Laws and rulings: 629
The statutes, regulations, rulings and agency guidance the guides cite, each in its own words, read from its primary text.
- As statedRecords collected for one purpose (running a service, answering a customer) may not be…Dated18 Oct 2026SourceGDPR Article 5(1)(b): purpose limitation, European Union
- GDPR Article 6(1)(f): legitimate interests as a lawful basis (Regulation (EU) 2016/679, Art 6(1)(f))As statedThis is the lawful basis a holder would normally rely on to license its own records. It…Dated18 Oct 2026SourceGDPR Article 6(1)(f): legitimate interests as a lawful…
- As statedBefore licensing, a holder that did not tell people about AI licensing has to run this…Dated18 Oct 2026SourceGDPR Article 6(4): compatibility test for a new purpose,…
- As statedIf a new use passes the compatibility test, the holder needs no fresh lawful basis. If…Dated18 Oct 2026SourceGDPR Recital 50: further processing and the legal basis,…
- As statedSupport tickets, chat and call recordings can mention health, union membership, beliefs…Dated18 Oct 2026SourceGDPR Article 9(1): special categories of personal data,…
- As statedA holder with a direct relationship (its customers, its staff) must update its privacy…Dated18 Oct 2026SourceGDPR Article 13(3): telling people before a new purpose,…
- As statedThis exception covers people the holder never dealt with (third parties named in an…Dated18 Oct 2026SourceGDPR Article 14(5)(b): disproportionate effort, European…
- As statedIf the holder relies on legitimate interests, every person in the records can object,…Dated18 Oct 2026SourceGDPR Article 21(1): right to object, European Union
- As statedA software or service company that holds its customers' tickets, chats and recordings as…Dated18 Oct 2026SourceGDPR Article 28(3)(a): a processor acts only on the…
- As statedA processor that licenses customer data for AI training takes on controller duties for…Dated18 Oct 2026SourceGDPR Article 28(10): a processor that decides purposes…
- As statedEach Member State may add its own rules for staff data, and works agreements can add…Dated18 Oct 2026SourceGDPR Article 88(1): employee data in the employment…
- As statedEven the research route requires the work to be done on data that no longer identifies…Dated18 Oct 2026SourceGDPR Article 89(1): safeguards for research and…
- As statedThe recital names technological development and privately funded research, which is why…Dated18 Oct 2026SourceGDPR Recital 159: scientific research is read broadly,…
- As statedA US buyer that is not on the Data Privacy Framework list can receive personal data only…Dated18 Oct 2026SourceGDPR Article 46(1): appropriate safeguards for a transfer…
- As statedA licence of a large dataset to an AI buyer is a bulk, planned transfer, so this one-off…Dated18 Oct 2026SourceGDPR Article 49(1), second subparagraph: the last-resort…
- As statedThe three things a bad licence would breach (the principles and lawful basis, people's…Dated18 Oct 2026SourceGDPR Article 83(5): the higher fine tier, European Union
- As statedThe EU regulators will look for a written assessment covering the interest, the…Dated18 Oct 2026SourceEDPB Opinion 28/2024, para 66: the legitimate interest…
- As statedAdding a line about AI to a privacy policy now does not settle what people reasonably…Dated18 Oct 2026SourceEDPB Opinion 28/2024, para 92: a privacy notice is not…
- As statedReplacing names and email addresses with fake ones is the first mitigation the EDPB…Dated18 Oct 2026SourceEDPB Opinion 28/2024, para 101: masking and substituting…
- As statedThe EDPB lists a delay between announcing and using the data, and an opt-out that needs…Dated18 Oct 2026SourceEDPB Opinion 28/2024, para 102: a waiting period and an…
- As statedIf a licence is found unlawful, the regulator's menu includes deleting the dataset and,…Dated18 Oct 2026SourceEDPB Opinion 28/2024, para 114: corrective measures can…
- As statedA buyer is expected to check the source of its training data. A holder that can hand…Dated18 Oct 2026SourceEDPB Opinion 28/2024, para 129: the next party must check…
- As statedCalling a dataset or model anonymous does not make it so. A holder that says its lot is…Dated18 Oct 2026SourceEDPB Opinion 28/2024, para 134: a claim of anonymity must…
- As statedThe holder carries the burden of proof, and if the balance fails even after safeguards,…Dated18 Oct 2026SourceEDPB Guidelines 1/2024 on legitimate interest, paras 59…
- As statedDe-identifying a dataset is itself processing that needs a lawful basis and must be…Dated18 Oct 2026SourceArticle 29 Working Party Opinion 05/2014: anonymising is…
- As statedA transfer needs personal data, an exporter under the GDPR, and an importer outside the…Dated18 Oct 2026SourceEDPB Guidelines 05/2021: when a disclosure is a 'transfer'…
- As statedThe EDPB treats the derogations as exceptions for specific situations. A holder should…Dated18 Oct 2026SourceEDPB Guidelines 2/2018: Article 49 derogations are read…
- As statedA holder cannot fix staff emails, chats or recordings by asking employees to consent,…Dated18 Oct 2026SourceEDPB Guidelines 05/2020 on consent, para 21: employee…
- As statedFrance's regulator accepts legitimate interests for AI development and a commercial…Dated18 Oct 2026SourceCNIL, relying on legitimate interests to develop an AI…
- As statedThe CNIL says in terms that sharing data with third parties for a different purpose…Dated18 Oct 2026SourceCNIL, re-use of data: the compatibility test covers…
- As statedThe CNIL puts the compatibility duty on the supplier of the data, which is the holder,…Dated18 Oct 2026SourceCNIL, data acquired from a third party: the supplier must…
- As statedThe lead EU regulator did not ban AI training on legitimate interests. It required an…Dated18 Oct 2026SourceIrish DPC statement on Meta AI (21 May 2025): the…
- As statedThe Irish regulator tells anyone reusing existing data for AI to check the purpose…Dated18 Oct 2026SourceIrish DPC guidance on AI, large language models and data…
- As statedThe Italian regulator held a US AI company responsible for checking whether its training…Dated18 Oct 2026SourceItalian Garante, order against Character Technologies (3…
- As statedThis is a published example of the remedy in practice: for training data held without a…Dated18 Oct 2026SourceItalian Garante, order against Character Technologies (3…
- As statedThe Garante's 15 million euro decision on OpenAI (2 November 2024) was taken off its…Dated18 Oct 2026SourceItalian Garante press release on the OpenAI fine: removed…
- As statedThe German appeal court, refusing an injunction on a summary review, accepted economic…Dated18 Oct 2026SourceOLG Koln, 15 UKl 2/25 (23 May 2025): economic interests…
- As statedFor data posted before Meta announced AI training (10 June 2024) the court could not…Dated18 Oct 2026SourceOLG Koln, 15 UKl 2/25 (23 May 2025): people expect AI…
- As statedThe court counted de-identification (removing names, emails, phone numbers, ID and card…Dated18 Oct 2026SourceOLG Koln, 15 UKl 2/25 (23 May 2025): de-identification…
- As statedOne German regulator holds that training must comply with the GDPR but that a defect in…Dated18 Oct 2026SourceHamburg data protection authority, discussion paper on…
- As statedA holder that invested substantially in obtaining, checking or presenting a curated…Dated18 Oct 2026SourceDatabase Directive 96/9/EC, Article 7(1): the sui generis…
- As statedThis exception lets a miner copy lawfully accessible material unless the rightholder…Dated18 Oct 2026SourceDSM Directive 2019/790, Article 4: the text and data…
- As statedPrivate tickets, code and call logs can be trade secrets if they are kept secret, have…Dated18 Oct 2026SourceTrade Secrets Directive 2016/943, Article 2(1): what…
- As statedA buyer that uses a licensed secret beyond the licence is acting unlawfully, which gives…Dated18 Oct 2026SourceTrade Secrets Directive 2016/943, Article 4(3): use in…
- As statedA buyer's public summary lists licensed data only in limited form, and private…Dated18 Oct 2026SourceCommission template for the public summary of AI training…
- As statedThe UK now defines scientific research to include commercial and privately funded work,…Dated18 Oct 2026SourceData (Use and Access) Act 2025, section 67: scientific…
- As statedThe new fast-track basis (recognised legitimate interests) is limited to the listed…Dated18 Oct 2026SourceData (Use and Access) Act 2025, section 70: recognised…
- As statedAnnex 1 covers public-task requests, national security, emergencies, crime and…Dated18 Oct 2026SourceData (Use and Access) Act 2025, Schedule 4: the recognised…
- As statedThe UK now has this five-factor test in its new Article 8A, which mirrors the EU's…Dated18 Oct 2026SourceData (Use and Access) Act 2025, section 71: the UK…
- As statedConsent, research done under Article 84B, and the Annex 2 conditions make a new purpose…Dated18 Oct 2026SourceData (Use and Access) Act 2025, section 71: purposes…
- As statedA UK holder is excused from telling its own customers about a new use only for research…Dated18 Oct 2026SourceData (Use and Access) Act 2025, section 77: the research…
- As statedThe research route needs a necessity condition and safeguards, and fails where the…Dated18 Oct 2026SourceData (Use and Access) Act 2025, section 86: safeguards for…
- As statedSections 67, 70, 71 and 77 of the 2025 Act (and sections 85 and 86) have applied since 5…Dated18 Oct 2026SourceCommencement Regulations 2026 (SI 2026/82): the data…
- As statedUK personal data can go to a US buyer without further tools only if the buyer is on the…Dated18 Oct 2026SourceData Protection (Adequacy) (United States of America)…
- As statedThe ICO's own reading is that sharing personal data for a very different, unexpected…Dated18 Oct 2026SourceICO guidance, purpose limitation: a very different or…
- As statedUK law accepts commercial interests too, but a licence that could be done as well with…Dated18 Oct 2026SourceICO guidance on legitimate interests: commercial interests…
- As statedThe UK regulator expects AI developers to show why they could not use other sources, and…Dated18 Oct 2026SourceICO outcomes report on generative AI: developers must show…
- As statedThe UK regulator says the anonymising step needs a lawful basis and a stated purpose,…Dated18 Oct 2026SourceICO anonymisation guidance: the anonymising step is…
- As statedSince 2023 the Swiss Act protects only natural persons, not companies. Business records…Dated18 Oct 2026SourceSwiss Federal Act on Data Protection, Article 5: personal…
- As statedThe Swiss rule words the test differently from the EU one: the purpose must be one the…Dated18 Oct 2026SourceSwiss FADP, Article 6(3): purpose and compatible further…
- As statedA Swiss holder may send personal data to a US buyer only where the Federal Council has…Dated18 Oct 2026SourceSwiss FADP, Article 16: disclosing personal data abroad,…
- As statedDisclosing sensitive personal data to third parties is on the Act's list of personality…Dated18 Oct 2026SourceSwiss FADP, Articles 30 and 31: disclosing sensitive data…
- As statedThe Swiss fine is up to 250,000 francs, applies to a private person who acts wilfully,…Dated18 Oct 2026SourceSwiss FADP, Article 61: fine for disclosure abroad without…
- As statedSince 15 September 2024 Swiss personal data can go to a US buyer that is certified under…Dated18 Oct 2026SourceFDPIC on the Swiss-US Data Privacy Framework (15 August…
- As statedBulk disclosure of conversations, recordings and email to an AI buyer is new-technology…Dated18 Oct 2026SourceGDPR Article 35(1): data protection impact assessment,…
- As statedThe CNIL reads the compatibility test as one step and the lawful basis (for a holder,…Dated18 Oct 2026SourceCNIL, re-use of data: even a compatible purpose needs a…
- As statedThe German court says Article 6(4) gives no permission of its own, which agrees with the…Dated18 Oct 2026SourceOLG Koln, 15 UKl 2/25 (23 May 2025): Article 6(4) is not a…
- As statedA UK holder sending personal data to a US buyer that is not on the UK Extension list…Dated18 Oct 2026SourceICO transfer checklist: IDTA, Addendum or BCRs, plus a…
- As statedThe UK ceiling is 17.5 million pounds or 4 percent of worldwide turnover, whichever is…Dated18 Oct 2026SourceData Protection Act 2018, section 157: the UK maximum…
- As statedThe test is singling out, linking and inference, not just the removal of names. Free…Dated18 Oct 2026SourceArticle 29 Working Party Opinion 05/2014: removing direct…
- As statedThe ICO takes the same recipient-by-recipient view as the Court of Justice in EDPS v…Dated18 Oct 2026SourceICO anonymisation guidance: the same information can be…
- As statedA holder can test its de-identified lot by asking what a motivated person with…Dated18 Oct 2026SourceICO anonymisation guidance: the motivated intruder test,…
- As statedThe CNIL presumes research reuse is compatible, but says training a model is not a…Dated18 Oct 2026SourceCNIL, re-use of data: the research presumption and why…
- As statedAnnex 2 lists public-task and archiving disclosures, public security, emergencies,…Dated18 Oct 2026SourceData (Use and Access) Act 2025, Schedule 5: the purposes…
- As statedThe lead EU regulator let LinkedIn train on members' data after it narrowed the data and…Dated18 Oct 2026SourceIrish DPC statement on LinkedIn AI training (7 November…
- As statedThe Court accepted that earning money from disclosing members' data (here to sponsors,…Dated18 Oct 2026SourceKoninklijke Nederlandse Lawn Tennisbond (C-621/22), para…
- As statedThe Court pointed to informing people beforehand and asking them as a less restrictive…Dated18 Oct 2026SourceKoninklijke Nederlandse Lawn Tennisbond (C-621/22), para…
- As statedWhat people could expect when their data was collected decides the balance, and…Dated18 Oct 2026SourceKoninklijke Nederlandse Lawn Tennisbond (C-621/22), paras…
- As statedA corpus of tickets or chats where sensitive items cannot be separated is treated as a…Dated18 Oct 2026SourceMeta Platforms v Bundeskartellamt (C-252/21), para 89: a…
- As statedThe sui generis database right rewards the effort of collecting existing material, not…Dated18 Oct 2026SourceBritish Horseracing Board v William Hill (C-203/02): the…
- As statedA national employment-data rule does not automatically make a use of staff data lawful.…Dated18 Oct 2026SourceHauptpersonalrat (C-34/21): national employee-data rules…
- As statedWhen a buyer receives personal data as its own controller, the clauses bind it to the…Dated18 Oct 2026SourceStandard contractual clauses, Module One (controller to…
- As statedA fee for work is US-source only when the work is done in the United States, while a…Dated18 Oct 2026SourceIRC section 861(a)(3) and (4): US-source compensation for…
- As statedPay for data collection work done outside the United States is foreign-source income,…Dated18 Oct 2026SourceIRC section 862(a)(3) and (4): foreign-source compensation…
- As statedA holder who is a foreign individual or sole proprietor owes a flat 30 percent US tax on…Dated18 Oct 2026SourceIRC section 871(a)(1): 30 percent tax on US-source…
- As statedA holder that is a foreign company owes a flat 30 percent US tax on US-source…Dated18 Oct 2026SourceIRC section 881(a): 30 percent tax on US-source royalties…
- As statedThe US buyer that pays a foreign individual or partnership holder is the one who must…Dated18 Oct 2026SourceIRC section 1441(a): the payer must withhold 30 percent…
- As statedWhen the holder is a foreign company, the US buyer withholds 30 percent of a US-source…Dated18 Oct 2026SourceIRC section 1442(a): the same withholding duty applies to…
- As statedIf the US buyer pays a holder in full when it should have withheld, the buyer owes the…Dated18 Oct 2026SourceIRC section 1461: the payer is liable for the tax it was…
- As statedBackup withholding is the separate US rule for payees who give no taxpayer number. A…Dated18 Oct 2026SourceIRC section 3406(a)(1): backup withholding when a payee…
- As statedThe IRS sorts a transfer of digital content (text, code, audio, video) into one of four…Dated18 Oct 2026SourceTreas. Reg. 1.861-18(a)-(b): what a digital content…
- As statedA licence that lets the buyer only keep and use a copy for its own training looks like a…Dated18 Oct 2026SourceTreas. Reg. 1.861-18(c): copyright rights and copyrighted…
- As statedWork to create new content for a buyer is a service when the facts show the buyer is to…Dated18 Oct 2026SourceTreas. Reg. 1.861-18(d)-(e): services to develop digital…
- As statedIf a holder keeps substantial rights in its content and lets the buyer use it, the IRS…Dated18 Oct 2026SourceTreas. Reg. 1.861-18(f)(1): a transfer of a copyright…
- As statedA term-limited licence where the buyer must delete the data after a period is treated…Dated18 Oct 2026SourceTreas. Reg. 1.861-18(f)(2)-(3): a copy that is not truly…
- As statedIf a data deal is a sale of a copy, it is not a royalty and follows the sale-sourcing…Dated18 Oct 2026SourceTreas. Reg. 1.861-18(f)(2)(ii): sourcing of a sold copy,…
- As statedCalling a deal a licence does not make it a royalty for tax. The IRS looks at what the…Dated18 Oct 2026SourceTreas. Reg. 1.861-18(g)(1) and (i): the label on the…
- As statedThe US buyer withholds the full 30 percent on every royalty payment to a foreign holder…Dated18 Oct 2026SourceTreas. Reg. 1.1441-1(b)(1): withhold 30 percent unless…
- Treas. Reg. 1.1441-1(e)(4)(ii)(A): how long a Form W-8 stays valid (26 CFR 1.1441-1(e)(4)(ii)(A)(1))As statedA holder's Form W-8BEN-E lasts until the end of the third calendar year after it is…Dated18 Oct 2026SourceTreas. Reg. 1.1441-1(e)(4)(ii)(A): how long a Form W-8…
- As statedA one-time lump-sum licence fee is still withholdable income, and so is a fee paid in…Dated18 Oct 2026SourceTreas. Reg. 1.1441-2(b): what counts as fixed or…
- As statedThe treaty rate is available only to the real beneficial owner of the fee who is…Dated18 Oct 2026SourceTreas. Reg. 1.1441-6(b)(1): when a payer may apply a…
- As statedThe US buyer is the withholding agent. If it has reason to doubt a holder's treaty…Dated18 Oct 2026SourceTreas. Reg. 1.1441-7(a)-(b): who is the withholding agent,…
- As statedA holder that is a company gives the US buyer a Form W-8BEN-E to prove it is foreign.…Dated18 Oct 2026SourceIRS Instructions for Form W-8BEN-E: foreign entities…
- As statedA holder that wants a treaty rate has to deliver its W-8BEN-E before the first payment,…Dated18 Oct 2026SourceIRS Instructions for Form W-8BEN-E: give it before the…
- As statedTo claim a treaty rate a holder gives its home-country tax number (or a US one), names…Dated18 Oct 2026SourceIRS Instructions for Form W-8BEN-E: the tax number and the…
- As statedA holder who is a foreign individual or sole proprietor uses Form W-8BEN. A holder that…Dated18 Oct 2026SourceIRS Instructions for Form W-8BEN: a foreign individual who…
- As statedA buyer's vendor form that asks every payee for a W-9 does not fit a foreign holder,…Dated18 Oct 2026SourceIRS Instructions for the Requester of Form W-9: a foreign…
- As statedThe US buyer reports every royalty payment to a foreign holder on Form 1042-S, even a…Dated18 Oct 2026SourceIRS Instructions for Form 1042-S: file it even when a…
- As statedA US buyer that withholds from a foreign holder reports the tax on Form 1042, due on 15…Dated18 Oct 2026SourceIRS Instructions for Form 1042: the annual return for tax…
- As statedThe IRS's own summary: pay for services follows where the work is done, a copyright…Dated18 Oct 2026SourceIRS Publication 515 (2026): where a fee is sourced, by…
- As statedThe IRS reports know-how royalties under income code 10 and copyright or software…Dated18 Oct 2026SourceIRS Publication 515 (2026): royalty categories and income…
- As statedTable 1 is the IRS's rate sheet for royalties paid to treaty-country residents. The IRS…Dated18 Oct 2026SourceIRS Tax Treaty Table 1: treaty withholding rates on income…
- As statedSource code licensed to a US buyer takes the copyright column. A payment that depends on…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, footnotes tt and yy: software…
- As statedThe IRS list has no entry between Belgium and Bulgaria (no Brazil), none between Russia…Dated18 Oct 2026SourceIRS list of US income tax treaties A to Z: no entry for…
- As statedFor a country with no treaty the royalty columns all read 30 percent, which is the…Dated18 Oct 2026SourceIRS Tax Treaty Table 1: countries without a treaty pay 30…
- As statedColumns read industrial equipment 10, know-how 0, patents 0, film and TV 10, copyrights…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Canada, United…
- As statedAll royalty columns read 0 (treaty article 12(1)). A UK holder licensing records pays 0…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for United Kingdom,…
- As statedAll royalty columns read 0 (treaty article 12(1)). A German holder pays 0 percent.Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Germany, United…
- As statedAll royalty columns read 0, with footnote ss (15 percent only if the income belongs to a…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for France, United…
- As statedAll royalty columns read 0, with footnote ss (15 percent only if the income belongs to a…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Netherlands,…
- As statedAll royalty columns read 0, with footnote ss (15 percent only if the income belongs to a…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Ireland, United…
- As statedAll royalty columns read 0, with footnote zz (15 percent only if the income belongs to a…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Spain, United…
- As statedColumns read industrial equipment 5, know-how 8, patents 8, film and TV 8, copyrights 0.…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Italy, United…
- As statedAll royalty columns read 10 (treaty article 13(2)). A Polish holder pays 10 percent.Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Poland, United…
- As statedColumns read industrial equipment 5, and 10 for know-how, patents, film and TV, and…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Estonia, United…
- As statedAll royalty columns read 0 (treaty article 12(1)). A Swedish holder pays 0 percent.Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Sweden, United…
- As statedColumns read know-how 15, patents 15, film and TV 10, copyrights 10 (treaty article…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Israel, United…
- As statedColumns read industrial equipment 10, and 15 for know-how, patents, film and TV, and…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for India, United…
- As statedAll royalty columns read 0 (treaty article 12(1)). A Japanese holder pays 0 percent.Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Japan, United…
- As statedColumns read know-how 15, patents 15, film and TV 10, copyrights 10 (treaty article…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for South Korea,…
- As statedAll royalty columns read 5 (treaty article 12(2)). An Australian holder pays 5 percent.Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Australia, United…
- As statedAll royalty columns read 5 (treaty article 12(2)). A New Zealand holder pays 5 percent.Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for New Zealand,…
- As statedAll royalty columns read 10 (treaty article 12(2)). A Mexican holder pays 10 percent.Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Mexico, United…
- As statedColumns read industrial equipment 5, and 10 for know-how, patents, film and TV, and…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Turkiye, United…
- As statedAll royalty columns read 15 (treaty article 13(2)), with footnote vv that the Philippine…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Philippines,…
- As statedA UK holder that licenses records to a US buyer is taxed on the fee in the UK only. The…Dated18 Oct 2026SourceUS-UK income tax convention, Article 12: royalties taxable…
- As statedThe general Canadian rate is 10 percent, but copyright royalties, software and…Dated18 Oct 2026SourceUS-Canada income tax convention, Article XII as amended:…
- As statedA German holder is taxed on the licence fee in Germany only. The definition covers…Dated18 Oct 2026SourceUS-Germany income tax convention, Article 12: royalties…
- As statedAn Indian holder pays 15 percent in the US on a data licence, and the same 15 percent…Dated18 Oct 2026SourceUS-India income tax convention, Article 12: 15 percent on…
- As statedA US company that buys a licence from a holder abroad has to comply with OFAC rules on…Dated18 Oct 2026SourceOFAC FAQ 11: who must comply with US sanctions, United…
- As statedScreening a holder means checking the person and its owners against the SDN list…Dated18 Oct 2026SourceOFAC: it keeps no country list, and entities 50 percent…
- As statedOFAC does not set a fixed screening step in the regulations I read. It strongly…Dated18 Oct 2026SourceOFAC, A Framework for OFAC Compliance Commitments: a…
- As statedAs of this reading Syria is no longer a comprehensively sanctioned country. List-based…Dated18 Oct 2026SourceOFAC, Syria sanctions program changes: no comprehensive…
- As statedA US buyer cannot pay a Cuban holder or take a licence in which Cuba or a Cuban national…Dated18 Oct 2026Source31 CFR 515.201: Cuba, transactions involving Cuba or Cuban…
- As statedA US buyer cannot buy a licence from an Iranian holder, because a licence is a service…Dated18 Oct 2026Source31 CFR 560.206: Iran, no US person may deal in goods or…
- As statedA US buyer cannot take a data licence from a holder in North Korea, directly or through…Dated18 Oct 2026Source31 CFR 510.205: North Korea, importing goods, services or…
- As statedA US buyer cannot take a data licence from a holder in Crimea.Dated18 Oct 2026Source31 CFR 589.208: the Crimea region of Ukraine, importing…
- As statedA US buyer cannot take a data licence from a holder in the so-called Donetsk or Luhansk…Dated18 Oct 2026SourceExecutive Order 14065, section 1: no importation of…
- As statedA buyer keeps its screening and payment records for each holder for at least ten years.Dated18 Oct 2026Source31 CFR 501.601: keep a record of every transaction for at…
- As statedThe DOJ rule is triggered by access by a country of concern or covered person to US…Dated18 Oct 2026Source28 CFR 202.210(b)(3): a US person getting data the covered…
- As statedData collection or labelling work bought from a holder is a vendor agreement. It is…Dated18 Oct 2026Source28 CFR 202.258: a vendor agreement is any arrangement in…
- As statedA US lab that buys services from a holder in China, Cuba, Iran, North Korea, Russia or…Dated18 Oct 2026Source28 CFR 202.401(a): vendor agreements with a country of…
- As statedA platform in the US can pay a holder with a Stripe Connect account only if the holder…Dated18 Oct 2026SourceStripe Connect cross-border payouts: only between the US,…
- As statedStripe's other product pays third parties in many countries, but it is offered to…Dated18 Oct 2026SourceStripe Global Payouts: for businesses in the US and UK…
- As statedStripe Global Payouts lists Malaysia and the UAE by wire and Singapore by local bank…Dated18 Oct 2026SourceStripe Global Payouts recipient requirements: Malaysia,…
- As statedA US business can send an international wire in US dollars with the holder's name,…Dated18 Oct 2026SourceSVB (First Citizens): international wires in US dollars…
- As statedA supply by an Indian holder to a US business, paid in foreign currency, is an export of…Dated18 Oct 2026SourceIndia IGST Act 2017, sections 2(6), 13(2) and 16(1):…
- As statedA licence of records the holder owns as intellectual property is a supply of services…Dated18 Oct 2026SourceIndia CGST Act 2017, Schedule II paragraph 5(c):…
- As statedA Canadian holder that licenses its copyright or trade secrets to a US lab that is not…Dated18 Oct 2026SourceCanada Excise Tax Act, Schedule VI, Part V, section 10: a…
- As statedData collection work done for a US lab is zero-rated as a service to a non-resident, but…Dated18 Oct 2026SourceCanada Excise Tax Act, Schedule VI, Part V, section 7:…
- As statedA buyer that cannot show where the data will be used must treat the royalty as US-source…Dated18 Oct 2026SourceTreas. Reg. 1.1441-2(a): if the source of a payment cannot…
- As statedIf a contract promises the holder a fixed net amount, the buyer paying the US tax on top…Dated18 Oct 2026SourceTreas. Reg. 1.1441-3(f)(1): when the payer pays the tax…
- As statedThe Russia program works through Executive Order 14024 and the persons it blocks, who…Dated18 Oct 2026Source31 CFR 587.201: Russia, transactions prohibited under…
- As statedA holder that is controlled but not half owned by a blocked person is not automatically…Dated18 Oct 2026SourceOFAC FAQ 398: the 50 percent rule is about ownership, not…
- As statedSeveral blocked owners are added together. A holder company whose owners are, between…Dated18 Oct 2026SourceOFAC revised guidance on entities owned by blocked…
- As statedCuba now carries two sets of rules: the long-standing Cuban Assets Control Regulations…Dated18 Oct 2026SourceOFAC alert of 29 September 2026: expanded sanctions…
- As statedA buyer that paid a blocked holder without checking can still be penalised if it should…Dated18 Oct 2026Source31 CFR part 501, Appendix A: OFAC asks whether a company…
- As statedUnder the US-China treaty the US withholds 10 percent on know-how, patent, film and…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for China, People's…
- As statedUnder the US-Switzerland treaty the US withholds nothing on know-how, patent and…Dated18 Oct 2026SourceIRS Tax Treaty Table 1, royalty row for Switzerland,…
- As statedA buyer that withheld more than the tax due on a licence fee (the full default rate…Dated18 Oct 2026SourceTreas. Reg. 1.1461-2(a): a withholding agent may repay tax…
- As statedA holder company with no US trade or business whose US tax on a licence fee was fully…Dated18 Oct 2026SourceTreas. Reg. 1.6012-2(g)(2)(i): no US return for a foreign…
- As statedA holder company that had more US tax withheld than it owed (for example at the default…Dated18 Oct 2026SourceIRS Instructions for Form 1120-F: a foreign company claims…
- As statedBesides the treaty claim, the form records the holder's status under the separate FATCA…Dated18 Oct 2026SourceIRS Instructions for Form W-8BEN-E: the chapter 4 (FATCA)…
- As statedAn Indian holder whose licence fee had US tax withheld at the treaty rate can take that…Dated18 Oct 2026SourceUS-India income tax convention, Article 25: India allows…
- As statedA Singapore holder registered for GST may charge no GST on a service contracted with,…Dated18 Oct 2026SourceIRAS, Providing international services: when a Singapore…
- As statedRecords about companies (a supplier's name, its legal form, its general contact details,…Dated18 Oct 2026SourceGDPR Recital 14: the Regulation protects natural persons,…
- As statedAnything that can identify a living person, directly or through other details, is…Dated18 Oct 2026SourceGDPR Article 4(1): what personal data is, European Union
- As statedThe Court of Justice has struck down an EU-US adequacy decision before, with immediate…Dated18 Oct 2026SourceData Protection Commissioner v Facebook Ireland and…
- As statedThe UK's text and data analysis exception covers only non-commercial research by someone…Dated18 Oct 2026SourceCopyright, Designs and Patents Act 1988, section 29A: text…
- As statedThe UK keeps the same database right as the EU, on the same test of substantial…Dated18 Oct 2026SourceCopyright and Rights in Databases Regulations 1997,…
- As statedIn the UK, a buyer that uses a holder's confidential records beyond what the licence…Dated18 Oct 2026SourceTrade Secrets (Enforcement, etc.) Regulations 2018,…
- As statedWhere a German company has a works council, it must agree before the company introduces…Dated18 Oct 2026SourceGerman Works Constitution Act, section 87(1) no. 6: the…
- As statedLicensing support tickets, email, chat or call recordings to a US AI company is a…Dated18 Oct 2026SourcePIPEDA Schedule 1, clause 4.2.4: a purpose not previously…
- As statedHanding records to a buyer so it can train its own model is a disclosure for a purpose…Dated18 Oct 2026SourcePIPEDA Schedule 1, clause 4.5: no use or disclosure for…
- As statedEven with consent, the purpose itself has to pass this test. A holder should be able to…Dated18 Oct 2026SourcePIPEDA section 5(3): only purposes a reasonable person…
- As statedThe exception that lets companies share personal information without consent in a merger…Dated18 Oct 2026SourcePIPEDA section 7.2(4): the business transaction exception…
- As statedThe research exception needs all three conditions, including telling the Commissioner…Dated18 Oct 2026SourcePIPEDA section 7(3)(f): disclosure without consent for…
- As statedThe regulator singles out disclosures to third parties that use the data for their own…Dated18 Oct 2026SourceOPC, Guidelines for obtaining meaningful consent: third…
- As statedThis rule covers a service provider working for the holder (storage, support tools). A…Dated18 Oct 2026SourceOPC, Guidelines for processing personal data across…
- As statedCanada has no list of approved countries and does not ban sending personal information…Dated18 Oct 2026SourceOPC, Guidelines for processing personal data across…
- As statedThe OPC treats generative AI as fully inside current privacy law and says every party,…Dated18 Oct 2026SourceOPC, Principles for responsible, trustworthy and…
- As statedPIPEDA has no statutory definition of anonymous. The OPC's test is no serious…Dated18 Oct 2026SourceOPC, PIPEDA Findings #2026-001 (Loblaw, PC Optimum): the…
- As statedCall recordings may be used only for the purposes the customer was told, and a…Dated18 Oct 2026SourceOPC, Recording of customer telephone calls (updated 8…
- As statedOpt-out consent works only for demonstrably non-sensitive information shared in a…Dated18 Oct 2026SourceOPC, Interpretation bulletin on form of consent: when…
- As statedBill C-36 would replace Part 1 of PIPEDA, but on 2026-10-18 it is only a bill at second…Dated18 Oct 2026SourceBill C-36 (45th Parliament, 1st session), Protecting…
- As statedMy search of the Copyright Act found no text and data mining exception. After a…Dated18 Oct 2026SourceISED, Consultation on copyright in the age of generative…
- As statedIn Quebec any use beyond the purpose of collection needs consent unless an exception…Dated18 Oct 2026SourceQuebec private sector Act, section 12: use for another…
- As statedIn Quebec, removing direct identifiers makes information de-identified, not anonymous:…Dated18 Oct 2026SourceQuebec private sector Act, section 12: de-identified…
- As statedLicensing records that contain personal information to a US buyer is a communication to…Dated18 Oct 2026SourceQuebec private sector Act, section 13: communicating…
- As statedA general privacy notice does not carry a licence to an AI buyer in Quebec: the holder…Dated18 Oct 2026SourceQuebec private sector Act, section 14: consent must be…
- As statedA Quebec holder must run a privacy impact assessment before communicating personal…Dated18 Oct 2026SourceQuebec private sector Act, section 17: privacy impact…
- As statedThe exception lets an enterprise share personal information without consent only to…Dated18 Oct 2026SourceQuebec private sector Act, section 18.4: the commercial…
- As statedQuebec's anonymization standard is irreversible, at all times, for direct and indirect…Dated18 Oct 2026SourceQuebec private sector Act, section 23: when information is…
- As statedA Quebec holder that anonymizes must use a qualified supervisor and run a…Dated18 Oct 2026SourceQuebec Regulation respecting the anonymization of personal…
- As statedThe regulator says anonymized information stops being personal information and can be…Dated18 Oct 2026SourceCAI (Quebec privacy regulator): anonymised versus…
- As statedThe regulator confirms that the assessment and written agreement apply to a…Dated18 Oct 2026SourceCAI (Quebec privacy regulator): communicating personal…
- As statedA Canadian holder that sends records to a US buyer must tell individuals, in clear…Dated18 Oct 2026SourceOPC, Guidelines for processing personal data across…
- As statedA paid licence of records is a commercial activity, so PIPEDA reaches the disclosure.…Dated18 Oct 2026SourcePIPEDA sections 2 and 4(1): commercial activity, and staff…
- As statedQuebec's research route needs a written request, a privacy impact assessment that finds…Dated18 Oct 2026SourceQuebec private sector Act, section 21: communication…
- As statedLicensing records to an AI buyer is a disclosure for a secondary purpose. The holder…Dated18 Oct 2026SourcePrivacy Act 1988, Schedule 1, APP 6.1 and 6.2(a): use or…
- As statedBefore sending personal information to a US buyer the holder must take reasonable steps…Dated18 Oct 2026SourcePrivacy Act 1988, Schedule 1, APP 8.1 and 8.2(b):…
- As statedA disclosure to a recipient in a country prescribed by regulations needs no APP 8.1…Dated18 Oct 2026SourcePrivacy Act 1988, Schedule 1, APP 8.3: disclosure to a…
- As statedIf the buyer mishandles personal information in a way that would breach the APPs, the…Dated18 Oct 2026SourcePrivacy Act 1988, section 16C: the holder is accountable…
- As statedA country can be prescribed only if its laws are at least substantially similar to the…Dated18 Oct 2026SourcePrivacy Act 1988, section 100(1A): what the Minister must…
- As statedThe principal regulations under the Privacy Act (made 13 November 2025, in force 1 April…Dated18 Oct 2026SourcePrivacy Regulations 2025 (in force 1 April 2026): contents…
- As statedPersonal information is de-identified when it is no longer about an identifiable or…Dated18 Oct 2026SourcePrivacy Act 1988, section 6(1): definition of…
- As statedA business with turnover of $3 million or less is normally outside the APPs, but not if…Dated18 Oct 2026SourcePrivacy Act 1988, section 6D: a small business that…
- As statedStaff data is exempt only for acts directly related to the employment relationship. My…Dated18 Oct 2026SourcePrivacy Act 1988, section 7B(3): the employee records…
- As statedFrom 10 December 2026 an entity whose computer programs make or help make decisions that…Dated18 Oct 2026SourcePrivacy and Other Legislation Amendment Act 2024, Schedule…
- As statedA holder that no longer needs records for a permitted purpose must destroy them or…Dated18 Oct 2026SourceOAIC, APP Guidelines chapter 11: destroy or de-identify…
- As statedThe regulator says that using records collected for a service to train a model…Dated18 Oct 2026SourceOAIC, Guidance on privacy and developing and training…
- As statedThe closest worked example to a holder licensing support tickets: ask first whether the…Dated18 Oct 2026SourceOAIC, generative AI training guidance, Example 3: a bank…
- As statedSending data to the US is two tests: APP 6 (is the disclosure allowed at all) and APP 8…Dated18 Oct 2026SourceOAIC, APP Guidelines chapter 8: a cross-border disclosure…
- As statedThe holder's licence with a US buyer should itself be an enforceable contract that…Dated18 Oct 2026SourceOAIC, APP Guidelines chapter 8, paragraph 8.16: an…
- As statedProperly de-identified records are not personal information and can be licensed without…Dated18 Oct 2026SourceOAIC, De-identification and the Privacy Act: de-identified…
- As statedA holder that is paid for a licence of records containing personal information is…Dated18 Oct 2026SourceOAIC, Trading in personal information: selling or…
- As statedAustralia has no text and data mining exception and the Government has ruled one out, so…Dated18 Oct 2026SourceAttorney-General's media release (26 October 2025): the…
- As statedA second tranche of privacy reform exists only as an exposure draft. It is not law on…Dated18 Oct 2026SourceAttorney-General's Department: exposure draft Privacy…
- As statedThe proposed second tranche would strengthen consent requirements, including to trade…Dated18 Oct 2026SourceAttorney-General's Department consultation paper (August…
- As statedA holder that de-identifies records before a licence is itself making a use of personal…Dated18 Oct 2026SourceOAIC, generative AI training guidance: de-identifying…
- As statedA holder may skip the APP 8.1 steps only if it reasonably believes the US recipient is…Dated18 Oct 2026SourceOAIC, APP Guidelines chapter 8, paragraphs 8.20 and 8.21:…
- As statedLicensing support tickets, email or call recordings to a US AI company is a provision to…Dated18 Oct 2026SourcePIPA Article 18: no use beyond the collection purpose and…
- As statedSending personal information to a buyer in the United States is allowed only on one of…Dated18 Oct 2026SourcePIPA Article 28-8: cross-border transfer needs separate…
- As statedA holder may process pseudonymised information without consent for scientific research,…Dated18 Oct 2026SourcePIPA Articles 28-2 and 28-7: pseudonymised information for…
- As statedRecords that are truly anonymous, judged by time, cost and technology, are outside the…Dated18 Oct 2026SourcePIPA Article 58-2: information that no longer identifies a…
- As statedThe regulator says pseudonymised data may be used without consent for scientific…Dated18 Oct 2026SourcePIPC, March 2026 revision of the Pseudonymised Information…
- As statedTranslation of the first part: the UK review is described as the second, after the…Dated18 Oct 2026SourcePIPC, 1 October 2026: the EU and EEA are the only…
- As statedKorea has no general ban on sending data abroad, but the Protection Commission can order…Dated18 Oct 2026SourcePIPA Articles 28-9 and 28-10: the regulator can suspend a…
- As statedTranslation: under current law, data collected on consent or contract can be used for…Dated18 Oct 2026SourcePIPC, 20 August 2026: current law needs separate consent…
- As statedFor copyright, the Ministry applies the general fair use clause (Copyright Act Art.…Dated18 Oct 2026SourceKorea MCST, 18 May 2026: no text-and-data-mining…
- As statedThe Act covers information about people that arises in commercial transactions, so…Dated18 Oct 2026SourcePDPA 2010 section 4: personal data is information about an…
- As statedA data controller needs the data subject's consent to process personal data and must…Dated18 Oct 2026SourcePDPA 2010 sections 6 and 7: consent to process, and…
- As statedPersonal data may not be disclosed without consent for a purpose other than the one…Dated18 Oct 2026SourcePDPA 2010 sections 8 and 39: no disclosure for a new…
- As statedA controller may disclose for a new purpose if it reasonably believed the data subject…Dated18 Oct 2026SourcePDPA 2010 section 39(d): disclosure on a reasonable belief…
- As statedThere is a research exemption, but it applies only if the data is processed for no other…Dated18 Oct 2026SourcePDPA 2010 section 45(2)(c): processing for statistics or…
- As statedSince the 2024 amendment (the old whitelist of approved countries was deleted) a holder…Dated18 Oct 2026SourcePDPA 2010 section 129 (as amended 2024): transfer outside…
- As statedSection 12 of the amending Act, which rewrote the cross-border transfer rule in section…Dated18 Oct 2026SourceGazette P.U.(B) 522: the 2024 amendment of section 129…
- As statedTo use the consent route a holder must first give the data subject a written notice…Dated18 Oct 2026SourceCommissioner's Cross Border Personal Data Transfer…
- As statedThe Guidelines publish no list of approved or adequate countries: the holder makes its…Dated18 Oct 2026SourceCommissioner's Cross Border Personal Data Transfer…
- As statedFor a one-off licence to a US buyer the practical alternative to consent is a contract…Dated18 Oct 2026SourceCommissioner's Cross Border Personal Data Transfer…
- As statedProposal, not law (comments open to 23 October 2026). Translation: using an AI system…Dated18 Oct 2026SourceMalaysia Personal Data Protection Department, public…
- As statedProposal, not law. Translation: anonymisation may use techniques such as aggregation,…Dated18 Oct 2026SourceMalaysia Personal Data Protection Department, public…
- As statedMalaysian copyright law has only a general fair dealing exception that lists research…Dated18 Oct 2026SourceCopyright Act 1987 section 13(2) and (2A): fair dealing…
- As statedHanding records to a buyer is 'processing', which the law defines to include disclosure,…Dated18 Oct 2026SourceProtection of Privacy Law, ss. 3 and 8(b): processing…
- As statedThe law covers any data about a person who can be identified with reasonable effort,…Dated18 Oct 2026SourceProtection of Privacy Law, s. 3: personal data is data…
- As statedIn Hebrew. Para. 5.3: a legal basis must be ensured for processing personal data that…Dated18 Oct 2026SourcePrivacy Protection Authority draft guidance (28 April…
- As statedIsrael's Ministry of Justice takes the view that training a machine-learning model on…Dated18 Oct 2026SourceMinistry of Justice opinion (18 December 2022):…
- As statedIn Spanish. A deputy proposed in December 2025 to bring AI systems expressly into the…Dated18 Oct 2026SourceChamber of Deputies initiative (December 2025) to add AI…
- As statedA business may use personal information for another purpose only if it believes on…Dated18 Oct 2026SourceNew Zealand Privacy Act 2020, IPP 10: personal information…
- As statedHanding records to a buyer is a disclosure. It is allowed if the disclosure is one of…Dated18 Oct 2026SourceNew Zealand Privacy Act 2020, IPP 11: no disclosure to…
- As statedA disclosure to a US buyer is allowed only if the person authorises it after being told…Dated18 Oct 2026SourceNew Zealand Privacy Act 2020, IPP 12: disclosing personal…
- As statedThe Commissioner applies the purpose rules to AI: existing records cannot be repurposed…Dated18 Oct 2026SourcePrivacy Commissioner guidance on AI and the information…
- As statedThe Commissioner's test for what is outside the Act is practical: if anyone can link the…Dated18 Oct 2026SourcePrivacy Commissioner: information is personal information…
- As statedIsraeli personal data may go abroad only if the receiving country's law gives protection…Dated18 Oct 2026SourcePrivacy Protection (Transfer of Data to Databases Abroad)…
- As statedThe Authority, summing up an inter-ministerial report, warns that anonymised data can…Dated18 Oct 2026SourcePrivacy Protection Authority, Guide to Privacy-Enhancing…
- As statedThe base rule is consent: the law forbids processing personal data without the person's…Dated18 Oct 2026SourceUAE Personal Data Protection Law, Article 4: no processing…
- As statedRecords collected to answer a support ticket or run an account may not later be used in…Dated18 Oct 2026SourceUAE Personal Data Protection Law, Article 5: collect for a…
- As statedPersonal data includes data that can identify a person indirectly by linking, and the…Dated18 Oct 2026SourceUAE Personal Data Protection Law, Article 1: what personal…
- As statedPersonal data may leave the UAE to a country the UAE Data Office has approved as having…Dated18 Oct 2026SourceUAE Personal Data Protection Law, Articles 22 and 23:…
- As statedThe federal law does not apply to companies in free zones that have their own data…Dated18 Oct 2026SourceUAE Personal Data Protection Law, Articles 2(2)(g) and 28:…
- As statedIn Spanish. Article 2(IV) defines consent as a free, specific and informed expression of…Dated18 Oct 2026SourceMexico private-sector data protection law, Article 11: a…
- As statedIn Spanish. All processing needs the person's consent unless the law makes an exception,…Dated18 Oct 2026SourceMexico private-sector data protection law, Articles 7 and…
- As statedIn Spanish. A 'transfer' is any communication of personal data inside or outside Mexico…Dated18 Oct 2026SourceMexico private-sector data protection law, Articles 2(XX),…
- As statedIn Spanish. Personal data is any information about an identified or identifiable person,…Dated18 Oct 2026SourceMexico private-sector data protection law, Articles 2 and…
- As statedIndia has no legitimate-interest or business-improvement ground. Once the Act is fully…Dated18 Oct 2026SourceDPDP Act 2023, s.4: consent or a certain legitimate use…
- As statedOn 2026-10-18 the consent, legitimate-use, transfer, research-exemption and s.43A-repeal…Dated18 Oct 2026SourceMeitY notification G.S.R. 843(E): which DPDP Act sections…
- As statedIndia uses a negative list: transfer is allowed unless the government notifies a…Dated18 Oct 2026SourceDPDP Act 2023, s.16: transfers abroad are allowed unless…
- As statedThe Act protects only data that identifies an individual. It has no definition of…Dated18 Oct 2026SourceDPDP Act 2023, s.2(t): personal data means data about an…
- As statedA government committee states that the Copyright Act 1957 has no text and data mining…Dated18 Oct 2026SourceDPIIT working paper (Dec 2025): Indian copyright law has…
- As statedLicensing support tickets, email, chat or call recordings to a US AI company is a…Dated18 Oct 2026SourcePDPA 2012, section 13: no collection, use or disclosure of…
- As statedThe PDPC itself confines the business improvement exception for AI development to a…Dated18 Oct 2026SourcePDPC AI Recommendation and Decision Systems guidelines (1…
- As statedBefore sending data to a US buyer the holder must take steps to make sure the buyer is…Dated18 Oct 2026SourcePersonal Data Protection Regulations 2021, regulations 10…
- As statedAnonymised data is outside the PDPA, but the PDPC's test is a…Dated18 Oct 2026SourcePDPC Selected Topics guidelines (revised 23 May 2024):…
- As statedSingapore has a text-and-data-mining style exception for copying works to train or…Dated18 Oct 2026SourceCopyright Act 2021, section 244: copying for computational…
- As statedGiving personal data to another company needs the person's prior consent unless a listed…Dated18 Oct 2026SourceAPPI Article 27: provision of personal data to a third…
- As statedBefore sending personal data to a company abroad, a Japanese holder needs the person's…Dated18 Oct 2026SourceAPPI Article 28(1): provision to a third party in a…
- As statedAnonymised information may be provided to a third party without consent, but the holder…Dated18 Oct 2026SourceAPPI Article 43(4): duties when providing anonymised…
- As statedJapan's copyright exception lets a work be used for data analysis and other uses not…Dated18 Oct 2026SourceCopyright Act Article 30-4: use of works not for enjoying…
- As statedThe bill passed the Diet on 10 July 2026 and was promulgated on 17 July 2026, so it is…Dated18 Oct 2026SourcePPC notice: the 2026 amendment to the APPI passed the Diet…
- As statedA Brazilian holder needs one of the ten Article 7 bases for each use of personal data.…Dated18 Oct 2026SourceLGPD Article 7: the legal bases for processing personal…
- As statedSending personal data to a US buyer needs an adequacy decision, approved contract…Dated18 Oct 2026SourceLGPD Article 33: the only cases in which personal data may…
- As statedThe ANPD's own page names only the EU as recognised, so the United States is not on any…Dated18 Oct 2026SourceANPD international data transfer page: the European Union…
- As statedData that has been truly anonymised can be licensed outside the LGPD, but only if…Dated18 Oct 2026SourceLGPD Article 12: anonymised data is not personal data…
- As statedIn plain English: the ANPD staff note treats training a generative AI model on data…Dated18 Oct 2026SourceANPD Technical Note 39/2024 (Meta AI training case):…
- As statedTranslation: if data collected to train one model is later wanted for training another,…Dated18 Oct 2026SourceKVKK generative AI guide (Nov 2025): reusing data for a…
- As statedTranslation: data that was never linkable to a person, and data made anonymous…Dated18 Oct 2026SourceKVKK generative AI guide (Nov 2025): truly anonymous data…
- As statedA licence from a Turkish holder to a US buyer that uses the standard contract must be on…Dated18 Oct 2026SourceKVKK Standard Contract 1 (controller to controller): no…
- As statedWithout an adequacy decision or a signed safeguard, the only route is explicit consent…Dated18 Oct 2026SourceKVKK transfer By-Law Article 16: an occasional transfer is…
- As statedTranslation, under the heading countries with adequate protection: the Board has not yet…Dated18 Oct 2026SourceKVKK: the Board has not yet determined any country with…
- As statedTranslation: personal data cannot be processed without the data subject's explicit…Dated18 Oct 2026SourceLaw No. 6698 Article 5: personal data needs explicit…
- As statedTranslation: personal data may be sent abroad if a processing condition in Articles 5 or…Dated18 Oct 2026SourceLaw No. 6698 Article 9 (as amended 2024): transfer abroad…
- As statedTranslation: a personal information handler may process personal information only on one…Dated18 Oct 2026SourcePIPL Articles 13, 14 and 23: consent is the main basis, a…
- As statedTranslation: to send personal information abroad a handler must meet one of these…Dated18 Oct 2026SourcePIPL Articles 38, 39 and 41: sending personal information…
- As statedTranslation: personal information does not include information that has been anonymised;…Dated18 Oct 2026SourcePIPL Articles 4 and 73: anonymised information is not…
- As statedTranslation: a non-critical-infrastructure handler that sends abroad the information of…Dated18 Oct 2026SourceCAC 2024 Provisions on Promoting and Regulating…
- As statedTranslation: data that no authority or region has notified or publicly announced as…Dated18 Oct 2026SourceCAC 2024 Provisions, Articles 2 and 10: data not announced…
- As statedTranslation: each region and department sets its own catalogue of important data for its…Dated18 Oct 2026SourceData Security Law Articles 21 and 31: important data is…
- As statedTranslation: the Measures do not apply to organisations that research and apply…Dated18 Oct 2026SourceInterim Measures for Generative AI Services, Articles 2…
- As statedTranslation: a holder that processes personal information in order to make it anonymous…Dated18 Oct 2026SourcePIPC Pseudonymised Information Processing Guideline (March…
- As statedTranslation: providing pseudonymised information for a purpose the law allows, such as…Dated18 Oct 2026SourcePIPC Pseudonymised Information Processing Guideline (March…
- As statedAn arbitral award made in one contracting state is recognised and enforced in the others…Dated18 Oct 2026SourceConvention on the Recognition and Enforcement of Foreign…
- As statedThe United States applies the New York Convention through federal law, so an award a…Dated18 Oct 2026SourceFederal Arbitration Act, chapter 2, section 201: the New…
- As statedA holder that wins an award under the Convention has three years to ask a US court to…Dated18 Oct 2026SourceFederal Arbitration Act, chapter 2, section 207:…
- As statedThe Hague convention on enforcing foreign court judgments applies in the EU since 1…Dated18 Oct 2026SourceHague Convention of 2 July 2019 on the Recognition and…
- As statedWhen an EU holder uses the standard clauses to send personal data to a US buyer, the…Dated18 Oct 2026SourceStandard contractual clauses, Module One (controller to…
- As statedA business outside the UK that offers goods or services to people in the UK, or monitors…Dated18 Oct 2026SourceUK GDPR Article 27: representatives of controllers or…
- As statedThe Texas data broker law is now chapter 510 (redesignated from 509 in 2025; chapter 509…Dated17 Oct 2026SourceTexas Business and Commerce Code chapter 510 (Data…
- As statedDeidentified data is outside the chapter only if the broker takes technical measures,…Dated17 Oct 2026SourceTexas Business and Commerce Code §§ 510.002 and 510.003,…
- As statedThe Act prohibits a data broker from making US individuals' sensitive data available to…Dated17 Oct 2026SourceProtecting Americans' Data from Foreign Adversaries Act of…
- As statedDefines a data intermediation service: a service aiming to set up commercial…Dated17 Oct 2026SourceData Governance Act, Regulation (EU) 2022/868, European…
- As statedA non-EU DIS offering services in the Union must appoint a legal representative in a…Dated17 Oct 2026SourceData Governance Act, Regulation (EU) 2022/868, European…
- As statedThe intermediated data may be used only to put it at the disposal of data users, and the…Dated17 Oct 2026SourceData Governance Act, Regulation (EU) 2022/868, European…
- As statedThe proposed definition keeps the core test and drops the aggregator and single-holder…Dated17 Oct 2026SourceCommission proposal for a Digital Omnibus Regulation,…
- As statedChapter V applies only to personal data. If the sample is personal data when it leaves…Dated17 Oct 2026SourceGDPR Article 44 (general principle for transfers), EU
- As statedTruly anonymous data is outside the GDPR, so its transfer needs no Chapter V tool.Dated17 Oct 2026SourceGDPR Recital 26 (anonymous information), EU
- As statedWhether data is personal is judged per person. Pseudonymised data can be non-personal…Dated17 Oct 2026SourceEDPS v SRB, para 86, EU
- As statedFor the controller's own duties, identifiability is judged from the controller's side.…Dated17 Oct 2026SourceEDPS v SRB, para 111, EU
- As statedThe EDPB's view, adopted before EDPS v SRB, is that pseudonymised data stays personal…Dated17 Oct 2026SourceEDPB Guidelines 01/2025 on Pseudonymisation (version for…
- As statedThe General Court upheld the EU-US Data Privacy Framework adequacy decision.Dated17 Oct 2026SourceLatombe v Commission, judgment of the General Court, EU
- As statedThe appeal asks the Court of Justice to annul the DPF decision. On 17 October 2026…Dated17 Oct 2026SourceAppeal brought by Philippe Latombe, Case C-703/25 P, EU
- As statedAdequacy covers only US organisations on the DPF List. An organisation that is not…Dated17 Oct 2026SourceEU-US Data Privacy Framework adequacy decision, Article 1,…
- As statedFor UK holders, the ICO Addendum is appended to the EU SCCs and makes them a valid UK…Dated17 Oct 2026SourceICO International Data Transfer Addendum to the EU…
- As statedThe UK transfer test is now whether protection is 'not materially lower' than in the UK.Dated17 Oct 2026SourceData (Use and Access) Act 2025, Schedule 7 (new UK GDPR…
- As statedCovered means access by a country of concern or a covered person to government-related…Dated17 Oct 2026Source28 CFR 202.210 Covered data transaction, US (federal)
- As statedA covered person includes an entity 50 percent or more owned, directly or indirectly and…Dated17 Oct 2026Source28 CFR 202.211 Covered person, US (federal)
- As statedThe six countries of concern. Under 202.208, China includes Hong Kong and Macau.Dated17 Oct 2026Source28 CFR 202.601 Countries of concern, US (federal)
- As statedDe-identification does not take data out of the rule: bulk US sensitive personal data is…Dated17 Oct 2026Source28 CFR 202.206 Bulk U.S. sensitive personal data, US…
- As statedA US holder may not license bulk US sensitive data or government-related data to a…Dated17 Oct 2026Source28 CFR 202.301 Prohibited data-brokerage transactions, US…
- As statedDOJ requires no set wording but offers a model. The model bars resale or licensing to…Dated17 Oct 2026SourceDOJ NSD, Data Security Program: Compliance Guide, sample…
- As statedDOJ confirms that anonymised, de-identified or aggregated data is still counted.Dated17 Oct 2026SourceDOJ NSD, Data Security Program FAQs, question 22, US…
- As statedThe grace period ended on 8 July 2025. Full enforcement applies now.Dated17 Oct 2026SourceDOJ NSD FAQs, limited enforcement period to 8 July 2025,…
- As statedOnly data-related terms are tested: terms on access to and use of data, and terms on…Dated17 Oct 2026SourceData Act, Article 13(1): unfair terms unilaterally imposed…
- As statedGeneral test is gross deviation from good commercial practice. Always unfair: limiting…Dated17 Oct 2026SourceData Act, Article 13(3) and (4): the general test and the…
- As statedPresumed unfair (rebuttable): inappropriately limiting liability or remedies, extending…Dated17 Oct 2026SourceData Act, Article 13(5): terms presumed unfair, EU
- As statedA term is imposed only where the other side tried to negotiate it and could not…Dated17 Oct 2026SourceData Act, Article 13(6): when a term is 'unilaterally…
- As statedAn unfair term is cut out and the rest binds. The main subject matter and the adequacy…Dated17 Oct 2026SourceData Act, Article 13(7)-(9): severance, price carve-out,…
- As statedChapter IV is not limited to connected-product data: it reaches any private-sector data…Dated17 Oct 2026SourceData Act, Article 1(2)(c): material scope of Chapter IV, EU
- As statedConfirms the two application dates for Article 13.Dated17 Oct 2026SourceCommission FAQs on the Data Act, v1.4, Q42b: contracts…
- As statedParties may choose the law of a country outside the EU for a contract, and Article 3(4)…Dated17 Oct 2026SourceRome I Regulation, Articles 3(4) and 9: choice of non-EU…
- As statedThe duty sits on the provider of a general-purpose AI model (a model lab), not on a data…Dated17 Oct 2026SourceAI Act, Article 53(1)(d): public summary of training…
- As statedThe summary balances transparency with trade secrets: broad, not technical; it gives…Dated17 Oct 2026SourceAI Act, Recital 107: summary generally comprehensive, not…
- As statedArticle 53 applies from 2 August 2025 (fines under Art 101 from 2 August 2026); models…Dated17 Oct 2026SourceAI Act, Articles 111(3) and 113: dates for general-purpose…
- As statedIn force since late July 2026. It changes high-risk timing, Art 111(2) and adds 111(4)…Dated17 Oct 2026SourceDigital Omnibus on AI, Regulation (EU) 2026/1744 (no…
- As statedThe template does not require the specific data or works to be identified; providers may…Dated17 Oct 2026SourceCommission, Explanatory Notice (24 July 2025), paragraph…
- As statedFor data licensed from rightsholders, the template asks only whether such licences exist…Dated17 Oct 2026SourceCommission template, Section 2.2.1: what is asked about…
- As statedThe developer must post a high-level summary including the sources or owners of the…Dated17 Oct 2026SourceCalifornia Civil Code section 3111 (AB 2013, Generative AI…
- As statedThe duty falls on whoever builds or substantially modifies a public generative AI…Dated17 Oct 2026SourceCalifornia Civil Code section 3110: definitions…
- As statedAB 2013 stays enforceable: xAI did not show likely success on its takings, First…Dated17 Oct 2026SourceX.AI LLC v. Bonta, C.D. Cal., order denying preliminary…
- As statedAppeal fully briefed (reply 4 September 2026), awaiting calendaring; no decision on the…Dated17 Oct 2026SourceX.AI LLC v. Bonta, Ninth Circuit No. 26-1591 (appeal from…
- As statedMarket practice reported by a law firm: the first AB 2013 disclosures name categories…Dated17 Oct 2026SourceGoodwin, 'California's AB 2013 Takes Effect' (January…
- As statedA service supplied to a business customer is taxed where the customer is established, so…Dated17 Oct 2026SourceVAT Directive, Article 44 (general B2B place-of-supply…
- As statedWhen a supplier not established in a member state supplies a service to a business…Dated17 Oct 2026SourceVAT Directive, Article 196 (reverse charge on Article 44…
- As statedA service to a business customer is supplied where the customer belongs, so a supply to…Dated17 Oct 2026SourceValue Added Tax Act 1994, section 7A(2) (place of supply…
- As statedWhen a supplier outside the UK serves a UK business and the place of supply is the UK,…Dated17 Oct 2026SourceValue Added Tax Act 1994, section 8 (reverse charge), UK
- As statedThe US appears only on Malaysia's list of limited agreements, which cover certain income…Dated17 Oct 2026SourceInland Revenue Board of Malaysia, list of limited double…
- As statedThe IRS list of US income tax treaties goes from Luxembourg to Malta: Malaysia is not on…Dated17 Oct 2026SourceIRS, United States income tax treaties A to Z, US
- As statedA trustee's sale or licence outside the ordinary course needs notice and a hearing. If…Dated17 Oct 2026Source11 U.S.C. 363(b)(1) (sale outside ordinary course;…
- As statedWhere the PII exception is engaged, a disinterested ombudsman is appointed and reports…Dated17 Oct 2026Source11 U.S.C. 332 (consumer privacy ombudsman), US (federal)
- As statedPII is narrow: names, home addresses, email addresses, home phone numbers, social…Dated17 Oct 2026Source11 U.S.C. 101(41A) (definition of personally identifiable…
- As statedA chapter 7 trustee must turn estate property into money, which is the basis for selling…Dated17 Oct 2026Source11 U.S.C. 704(a)(1) (chapter 7 trustee's duty to…
- As statedA bankruptcy trustee may employ a professional, such as a broker to sell an estate…Dated17 Oct 2026Source11 U.S.C. 327(a) (employment of professional persons), US…
- As statedThe court may approve a percentage success fee like ours, and may later allow a…Dated17 Oct 2026Source11 U.S.C. 328(a) (terms of employment, including…
- As statedA dissolved Delaware corporation continues for 3 years (or longer if the Court of…Dated17 Oct 2026Source8 Del. C. § 278 (continuation of dissolved corporation),…
- As statedThe FTC's general power over privacy: breaking a privacy promise (deception) or causing…Dated17 Oct 2026SourceFederal Trade Commission Act section 5, unfair or…
- As statedThe FTC can order a company to delete not only data it misused but the models and…Dated17 Oct 2026SourceIn the Matter of Everalbum, Inc.: FTC finalizes settlement…
- As statedData collected from children without parental consent under COPPA had to be deleted…Dated17 Oct 2026SourceUnited States v. WW International, Inc. and Kurbo, Inc.:…
- As statedThe order required Rite Aid to delete, and tell third parties to delete, the images and…Dated17 Oct 2026SourceFTC v. Rite Aid Corporation: proposed order on facial…
- As statedLicensing personal information to an AI buyer for money, or for anything else of value,…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, definition of sell,…
- As statedOnly a transfer where the buyer takes over all or part of the business escapes the sale…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, transfer in a merger,…
- As statedData counts as deidentified (and outside the CCPA's personal information rules) only…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, definition of…
- As statedA vendor that processes customers' personal information as a service provider must be…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, definition of service…
- As statedBefore selling personal information, a covered business must tell consumers and honour…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, right to opt out of sale…
- As statedSensitive personal information (health, precise location, message contents and more)…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, right to limit use and…
- As statedMessage contents are sensitive personal information unless the business itself was the…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, definition of sensitive…
- California Consumer Privacy Act, definition of business (thresholds) (Cal. Civ. Code 1798.140(d)(1))As statedThe CCPA binds a for-profit company doing business in California that meets any one…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, definition of business…
- As statedA service provider may use customer personal information only for listed purposes…Dated17 Oct 2026SourceCCPA Regulations, service providers and contractors…
- As statedRecords that meet the CCPA deidentified standard fall outside the Act's personal…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, deidentified and…
- As statedCalifornia treats an AI system that can output personal information as holding personal…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, formats of personal…
- As statedA data practice is unfair when it causes substantial harm people cannot avoid and that…Dated17 Oct 2026SourceFederal Trade Commission Act section 5(n), standard for…
- As statedA business that sells personal information must tell consumers in advance and offer the…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, notice that personal…
- As statedPersonal information of known minors under 16 cannot be sold without affirmative opt-in…Dated17 Oct 2026SourceCalifornia Consumer Privacy Act, opt-in for consumers…
- As statedThe court-appointed ombudsman backed the sale of de-identified records once passenger…Dated17 Oct 2026SourceIn re Spirit Aviation Holdings: Consumer Privacy Ombudsman…
- As statedAlthough no state law forced it, the estate and Google adopted California's three-part…Dated17 Oct 2026SourceIn re Spirit Aviation Holdings: Consumer Privacy Ombudsman…
- As statedThe ombudsman's mandate covers consumers' personally identifiable information only;…Dated17 Oct 2026SourceIn re Spirit Aviation Holdings: Consumer Privacy Ombudsman…
- As statedThe privacy fix in the leading records sale was to leave consumer systems out entirely…Dated17 Oct 2026SourceIn re Spirit Aviation Holdings: Consumer Privacy Ombudsman…
- As statedThe privacy limit on selling personal information in bankruptcy, and the ombudsman who…Dated17 Oct 2026SourceBankruptcy Abuse Prevention and Consumer Protection Act of…
- As statedThe Wiretap Act bars intercepting email or chat and also disclosing or using contents…Dated17 Oct 2026SourceWiretap Act, interception, disclosure and use prohibited,…
- As statedA company that runs its own mail or chat system can rely on this exception only for…Dated17 Oct 2026SourceWiretap Act, provider exception, United States (federal)
- As statedUnder federal law the prior consent of one party (for example an employee who signed a…Dated17 Oct 2026SourceWiretap Act, one-party consent, United States (federal)
- As statedAccessing stored email or chat without authorization, or beyond the authorization given,…Dated17 Oct 2026SourceStored Communications Act, unlawful access to stored…
- As statedAccess authorised by the entity providing the service, or by a user for that user's own…Dated17 Oct 2026SourceStored Communications Act, provider and user authorization…
- As statedThe bar on divulging stored contents applies only to services provided "to the public";…Dated17 Oct 2026SourceStored Communications Act, public providers may not…
- As statedWhere 2702 does apply (a provider to the public), lawful consent of the sender or a…Dated17 Oct 2026SourceStored Communications Act, exceptions for disclosure of…
- As statedSince 7 May 2022 (L. 2021, c. 583, signed 8 November 2021, effective on the 180th day) a…Dated17 Oct 2026SourceNew York electronic monitoring notice law, New York,…
- As statedConnecticut requires prior written notice (a conspicuous posting counts) of the types of…Dated17 Oct 2026SourceConnecticut electronic monitoring notice law, as amended…
- As statedA Delaware employer may monitor or intercept staff email only after a daily electronic…Dated17 Oct 2026SourceDelaware notice of monitoring of telephone, email and…
- As statedMaine (LD 61, law without the Governor's signature 11 January 2026; general effective…Dated17 Oct 2026SourceMaine employer surveillance law, Maine, United States
- CCPA employment-information exemption and its 2023 sunset (Cal. Civ. Code 1798.145(m)(1)(A), (m)(4))As statedThe CCPA's carve-out for employee and applicant information expired on 1 January 2023,…Dated17 Oct 2026SourceCCPA employment-information exemption and its 2023 sunset,…
- As statedThe CCPA regulator states that employees and job applicants are consumers with CCPA…Dated17 Oct 2026SourceCalifornia Privacy Protection Agency FAQ: employee data…
- As statedThe 2022 General Counsel signalled enforcement against monitoring that chills protected…Dated17 Oct 2026SourceNLRB General Counsel memo on electronic monitoring…
- NLRB General Counsel memo rescinding GC 23-02 (NLRB Memorandum GC 25-05 (February 14, 2025), Part A)As statedThe Acting General Counsel rescinded GC 23-02 on 14 February 2025; cite the 2022 memo…Dated17 Oct 2026SourceNLRB General Counsel memo rescinding GC 23-02, United…
- As statedThe rule only rescues inadvertent disclosures made in a federal proceeding or to a…Dated17 Oct 2026SourceFederal Rule of Evidence 502(b), inadvertent disclosure of…
- As statedA tax preparer that licenses client tax information, including what sits in client…Dated17 Oct 2026SourceInternal Revenue Code, disclosure or use of information by…
- As statedA bank, lender, insurer or other financial institution may not hand customers' nonpublic…Dated17 Oct 2026SourceGramm-Leach-Bliley Act, obligations with respect to…
- As statedAlmost everything a financial institution knows about a customer counts: what the…Dated17 Oct 2026SourceGramm-Leach-Bliley Act, definition of nonpublic personal…
- As statedA website or app aimed at children under 13, or one that knows it collects from such a…Dated17 Oct 2026SourceChildren's Online Privacy Protection Act, regulations…
- As statedSince the 2025 amendments (effective June 23, 2025; compliance required by April 22,…Dated17 Oct 2026SourceCOPPA Rule, parental consent, general requirements (as…
- As statedThe FTC said in the rule itself that handing children's data to a third party for money,…Dated17 Oct 2026SourceFTC, COPPA Rule amendments, Statement of Basis and…
- As statedA school or college that takes federal funds may not release students' education…Dated17 Oct 2026SourceFERPA, release of education records only with written…
- As statedConsent to disclose student records must be signed, dated and specific: which records,…Dated17 Oct 2026SourceFERPA regulations, prior written consent to disclose…
- As statedEducation data can be released without consent only once all personally identifiable…Dated17 Oct 2026SourceFERPA regulations, release of de-identified records…
- As statedAn edtech vendor that received student records from a school may use them only for the…Dated17 Oct 2026SourceFERPA regulations, limits on redisclosure, United States…
- As statedNo business may sell, lease, trade or otherwise profit from Illinois residents'…Dated17 Oct 2026SourceIllinois Biometric Information Privacy Act, collection and…
- As statedVoiceprints and scans of face or hand geometry are biometric identifiers, and anything…Dated17 Oct 2026SourceIllinois Biometric Information Privacy Act, definitions of…
- As statedEach person whose biometric data was mishandled can sue for at least $1,000 per…Dated17 Oct 2026SourceIllinois Biometric Information Privacy Act, private right…
- As statedA business that rents, sells or delivers prerecorded video (courts have applied this to…Dated17 Oct 2026SourceVideo Privacy Protection Act, wrongful disclosure of video…
- As statedIn California every party to a confidential call must consent to its recording.…Dated17 Oct 2026SourceCalifornia Invasion of Privacy Act, recording confidential…
- As statedAnyone recorded in breach of California's privacy chapter can sue for $5,000 per…Dated17 Oct 2026SourceCalifornia Invasion of Privacy Act, civil action for…
- As statedA company selling data about its own customers, people it has a direct relationship…Dated17 Oct 2026SourceCalifornia Delete Act, definition of data broker, California
- As statedA data broker must register with the California Privacy Protection Agency by January 31…Dated17 Oct 2026SourceCalifornia Delete Act, data broker registration, including…
- As statedSince August 1, 2026, every registered data broker must pull the state's deletion list…Dated17 Oct 2026SourceCalifornia Delete Act, accessible deletion mechanism…
- As statedThe regulator confirms the August 1, 2026 start of deletion processing through its…Dated17 Oct 2026SourceCalifornia Privacy Protection Agency, data broker…
- As statedVermont's definition expressly covers licensing as well as selling, but only of data…Dated17 Oct 2026SourceVermont, definition of data broker, Vermont
- As statedA data broker must register with the Vermont Secretary of State by January 31 each year…Dated17 Oct 2026SourceVermont, annual data broker registration, Vermont
- As statedOregon requires registration before anyone collects, sells or licenses brokered personal…Dated17 Oct 2026SourceOregon, data broker registration with the Department of…
- As statedFrom January 1, 2027, no one may sell or license brokered personal data in Connecticut…Dated17 Oct 2026SourceConnecticut Public Act 26-64 (SB 4), data broker…
- As statedNew Jersey reaches the first-party seller too: a company that sells or licenses its own…Dated17 Oct 2026SourceNew Jersey P.L.2026, c.25, registration of data brokers…
- New Jersey P.L.2026, c.25, ban on selling or licensing sensitive data (N.J. P.L.2026, c.25, secs. 1…As statedIn New Jersey no controller may sell sensitive data (health, biometric, precise…Dated17 Oct 2026SourceNew Jersey P.L.2026, c.25, ban on selling or licensing…
- As statedThe first template for selling customer data out of bankruptcy: only with the whole…Dated17 Oct 2026SourceToysmart: Stipulation and Order Establishing Conditions on…
- As statedThe FTC treats a sale of customer data that breaks the seller's privacy promise as a…Dated17 Oct 2026SourceFTC press release: FTC Announces Settlement With Bankrupt…
- As statedA privacy policy that says customer data will never be shared does not lapse when the…Dated17 Oct 2026SourceFTC press release: FTC Sues Failed Website, Toysmart.com,…
- As statedThe FTC's standing conditions for a bankrupt seller whose policy promised not to sell…Dated17 Oct 2026SourceFTC Bureau of Consumer Protection letter to the RadioShack…
- As statedState attorneys general can cut a bankruptcy data sale down to a small, recent slice:…Dated17 Oct 2026SourceTexas Attorney General press release: Attorney General…
- As statedThe FTC's current position: privacy and security promises travel with the data, and any…Dated17 Oct 2026SourceFTC Chairman Andrew N. Ferguson letter to the U.S. Trustee…
- As statedThe ombudsman's headline recommendation was opt-in consent before the sale, or before…Dated17 Oct 2026SourceReport of Consumer Privacy Ombudsman Neil M. Richards in…
- As statedAn ombudsman reads the seller's privacy promises broadly (marketing claims included,…Dated17 Oct 2026SourceReport of Consumer Privacy Ombudsman in the 23andMe…
- As statedAfter Regeneron won the auction, TTAM's later $305 million bid won; the court approved…Dated17 Oct 2026SourceIn re 23andMe Holding Co.: memorandum opinion approving…
- As statedEven when the privacy policy allows the sale, a bankrupt seller still has to comply with…Dated17 Oct 2026SourceIn re 23andMe Holding Co.: section 363(b)(1) does not let…
- As statedFor deciding whether section 363(b)(1) is triggered, the court looks at the formal…Dated17 Oct 2026SourceIn re 23andMe Holding Co.: which privacy policy counts…
- As statedAn ombudsman's recommendations are advice, not conditions: where the buyer keeps the…Dated17 Oct 2026SourceIn re 23andMe Holding Co.: court declines the ombudsman's…
- As statedWhat made the sale approvable: the buyer adopted the seller's policy unchanged, kept…Dated17 Oct 2026SourceIn re 23andMe Holding Co.: buyer keeps the privacy policy,…
- As statedThe buyer commitments the court relied on in approving the sale: honor the existing…Dated17 Oct 2026Source23andMe press release (company statement): 23andMe Reaches…
- As statedThe 23andMe sale closed on July 14, 2025 as a section 363 sale.Dated17 Oct 2026SourceTTAM Research Institute press release (company statement):…
- As statedA coalition of 28 attorneys general (27 states and the District of Columbia) sued inside…Dated17 Oct 2026SourceNew York Attorney General press release: Attorney General…
- As statedStates use two tools at once in a data sale: an adversary lawsuit in the bankruptcy and…Dated17 Oct 2026SourceColorado Attorney General press release: Colorado joins…
- As statedObjecting states can trade their objection for conditions written into the sale…Dated17 Oct 2026SourceMissouri Attorney General press release: Attorney General…
- As statedWhen a data-rich company is in distress, regulators may tell customers to delete before…Dated17 Oct 2026SourceCalifornia Attorney General consumer alert: Attorney…
- 11 U.S.C. § 103(a): chapters 1, 3 and 5 apply in chapter 7, 11, 12 and 13 cases (11 U.S.C. § 103(a))As statedSection 363 (in chapter 3) and the ombudsman in section 332 apply in a chapter 7…Dated17 Oct 2026Source11 U.S.C. § 103(a): chapters 1, 3 and 5 apply in chapter…
- As statedIn an assignment for the benefit of creditors the assignee sells the assets, customer…Dated17 Oct 2026SourceFla. Stat. § 727.108: duties of an assignee for the…
- As statedAn assignment for the benefit of creditors is a state-law liquidation, run by an…Dated17 Oct 2026SourceFla. Stat. § 727.101: intent of the general assignments…
- As statedA dissolving Delaware company that sells its customer data to pay claims does so as an…Dated17 Oct 2026Source8 Del. C. § 281(b): plan of distribution of a dissolved…
- As statedA seller that puts user data into a sale process points users to their delete and export…Dated17 Oct 2026SourceCharacter.ai blog (company statement): An Update on…
- As statedForty attorneys general put the buyer conditions on the table at the first-day stage of…Dated17 Oct 2026SourceNew York Attorney General press release: Attorney General…
- As statedThe states' filed position: deletion before any sale, notice to users of the buyer's…Dated17 Oct 2026SourceStates’ Notice of Interest and Reservation of Rights in…
- As statedState attorneys general are the main objectors in a consumer data sale: most of the…Dated17 Oct 2026SourceIn re 23andMe Holding Co.: memorandum opinion approving…
- As statedIn Virginia only an exchange for money is a "sale", so a paid licence of customer data…Dated17 Oct 2026SourceVirginia Consumer Data Protection Act, definitions (sale…
- As statedHealth, biometric, precise location, children's and similar sensitive data cannot be…Dated17 Oct 2026SourceVirginia Consumer Data Protection Act, controller duties…
- As statedDe-identified data is outside "personal data", but only if the holder takes reasonable…Dated17 Oct 2026SourceVirginia Consumer Data Protection Act, processing…
- As statedThe Virginia Consumer Data Protection Act has been in force since 1 January 2023.Dated17 Oct 2026SourceVirginia Consumer Data Protection Act, effective date…
- As statedIn Colorado a transfer for any valuable consideration is a sale, so licensing customer…Dated17 Oct 2026SourceColorado Privacy Act, definitions (sale), Colorado
- As statedSensitive data (health, sex life, religion, biometrics, children and, after later…Dated17 Oct 2026SourceColorado Privacy Act, duty regarding sensitive data,…
- As statedData only counts as de-identified (and outside the Act) when all three conditions hold:…Dated17 Oct 2026SourceColorado Privacy Act, definitions (de-identified data),…
- As statedThe Colorado Privacy Act has been in force since 1 July 2023.Dated17 Oct 2026SourceColorado Privacy Act, effective date (SB 21-190, section…
- As statedConnecticut counts any valuable consideration, so a licence of customer data for AI…Dated17 Oct 2026SourceConnecticut Data Privacy Act, definitions (sale of…
- As statedSince 1 July 2026 sensitive data (now including neural data, financial account and…Dated17 Oct 2026SourceConnecticut Data Privacy Act, controller duties (sensitive…
- As statedDe-identified status requires all three steps: reasonable measures, a public commitment…Dated17 Oct 2026SourceConnecticut Data Privacy Act, definitions (de-identified…
- As statedThe Connecticut Data Privacy Act has applied since 1 July 2023; the broad P.A. 25-113…Dated17 Oct 2026SourceConnecticut Data Privacy Act, effective dates (P.A. 22-15;…
- As statedTexas counts sharing or transferring for any valuable consideration as a sale, so…Dated17 Oct 2026SourceTexas Data Privacy and Security Act, definitions (sale of…
- As statedA controller may not process sensitive data, including disclosing it for AI training,…Dated17 Oct 2026SourceTexas Data Privacy and Security Act, controller duties…
- As statedA company that sells sensitive data must post this exact notice beside its privacy…Dated17 Oct 2026SourceTexas Data Privacy and Security Act, privacy notice (sale…
- As statedTexas imposes the same three de-identification duties as duties on the holder:…Dated17 Oct 2026SourceTexas Data Privacy and Security Act, deidentified or…
- As statedThe Texas Data Privacy and Security Act has been in force since 1 July 2024.Dated17 Oct 2026SourceTexas Data Privacy and Security Act, effective date (H.B.…
- As statedOregon counts any valuable consideration, so licensing customer data for AI training is…Dated17 Oct 2026SourceOregon Consumer Privacy Act, definitions (sale), Oregon
- As statedSensitive data (including national origin, transgender or nonbinary status and…Dated17 Oct 2026SourceOregon Consumer Privacy Act, controller duties (sensitive…
- As statedOregon now bars selling data of known under-16s and precise (1,750 foot) location data…Dated17 Oct 2026SourceOregon Consumer Privacy Act, prohibited sales (under-16…
- As statedAn Oregon controller holding deidentified data must take reasonable measures, publicly…Dated17 Oct 2026SourceOregon Consumer Privacy Act, controller's use of…
- As statedThe Oregon Consumer Privacy Act has applied since 1 July 2024.Dated17 Oct 2026SourceOregon Consumer Privacy Act, operative date (2023 SB 619,…
- As statedUtah counts only money as consideration, so a cash licence of customer data is a sale…Dated17 Oct 2026SourceUtah Consumer Privacy Act, definitions (sale), Utah
- As statedUtah does not require opt-in consent for sensitive data: clear notice and a chance to…Dated17 Oct 2026SourceUtah Consumer Privacy Act, controller responsibilities…
- As statedUtah uses the three-part test inside the definition, and the current text adds that…Dated17 Oct 2026SourceUtah Consumer Privacy Act, definitions (deidentified…
- As statedMontana counts any valuable consideration, so licensing customer data for AI training is…Dated17 Oct 2026SourceMontana Consumer Data Privacy Act, definitions (sale of…
- As statedSensitive data needs the consumer's opt-in consent before processing in Montana.Dated17 Oct 2026SourceMontana Consumer Data Privacy Act, data processing by…
- As statedMontana uses the three-part de-identification test inside the definition.Dated17 Oct 2026SourceMontana Consumer Data Privacy Act, definitions…
- As statedThe Montana Act has applied since 1 October 2024; the definitions were later amended by…Dated17 Oct 2026SourceMontana Consumer Data Privacy Act, effective date (MCA…
- As statedIowa counts only money, so a cash licence of customer data is a sale consumers can opt…Dated17 Oct 2026SourceIowa consumer data protection law, definitions (sale of…
- As statedIowa needs clear notice and an opportunity to opt out before sensitive data is…Dated17 Oct 2026SourceIowa consumer data protection law, controller duties…
- As statedIowa defines de-identified data by a single linkability test, without the three duties…Dated17 Oct 2026SourceIowa consumer data protection law, definitions…
- As statedIowa's law has been in force since 1 January 2025.Dated17 Oct 2026SourceIowa consumer data protection law, effective date (2023…
- As statedDelaware counts any valuable consideration, so licensing customer data for AI training…Dated17 Oct 2026SourceDelaware Personal Data Privacy Act, definitions (sale of…
- As statedSensitive data needs the consumer's opt-in consent; a rewritten section with further…Dated17 Oct 2026SourceDelaware Personal Data Privacy Act, duties of controllers…
- As statedDelaware uses the three-part de-identification test inside the definition.Dated17 Oct 2026SourceDelaware Personal Data Privacy Act, definitions…
- As statedThe Act was approved on 11 September 2023, so it has applied since 1 January 2025.Dated17 Oct 2026SourceDelaware Personal Data Privacy Act, effective date (84…
- As statedNebraska counts any valuable consideration, so licensing customer data for AI training…Dated17 Oct 2026SourceNebraska Data Privacy Act, definitions (sale of personal…
- As statedSensitive data needs the consumer's opt-in consent before processing in Nebraska.Dated17 Oct 2026SourceNebraska Data Privacy Act, controller duties (sensitive…
- As statedNebraska imposes the three de-identification duties on the holder rather than in the…Dated17 Oct 2026SourceNebraska Data Privacy Act, deidentified data duties,…
- As statedThe Nebraska Data Privacy Act (sections 1 to 30 of LB 1074) has applied since 1 January…Dated17 Oct 2026SourceNebraska Data Privacy Act, operative date (LB 1074, sec.…
- As statedNew Hampshire counts any valuable consideration, so licensing customer data for AI…Dated17 Oct 2026SourceNew Hampshire consumer data privacy law, definitions (sale…
- As statedSensitive data needs the consumer's opt-in consent before processing in New Hampshire.Dated17 Oct 2026SourceNew Hampshire consumer data privacy law, controller…
- As statedNew Hampshire uses the three-part de-identification test inside the definition.Dated17 Oct 2026SourceNew Hampshire consumer data privacy law, definitions…
- As statedNew Jersey counts sharing or transferring for any valuable consideration, so licensing…Dated17 Oct 2026SourceNew Jersey consumer data privacy law, definitions (sale),…
- As statedSensitive data needs the consumer's prior opt-in consent before processing in New Jersey.Dated17 Oct 2026SourceNew Jersey consumer data privacy law, controller…
- As statedNew Jersey uses the three-part de-identification test inside the definition.Dated17 Oct 2026SourceNew Jersey consumer data privacy law, definitions…
- As statedApproved on 16 January 2024, the law took effect on the 365th day after, 15 January 2025.Dated17 Oct 2026SourceNew Jersey consumer data privacy law, effective date…
- As statedTennessee counts only monetary consideration, so a cash licence of customer data is a…Dated17 Oct 2026SourceTennessee Information Protection Act, definitions (sale of…
- As statedSensitive data needs the consumer's opt-in consent before processing in Tennessee.Dated17 Oct 2026SourceTennessee Information Protection Act, controller duties…
- As statedTennessee imposes the three de-identification duties on the holder rather than in the…Dated17 Oct 2026SourceTennessee Information Protection Act, de-identified data…
- As statedThe Tennessee Information Protection Act has applied since 1 July 2025.Dated17 Oct 2026SourceTennessee Information Protection Act, effective date (2023…
- As statedMinnesota counts any valuable consideration, so licensing customer data for AI training…Dated17 Oct 2026SourceMinnesota Consumer Data Privacy Act, definitions (sale),…
- As statedSensitive data needs the consumer's opt-in consent; even small businesses otherwise…Dated17 Oct 2026SourceMinnesota Consumer Data Privacy Act, responsibilities of…
- As statedMinnesota uses the three-part de-identification test inside the definition.Dated17 Oct 2026SourceMinnesota Consumer Data Privacy Act, definitions…
- As statedThe Minnesota Consumer Data Privacy Act has applied since 31 July 2025 (postsecondary…Dated17 Oct 2026SourceMinnesota Consumer Data Privacy Act, effective date (Laws…
- As statedMaryland counts any valuable consideration and also catches processors and affiliates,…Dated17 Oct 2026SourceMaryland Online Data Privacy Act, definitions (sale of…
- As statedMaryland goes beyond consent: sensitive data may be used only when strictly necessary…Dated17 Oct 2026SourceMaryland Online Data Privacy Act, controller prohibitions…
- As statedMaryland borrows a three-part definition: technical measures, a public commitment, and…Dated17 Oct 2026SourceMaryland Online Data Privacy Act, de-identified data…
- As statedThe enrolled chapter strikes "2024" and inserts "2025", so the Act took effect 1 October…Dated17 Oct 2026SourceMaryland Online Data Privacy Act, effective date (2024 Md.…
- As statedIndiana counts only monetary consideration, so a cash licence of customer data is a sale…Dated17 Oct 2026SourceIndiana consumer data protection law, definitions (sale of…
- As statedSensitive data needs the consumer's opt-in consent before processing in Indiana.Dated17 Oct 2026SourceIndiana consumer data protection law, controller duties…
- As statedIndiana uses the three-part de-identification test inside the definition.Dated17 Oct 2026SourceIndiana consumer data protection law, definitions…
- As statedIndiana's law (IC 24-15) has applied since 1 January 2026.Dated17 Oct 2026SourceIndiana consumer data protection law, effective date (SEA…
- As statedKentucky counts only monetary consideration, so a cash licence of customer data is a…Dated17 Oct 2026SourceKentucky Consumer Data Protection Act, definitions (sale…
- As statedSensitive data needs the consumer's opt-in consent before processing in Kentucky.Dated17 Oct 2026SourceKentucky Consumer Data Protection Act, controller duties…
- As statedKentucky imposes the three de-identification duties on the holder rather than in the…Dated17 Oct 2026SourceKentucky Consumer Data Protection Act, de-identified data…
- As statedRhode Island counts any valuable consideration, so licensing customer data for AI…Dated17 Oct 2026SourceRhode Island Data Transparency and Privacy Protection Act,…
- As statedSensitive data needs the customer's opt-in consent before processing in Rhode Island.Dated17 Oct 2026SourceRhode Island Data Transparency and Privacy Protection Act,…
- As statedRhode Island imposes the three de-identification duties (reasonable measures, public…Dated17 Oct 2026SourceRhode Island Data Transparency and Privacy Protection Act,…
- As statedAlabama's law starts on 1 May 2027; non-cash consideration counts as a sale only where…Dated17 Oct 2026SourceAlabama Personal Data Protection Act (HB 351, 2026), sale…
- As statedLouisiana's law starts on 1 January 2027 and counts any valuable consideration as a sale.Dated17 Oct 2026SourceLouisiana Data Privacy Act (SB 386, Act 502 of 2026), sale…
- As statedVermont's law, signed 16 June 2026, starts on 1 January 2028 and counts any valuable…Dated17 Oct 2026SourceVermont Data Privacy and Online Surveillance Act (S.71,…
- As statedVirginia's law, and the many state laws modelled on it, protect people only in their…Dated17 Oct 2026SourceVirginia Consumer Data Protection Act, definition of…
- As statedTexas excludes people acting in a commercial or employment context, so staff and…Dated17 Oct 2026SourceTexas Data Privacy and Security Act, definition of…
- As statedFair use is decided case by case on four factors. Factor four, the effect on the market…Dated17 Oct 2026SourceCopyright Act, limitations on exclusive rights: fair use,…
- As statedThe first federal appeals court to rule on AI training counted a developing market for…Dated17 Oct 2026SourceThomson Reuters v. ROSS Intelligence, Third Circuit…
- As statedThe appeals court limited its ruling to a non-generative tool built to replace the…Dated17 Oct 2026SourceThomson Reuters v. ROSS Intelligence, Third Circuit…
- As statedThe trial judge held that harm to a potential market for AI training data is enough…Dated17 Oct 2026SourceThomson Reuters v. Ross Intelligence, District of Delaware…
- As statedJudge Alsup held that training a generative model on lawfully acquired books was a fair…Dated17 Oct 2026SourceBartz v. Anthropic, order on fair use (23 June 2025):…
- As statedHow the data was acquired is judged separately from the training. Copies taken from…Dated17 Oct 2026SourceBartz v. Anthropic, order on fair use (23 June 2025):…
- As statedJudge Alsup assumed a market for licensing books to train models could develop, but held…Dated17 Oct 2026SourceBartz v. Anthropic, order on fair use (23 June 2025): the…
- As statedJudge Chhabria, like Judge Alsup, refused to count lost fees for licensing works as…Dated17 Oct 2026SourceKadrey v. Meta Platforms, order on cross-motions for…
- As statedThe court named a third kind of market harm: a model that floods the market with works…Dated17 Oct 2026SourceKadrey v. Meta Platforms, order on cross-motions for…
- As statedMeta won on the record these authors built, not on a rule that training is lawful. The…Dated17 Oct 2026SourceKadrey v. Meta Platforms, order on cross-motions for…
- As statedThe Copyright Office's view is that a working licensing market weighs against unlicensed…Dated17 Oct 2026SourceUS Copyright Office, Copyright and Artificial…
- As statedLicensing is most workable for organisations that hold large, clearly owned collections,…Dated17 Oct 2026SourceUS Copyright Office, Copyright and Artificial…
- As statedThe UK court did not decide whether training infringes, because Getty dropped that claim…Dated17 Oct 2026SourceGetty Images v. Stability AI, High Court of England and…
- As statedStatutory damages run per work infringed, from a floor set in the same subsection up to…Dated17 Oct 2026SourceCopyright Act, remedies for infringement: statutory…
- As statedTraining an AI as an intermediate step did not make the use transformative when the…Dated17 Oct 2026SourceThomson Reuters v. ROSS Intelligence, Third Circuit…
- As statedKeeping a general library of pirated copies for possible future uses was its own use,…Dated17 Oct 2026SourceBartz v. Anthropic, order on fair use (23 June 2025): the…
- As statedThe copier asked for a licence first and was refused, then obtained the content another…Dated17 Oct 2026SourceThomson Reuters v. Ross Intelligence, District of Delaware…
- As statedThe federal anti-hacking law reaches access without authorization and access beyond what…Dated17 Oct 2026SourceComputer Fraud and Abuse Act: definition of 'exceeds…
- As statedThe Supreme Court narrowed the anti-hacking law to a gates-up-or-down question: may you…Dated17 Oct 2026SourceVan Buren v. United States (Supreme Court, 3 June 2021),…
- As statedScraping pages anyone can see without logging in is unlikely to be access 'without…Dated17 Oct 2026SourcehiQ Labs v. LinkedIn, Ninth Circuit opinion on remand (18…
- As statedThe court that narrowed the anti-hacking law pointed site owners to contract, trespass,…Dated17 Oct 2026SourcehiQ Labs v. LinkedIn, Ninth Circuit opinion on remand (18…
- As statedThe scraper that won on the anti-hacking law lost on contract. The parties' stipulated…Dated17 Oct 2026SourcehiQ Labs v. LinkedIn, stipulated consent judgment and…
- As statedA platform's terms bind its account holders when they use their accounts. Scraping…Dated17 Oct 2026SourceMeta Platforms v. Bright Data, order on cross-motions for…
- As statedA platform that does not own its users' posts could not use state contract and tort law…Dated17 Oct 2026SourceX Corp. v. Bright Data, order dismissing complaint (9 May…
- As statedTrespass to chattels against a scraper needs real harm to the servers, such as impaired…Dated17 Oct 2026SourceX Corp. v. Bright Data, order dismissing complaint (9 May…
- As statedTerms a visitor must click to accept bind far more reliably than terms behind a footer…Dated17 Oct 2026SourceNguyen v. Barnes & Noble, Ninth Circuit (18 August 2014):…
- As statedReddit's claims that Anthropic broke its user agreement by scraping went back to state…Dated17 Oct 2026SourceReddit v. Anthropic, order granting motion to remand (30…
- As statedGetting around technical barriers such as CAPTCHAs to scrape copyrighted content can be…Dated17 Oct 2026SourceReddit v. SerpApi, Oxylabs, AWMProxy and Perplexity,…
- As statedGoogle's own anti-circumvention suit against the same scraping service was dismissed…Dated17 Oct 2026SourceReddit v. SerpApi, opinion and order (31 July 2026): the…
- As statedAnti-circumvention law protects real barriers (logins, encryption, challenges a bot must…Dated17 Oct 2026SourceDMCA anti-circumvention: when a measure 'effectively…
- As statedA robots.txt file is a request, not a lock: ignoring it is not circumvention under the…Dated17 Oct 2026SourceZiff Davis v. OpenAI, opinion and order denying leave to…
- As statedScraping public photos and extracting face geometry led to a nationwide class action…Dated17 Oct 2026SourceIn re Clearview AI, Inc., Consumer Privacy Litigation,…
- As statedThe data came from public websites, yet collecting biometric identifiers from it without…Dated17 Oct 2026SourceIn re Clearview AI, Inc., Consumer Privacy Litigation,…
- As statedThe case ended with a money judgment against the scraper, agreed by the parties, after…Dated17 Oct 2026SourcehiQ Labs v. LinkedIn, stipulated consent judgment (filed 6…
- As statedThe scraper had to delete the scraped profiles and the code built to use them. Scraped…Dated17 Oct 2026SourcehiQ Labs v. LinkedIn, stipulated consent judgment (filed 6…
- As statedReddit tells crawlers no in robots.txt and lets even its API partners train AI only…Dated17 Oct 2026SourceReddit v. SerpApi, opinion and order (31 July 2026):…
- As statedIn US copyright law an assignment and an exclusive licence both transfer ownership of…Dated17 Oct 2026SourceCopyright Act, definitions: 'transfer of copyright…
- As statedAn assignment or exclusive licence of copyright must be in a signed writing. An…Dated17 Oct 2026SourceCopyright Act: execution of transfers of copyright…
- As statedThe trial judge limited his ruling to a tool that returns existing text, leaving…Dated17 Oct 2026SourceThomson Reuters v. Ross Intelligence, District of Delaware…
- As statedHealth data that meets this standard is no longer individually identifiable, so it is no…Dated17 Oct 2026SourceHIPAA Privacy Rule: the de-identification standard, United…
- As statedThe first route: a qualified expert judges, for a named or anticipated recipient, that…Dated17 Oct 2026SourceHIPAA Privacy Rule: the Expert Determination method,…
- As statedThe second route: remove eighteen listed kinds of identifier, and not only the patient's…Dated17 Oct 2026SourceHIPAA Privacy Rule: the Safe Harbor method, whose…
- As statedAnything more precise than a state goes. A three-digit ZIP prefix may stay only where…Dated17 Oct 2026SourceHIPAA Safe Harbor: geography and the three-digit ZIP rule,…
- As statedOnly the year of a date tied to a person may stay, and ages over 89 (and any date that…Dated17 Oct 2026SourceHIPAA Safe Harbor: dates and ages over 89, United States…
- As statedThe list ends with a catch-all: any unique number, characteristic or code that points to…Dated17 Oct 2026SourceHIPAA Safe Harbor: any other unique number, characteristic…
- As statedRemoving the eighteen kinds is not enough if the covered entity actually knows that what…Dated17 Oct 2026SourceHIPAA Safe Harbor: the no actual knowledge condition,…
- As statedA record key may survive de-identification only if it is not derived from the person's…Dated17 Oct 2026SourceHIPAA Privacy Rule: re-identification codes, United States…
- As statedA limited data set is still protected health information. It keeps dates, town, state…Dated17 Oct 2026SourceHIPAA Privacy Rule: the limited data set, United States…
- As statedThe data use agreement limits the recipient's uses, binds its agents and forbids…Dated17 Oct 2026SourceHIPAA Privacy Rule: what a data use agreement must say,…
- As statedA covered entity or business associate cannot take money for protected health…Dated17 Oct 2026SourceHIPAA Privacy Rule: the prohibition on the sale of…
- As statedSelling identifiable health data needs a signed authorization from each patient that…Dated17 Oct 2026SourceHIPAA Privacy Rule: authorization required for a sale of…
- As statedProperly de-identified data falls outside the Privacy Rule, but handing over the…Dated17 Oct 2026SourceHIPAA Privacy Rule: uses and disclosures of de-identified…
- As statedA vendor holding a health client's data may de-identify it for its own purposes only if…Dated17 Oct 2026SourceHIPAA Privacy Rule: a business associate's permitted uses,…
- As statedThe business associate agreement is where any right to de-identify and reuse a client's…Dated17 Oct 2026SourceHIPAA Privacy Rule: what a business associate contract…
- As statedSome health information is not protected health information at all: a covered entity's…Dated17 Oct 2026SourceHIPAA definitions: protected health information, United…
- As statedHIPAA binds health plans, clearinghouses and most providers, and through the business…Dated17 Oct 2026SourceHIPAA definitions: covered entity and business associate,…
- As statedNo licence makes someone an expert; OCR looks at the person's training and actual…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): who is an…
- As statedAn expert assesses the risk for the anticipated recipients, recommends transformations,…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): how an…
- As statedHHS sets no single number for very small risk: the expert sets it for the recipient and…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): no fixed…
- As statedThe expert's report is the evidence: it must exist and be produced to the regulator on…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): methods and…
- As statedExpert determinations often carry an expiry, because what counts as reasonably available…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): time-limited…
- As statedActual knowledge is clear and direct knowledge, such as a record naming a patient's…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): what actual…
- As statedNotes, narratives and comment fields get no exemption: a name or date in prose must go…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): identifiers…
- As statedA plain hash of a patient identifier is itself an identifier under Safe Harbor; only a…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): hashed…
- As statedHIPAA does not require a contract for de-identified data, but a holder may and usually…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): data use…
- As statedSafe Harbor does not itself require removing clinicians' or staff names, though other…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): whose names…
- As statedHHS lists the three-digit ZIP prefixes that must become 000 (from 2000 Census data) and…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): the…
- As statedUnder Safe Harbor a date of service, a lab date or a ticket date tied to a patient keeps…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): dates under…
- As statedPatient information de-identified to the HIPAA standard is outside the CCPA, and loses…Dated17 Oct 2026SourceCalifornia Civil Code 1798.146: deidentified patient…
- As statedA licence of de-identified patient information with a California party must say it…Dated17 Oct 2026SourceCalifornia Civil Code 1798.148: no re-identification, and…
- As statedThe Act reaches health data held by businesses HIPAA does not cover (apps, wellness,…Dated17 Oct 2026SourceWashington My Health My Data Act: consumer health data and…
- As statedSelling identifiable consumer health data about a Washington consumer needs a signed…Dated17 Oct 2026SourceWashington My Health My Data Act: valid authorization to…
- As statedData HIPAA already governs is outside the Act, and so is data de-identified under HIPAA…Dated17 Oct 2026SourceWashington My Health My Data Act: exemptions for HIPAA…
- As statedA breach is an unfair or deceptive act under Washington's Consumer Protection Act, which…Dated17 Oct 2026SourceWashington My Health My Data Act: enforced through the…
- As statedA general-purpose model provider must be able to show it respected opt-outs from text…Dated17 Oct 2026SourceAI Act, Article 53(1)(c): copyright policy and rights…
- As statedBeyond the public summary, a general-purpose model provider keeps technical…Dated17 Oct 2026SourceAI Act, Annex XI: technical documentation on training…
- As statedA high-risk AI system's training data must be governed with records of where it came…Dated17 Oct 2026SourceAI Act, Article 10(2): data governance for high-risk…
- As statedAB 2013's twelve topics read like a provenance record: sources or owners, whether data…Dated17 Oct 2026SourceX.AI LLC v. Bonta (C.D. Cal. 2026): the topics AB 2013…
- As statedAn expert removes (suppresses), coarsens (generalises) or perturbs values until the risk…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): how an…
- As statedReleases cut differently for different recipients must not combine to identify anyone,…Dated17 Oct 2026SourceHHS OCR guidance on de-identification (2012): several…
- As statedA high-risk AI system's documentation describes its training data in datasheets,…Dated17 Oct 2026SourceAI Act, Annex IV: technical documentation for high-risk…
- As statedA platform's terms of use can bind an AI company that collects its content when the…Dated17 Oct 2026SourceReddit, Inc. v. Anthropic PBC, order granting motion to…
- As statedA company that collected data under one privacy promise cannot quietly rewrite its terms…Dated17 Oct 2026SourceFTC Technology Blog: AI (and other) Companies: Quietly…
- As statedCode an employee writes in the course of the job belongs to the company. Code a…Dated17 Oct 2026SourceCopyright Act, definition of a work made for hire, United…
- As statedFor a work made for hire the employer is the author and owns the copyright, unless a…Dated17 Oct 2026SourceCopyright Act, ownership of works made for hire, United…
- As statedHanding source code to a foreign person counts as an export under the EAR, even inside…Dated17 Oct 2026SourceExport Administration Regulations, definition of export…
- As statedFootage belongs first to whoever shot it. A production company or creator that licenses…Dated17 Oct 2026SourceCopyright Act, ownership of copyright: initial ownership,…
- As statedIn California, a services contract clause that lets someone make a digital replica of a…Dated17 Oct 2026SourceCalifornia Labor Code section 927: contract provisions for…
- As statedOklahoma's law, enacted in 2026, starts on 1 January 2027 and counts only monetary…Dated17 Oct 2026SourceOklahoma Consumer Data Privacy Act (SB 546, 2026), sale…