The Sedona Conference Working Group 11 Meeting

The panel will lead a dialogue with all members in attendance on the brainstorming group’s outline on the topic. In light of the ever-increasing number of privacy and data security laws being enacted and updated, including data localization laws, the brainstorming group has been exploring the complex decisions global companies face regarding privacy and data security compliance and considering approaches to global compliance, and whether work product on this topic – and in what form – would be useful to practitioners.

A panel of WG11 drafting team members and a leading jurist will lead a dialogue on a second draft of a Commentary which: (1) identifies and explains the legal principles a U.S. court would likely apply if asked to enforce an order entered under the GDPR by an EU court (or alternatively a Data Protection/Supervisory Authority (DPA) or the European Data Protection Board (EDPB)) against a U.S.-based company; and, (2) evaluates whether under those principles, a U.S. court would likely enforce various categories of orders that might be entered under the GDPR (e.g., injunctive orders, administrative actions, damage awards, penalty assessments).

A panel will lead a dialogue with all members in attendance on a draft of a Commentary which will explore what it means to have an “explainable” AI system, leveraging existing guidance provided by global regulators and industry groups, and will set forth foundational design principles that should be incorporated into legal standards governing AI transparency. The Commentary will articulate what the law should require regarding what, how, and to whom to disclose as it pertains to AI-based systems that rely on personal information to make decisions.

A panel will lead a dialogue with all members in attendance on a draft of a Commentary with principles that is being developed to guide the development of data breach notification laws. Drawing upon best practices in data privacy and incident response, the Commentary and principles will describe how data breach notification laws should address different aspects of data breach notification, including what constitutes a notifiable breach, what methods of notification should be permissible, and whether there should be timelines for notification.