Kathrin Gardhouse

Anonymized and pseudonymized medical data are at the heart of cutting-edge research and innovation in healthcare. By stripping away personal identifiers and adding additional privacy-preserving measures, these data allow for advanced studies without compromising the privacy of individuals.In Japan, as elsewhere, the path to leveraging this valuable resource has been complex due to the need to balance large-scale data use with privacy protection. Thus, under the Act on the Protection of Personal Information (APPI) healthcare providers have faced challenges in sharing and processing medical data for research and innovation purposes, primarily due to strict consent requirements.

As the world gears up for the AI Action Summit in Paris in February 2025, global policymakers, researchers, and industry leaders are turning their attention to a landmark publication: The International AI Safety Report 2025. This report, a collaborative effort by 96 AI experts from around the world, represents the most comprehensive scientific assessment to date of the risks posed by general-purpose AI—a rapidly advancing form of AI with the ability to perform a wide range of tasks.

The European Data Protection Board (EDPB) has recently provided critical guidance on ensuring GDPR compliance during the development and deployment of AI models.

The US insurance industry operates under a complex landscape of privacy laws and regulations designed to protect consumers’ personal information. At the heart of this regulatory framework are standards developed by the National Association of Insurance Commissioners (NAIC), alongside federal and state laws like the Gramm-Leach-Bliley Act (GLBA).

Quebec’s new Act Respecting Health and Social Services Information (ARHSSI) introduces a notable tightening of data privacy requirements within the province, with a distinct emphasis on safeguarding health and social services information.

We previously wrote about Unlocking Compliance with the Japanese Data Privacy Act (APPI) using Private AI and are now following up with an assessment of the Interim Report on Considerations for the Triennial Review of the Act on Protection of Personal Information (Interim Report).

The Office of the Superintendent of Financial Institutions (OSFI) has set forth guidelines to ensure that Federally Regulated Financial Institutions (FIs) maintain robust data security, risk management, and operational resilience. Private AI’s advanced machine learning and natural language processing technologies provide helpful tools that can help FRFIs meet these requirements efficiently and effectively.

For the longest time, the US was one notable outlier in the global trend of developing federal-level comprehensive privacy laws.

China’s Personal Information Protection Law (PIPL) that come into force November 1, 2021 sets out stringent requirements for the handling,

Acting on its obligations flowing from a 2023 Executive Order, the US Department of Commerce’s National Institute of Standards and Technology (NIST) has recently released two new tools to aid companies developing Generative AI models (GenAI) do so responsibly and securely.

Under the APPI, businesses must adhere to strict rules regarding the processing of personal information, in particular when it comes to the disclosure or transfer of such information.

As the European Union continues to strengthen its data protection and artificial intelligence (AI) regulations, organizations are seeking innovative ways to ensure compliance. Private AI, a cutting-edge approach to machine learning that prioritizes data privacy, has emerged as a powerful tool in this landscape.

Personally identifiable information (PII) is any data that can be used to identify an individual directly or indirectly, such as their name, social security number, date of birth, gender, ZIP code, and more.

Ontario’s Bill 194, formally known as the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024, represents a crucial legislative shift, aiming to fortify digital security and elevate trust within public sector entities.

In the rapidly evolving landscape of generative AI, distinct regulatory and ethical approaches have emerged, reflecting the values, ambitions, and constraints of various global players.

On May 3, 2024, the OECD released updated AI Principles that build upon the 2019 version with some notable differences.

Under the General Data Protection Regulation (GDPR), consent is only one of the legal bases that can be used to process personal data, including when using Large Language Models (LLMs) to boost the efficiency of processing personal information.

The healthcare sector has witnessed a remarkable evolution in data privacy legislation from the 1970s to the present, mirroring the technological innovations of the time.

The healthcare sector in the United States has seen a profound transformation in its approach to data privacy, paralleling significant technological advancements, in particular the electronic health record (EHR).

There are lots of risks involved with implementing AI systems into an organization’s environment, some of which are not even known or knowable at this time.

The WHO’s publication of its Ethics and governance of artificial intelligence for health: Guidance on large multi-modal models from January 18, 2024 is an almost 100 page document, including over 20 pages of footnotes, which takes a deep dive into the risks and challenges of Large Multi-Modal Models (LMMs) developed, provided, and/or deployed for health care purposes.

Many of the security measures businesses put in place to protect the personal information of their customers and employees will also help safeguard confidential corporate information.

In recent years, the emergence of artificial intelligence (AI) and machine learning technologies has created new possibilities for various fields, including the legal sector.

In recent years, the advent of artificial intelligence (AI) and machine learning technologies has revolutionized a range of industries, not least of which is Human Resources (HR).

In recent years, the emergence of artificial intelligence (AI) and machine learning technologies has opened up a wealth of opportunities across various sectors, including the banking industry.

The landscape of data protection and privacy has undergone significant transformations worldwide, with Quebec’s Law25 emerging as a pivotal legislative piece within Canada.

While the recent Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence advocates for a federal privacy law to be enacted, at this time it is still the states leading the way.

In recent years, the global landscape of data privacy regulations has evolved significantly, with countries enacting stringent laws to protect individuals’ personal information.

Tokenization is an increasingly popular method used in data security, especially in areas that require the handling of sensitive data like financial transactions. But what exactly is tokenization, and how does it bolster data protection?

End-to-end privacy management refers to the process of protecting sensitive data throughout its entire lifecycle, from the moment it is collected to the point where it is destroyed.

Generative AI has become a cornerstone of modern technology, with potential applications ranging from content creation and customer service to scientific research and healthcare.

This last part of our series gets a bit more technical when discussing attacks on AI Models with the goal of obtaining illicit access to the data, as well as re-identification attacks launched against the data used by AI developers to train the model.

Despite the promising signs of AI used in healthcare that we explored in Part 1 of this series, ethical concerns persist regarding the potential misuse of these innovations and safeguarding health data.

AI is revolutionizing medicine by venturing into uncharted territories and addressing significant global healthcare challenges.

About a year ago we covered the 2022 Cost of a Data Breach Report by IBM. The 2022 report had surfaced that the cost was highest in the healthcare and financial industry, followed by pharmaceuticals and technology.

PHI stands for "Protected Health Information" and can include information about an individual such as blood type, condition, injury, etc. This term is subject to a lengthy and complex definition in a regulation under the US Health Insurance Portability and Accountability Act of 1996 (HIPAA), which we will examine in detail below.

PCI is often mentioned in the triage PII, PHI and PCI in the context of data protection. PCI stands for “Payment Card Industry” data, which includes information such as bank account numbers, credit card numbers, card expiration dates, CVV numbers, etc.

With data privacy becoming an increasingly hot topic as major data breaches make headlines around the globe, the biggest question typically is: “What PII was exposed?” But what is PII? PII stands for "Personally Identifiable Information."

The latest data breaches are a regular topic in the news. Raising awareness about the prevalence and severity of the issue, as well as how the financial impact on the business can be limited is what we contribute with this article.