority and ICT Authority signed a Technical Cooperation Agreement to support the deployment of fibre optic cable connectivity in 19 counties in Kenya. The Universal Service Fund will support the rollout of the infrastructure and communications services involved. The scheme supports the government's broader Governmental Digital Transformation Agenda.

Additional Information

This publication does not necessrily deal with every important topic nor cover every aspect of the topics with which it deals. It is not designed to provide legal or other advice. Clifford Chance is not responsible for third party content. Please note that English language translations may not be available for some content.

The content above relating to the PRC is based on our experience as international counsel representing clients in business activities in the PRC and should not be construed as constituting a legal opinion on the application of PRC law. As is the case for all international law firms with offices in the PRC, whilst we are authorised to provide information concerning the effect of the Chinese legal environment, we are not permitted to engage in Chinese legal affairs. Our employees who have PRC legal professional qualification certificates are currently not PRC practising lawyers.