Legal News

The prohibitions span manipulative practices; AI that takes advantage of people with disabilities; social scoring; some versions of predictive policing; facial-recognition repositories like Clearview AI; and biometric classification. They also extend to emotion-detection tools in schools and workplaces, and to real-time Remote Biometric Identification ( RBI) in places open to the public, save in narrowly defined situations. From February 2025, EU member states may introduce domestic rules governing these exceptional deployments of real-time RBI. However, until August 2025 there is no duty to appoint data protection regulators to supervise them. This gap is partly bridged because every law-enforcement use of real-time RBI must be reported to the relevant privacy authorities......

To conclude, although ISO 42001 calls for many measures akin to those set out by the AI Act, the latter tends to be narrower and more detailed. Following the ISO framework will often assist with meeting legal duties, including under the AI Act, and in some circumstances could even be sufficient; however, this may prompt competent authorities to judge that ISO compliance is not the same as AI Act compliance, even where obligations intersect. Overlapping requirements, different focus ISO 42001 and the AI Act diverge conceptually and in their respective legal character significantly: ISO 42001 is a voluntary standard centred on organisational AI management and governance, whereas the AI Act is a mandatory regulation directed at product safety and oversight. Even so, ISO 42001 offers a practical baseline for tackling AI compliance efforts. For illustration, the AI Act demands that high‑risk AI systems enable automatic event logging...

The Court of Appeal of the Unified Patent Court found that the lower court had gone beyond the relief sought when it prohibited Sibio Technology UK, a competitor to Abbott Diabetes Care, from selling its devices in Ireland, which had merely signalled a non-binding intention to join the bloc's patent system. Ireland was not a contracting member state and therefore could not be treated as covered by Abbott's request for a preliminary injunction, the appellate court said. Abbott's unit, which sells its Free Style Libre devices for people with diabetes, sought a preliminary injunction in all contracting member states where the patent in issue was in force, namely the Netherlands, Germany, France, Ireland and the UK, according to the judgment. The first court held that ......

In July 2024, the dominant search and advertising firm announced it would roll out a user-choice cookie prompt in Chrome. People will be able either to retain third-party cookies—the adtech sector’s principal mechanism for targeted advertising—or select a ‘new experience’ intended to help them ‘make an informed choice that applies across their web browsing’. Four years after first saying it planned to scrap third-party cookies in the world’s dominant Internet browser, Google is now leaving it to consumers to decide whether advertisers can continue to reap the benefits of cross-site tracking for targeted ads. That change places fresh attention on the Commission, which has pressed for cookie choices in browser settings since putting forward the e- Privacy Regulation in 2017. The draft law has spent six years in legislative limbo. By confirming it will retain third-party cookies while expanding user options within Chrome, Google...

Consult Practice Note...

AI is transforming operations across intellectual property, contract drafting, negotiations in corporate transactions, data protection and employment, and it is markedly and notably influencing sectors such as technology, media and telecommunications ( TMT), a core contributor to Ireland’s economic growth. The EU AI Act takes effect on 1 August 2024 and aims to promote ethical AI development while safeguarding fundamental rights and safety. Although enforcement will roll out in phases, with the first duties applying from 2 February 2025, Irish businesses are encouraged to start reviewing their AI use, including tools like spam filters, and to grasp the relevant risk categories and obligations. This also presents a chance to align corporate practices with existing data privacy and cybersecurity laws. Active engagement with the new framework will be crucial for Irish businesses to responsibly realise AI’s benefits and remain legally compliant. Doing so will ensure Irish...

They concern EU government institutions, pursuant to EU Regulation 2018/1725. That Regulation sets the rules for safeguarding personal data within EU government institutions, bodies, offices and agencies, and empowers the supervisor as the institutions’ independent data protection authority. While these guidelines are limited to EU governmental entities, they shed light on how the supervisor may handle generative AI in the future. Given the recently adopted EU Artificial Intelligence Act, due to take effect over the coming years, and the accelerating global shift towards AI regulation, the guidelines hint at what might become the next stage of AI oversight in Europe, the UK, the US and elsewhere. For clarity, generative AI denotes advances in computer deep learning models built to deliver a broad and general spectrum of outputs, able to perform a variety of tasks and uses, such as producing text, images or audio. The most...

Commission coordinates action by national consumer protection authorities against Meta on 'pay or consent' model Today, the Consumer Protection Cooperation ( CPC) Network dispatched a letter after raising doubts that Meta’s ‘pay or consent’ approach could infringe EU consumer rules. The Commission coordinated the move, which is headed by the French Directorate General for Competition, Consumer Affairs and Fraud Prevention. The initiative began in 2023, straight after Meta suddenly asked users to either pay a subscription to access Facebook and Instagram or agree to Meta processing their personal data to deliver personalised advertising from which Meta profits (‘pay or consent’). Consumer protection bodies reviewed several aspects that may amount to misleading or aggressive practices, notably whether Meta offered consumers upfront information that was accurate, transparent and sufficient. They examined if such information enabled people to grasp the consequences of choosing to pay, or to accept the...

In the EU’s lower-tier General Court, judges held that the Commission was entirely within its rights to classify Byte Dance as a gatekeeper, marking the first substantive ruling delivered under the new Digital Markets Act ( DMA). In a statement, the court said Byte Dance’s submissions lacked adequate and convincing evidence to clearly rebut the presumption that the company has a significant impact on the internal market, that Tik Tok serves as an important gateway enabling business users to reach their end users, and that Byte Dance holds an entrenched and durable position. In September 2023, the Tik Tok platform was labelled a core platform service, alongside other providers including Alphabet ( Google’s parent), Amazon, Apple, Meta Platforms and Microsoft......

See Practice Note: Ireland— Assigning rights under contracts Consult Practice Note: Ireland—transferring rights in contracts...

Ryan initiated a judicial review against the DPC regarding its probe into Google and the ‘real-time bidding’ system. This mechanism underpins the online advertising ecosystem, which finances much of the modern internet. ‘ The DPC’s half-decade refusal to investigate Google’s massive data breach is inexplicable’, Ryan said publicly in a statement issued ahead of that hearing last year. ‘ We are asking the Irish High Court to formally order the DPC to finally do its job’, he said at the time. ‘ Having worked in the [real-time bidding] industry, I know how dangerous these data are when placed in the wrong hands’......

Statement regarding High Court Judgments of 20 June 2024 in Reddit Incorporated and Coimisiún na Meá;n and Tumblr and Coimisiú;n na Meán We welcome the Court’s judgment and its affirmation of our designation of Reddit and Tumblr as Video- Sharing Platform Services. We are progressing our draft Online Safety Code and anticipate having it in place later this year, as an element of our overall Online Safety Framework, as planned. We remain dedicated to deploying our full suite of powers to enhance online safety for people in Ireland and throughout Europe. This piece was originally published by MLex, a Lexis Nexis® company, on 25 June 2024, and appears here with permission. Visit MLex for further details and to request a free trial......

Proving genuine use of a brand The need to evidence genuine use means even household names must assemble robust proof if they intend to enforce their intellectual property, legal experts say. BDB Pitmans partner Dennis Lee observed that the key lesson from the ruling is a reminder to global giants that an overly bullish brand protection strategy does not always pay off. In June 2024, the EU’s General Court overturned exclusive protection for the Big Mac trade mark covering “chicken sandwiches”, along with certain other goods and services. The court held that Mc Donald’s materials showed use of the Big Mac branding for items such as beef burgers, yet failed to establish use in relation to poultry products. This development is simply the latest step in a long-running tussle between Mc Donald’s and Irish fast food chain Supermac’s, which began when Mc Donald’s...

After a famously gruelling final bout of political bargaining in December, the EU’s AI Act cleared its last hurdle, acclaimed as a flagship victory for a Union long eager to cement its role as the global leader on digital regulation. The text is slated for publication in the EU’s Official Journal next month, with entry into effect 20 days thereafter, in August 2024. Attention has therefore shifted firmly to implementation—particularly to the often opaque, highly specialised, somewhat arcane sphere of technical standards. Such standards are granular, detailed sets of technical specifications that help industry demonstrate technical conformity with legislation. They have long served to harmonise technical and safety requirements. Once largely unnoticed, standards have now taken on clear strategic significance. The landscape is also unsettled, as a recent EU court judgment could fundamentally reshape the very basis on which standards...

At a glance The EU GIA outlines measures to accelerate the deployment of high-speed fibre‑optic internet and 5G—known as very high‑capacity networks ( VHCNs)—by 2030: Shared infrastructure: promoting the joint use of ducts and poles for VHCN roll‑out to maximise resources and lower costs Co‑deployment and coordination of civil works: enabling VHCN operators to work alongside public works so fibre can be installed concurrently, minimising disruption and speeding up broadband expansion Streamlined administrative procedures: simplifying processes for network deployment across the EU to cut bureaucracy and raise efficiency High‑speed‑ready buildings: encouraging buildings to include high‑speed‑ready infrastructure and ensuring access to it to support broadband roll‑out and adoption As Margrethe Vestager, Executive Vice‑ President for a Europe Fit for the Digital Age, observes, removing red tape and ensuring swift, dependable connectivity is vital for the digital transition, serving both citizens and...

Update to a recent blog post In an update to a recent blog post on its push to create AI for Europeans in ‘a transparent and responsible way’, Meta said it was disappointed by a request from the Irish Data Protection Commission (its lead EU privacy regulator) to postpone training its large language models on images, posts and other public content shared by adult users of Facebook and Instagram. The company, which owns both platforms, maintained it is highly confident its approach aligns with European laws and regulations, noting that since March 2024 it has kept data protection authorities across the EU informed and incorporated their feedback during development. Meta argued the move is a setback for European innovation and competition in AI, and will further delay delivering the benefits of AI to people in Europe. It also pointed out that using public data to train...

In recent months, solicitors have been guiding business clients on evaluating the risks posed by their artificial intelligence ( AI) systems and on taking immediate steps to establish internal governance frameworks, so that organisations keep pace with compliance under the far-reaching new law, approved by the Council of the EU in May 2024 and phased in across the next 36 months. Gibson Dunn & Crutcher LLP partner Joel Harrison, co-chair of the firm's privacy, cybersecurity and data innovation practice group, told Law360 that numerous companies are working out internally where responsibility for AI governance should sit within current corporate arrangements, a task complicated by lingering ambiguities in the statute. He said many organisations are wrestling with the placement of AI governance and how the new AI rules intersect with their data privacy and security practices, as they determine how these...

Meta is facing complaints from 11 European data protection authorities After announcing a privacy policy revision signalling it would use personal data to develop ‘ AI technology’, Meta now faces formal complaints from 11 European data protection authorities. Max Schrems’ campaign group NOYB has lodged cases with privacy watchdogs in Austria, Belgium, France, Germany, Greece, Ireland, Italy, the Netherlands, Norway, Poland and Spain, urging the regulators to urgently stop the change before it takes effect on 26 June. NOYB has specialised in strategic complaints, including those that led to the invalidation of Meta’s legal basis under contract for processing personal data for advertising. Since then, Meta has switched to the ‘legitimate interest’ legal basis. While the General Data Protection Regulation sets out six potential legal bases for processing personal data, the prevailing doctrine arising from data protection authorities’ guidance and decisions has......

MLex: Meta Platforms' legal basis to process data to train artificial intelligence models is already facing scrutiny Last week, the social media behemoth told Facebook users it would henceforth depend on the 'legitimate interests' ground under the General Data Protection Regulation ( GDPR) to 'develop and improve AI at Meta'. The change sits within its EU and UK launch of AI tools, forming part of a wider rollout overall, and will take effect from 26 June......

AI providers in the EU AI firms operating in the EU, including Open AI, and their users are unlikely to face a standalone AI product liability regime, as EU governments and the European Parliament doubt the need for one. Most countries prefer to wait for the outcome of the Parliament’s study, an EU official told MLex, with France and the Netherlands particularly sceptical. The prevailing worry is that the sector could be over-regulated. Such an AI liability law would ease the burden of proof for individuals seeking compensation for harm linked to AI systems, and impose fresh disclosure duties on systems labelled ‘high-risk’ under the EU AI Act. Member States concur that addressing liability in the AI context matters. However, the EU Product Liability Directive, approved in March 2024, together with existing national liability frameworks, may already suffice, MLex...