MHC Technology Sector Update - In Brief - Q1 2024

Technology Sector Update In Brief Q1 2024

Technology Sector Update - In Brief

Welcome

Welcome to the latest edition of our Technology Sector Update - In Brief series. In this interactive magazine, we feature our most popular insights from the past month. We hope you find it informative.

First up, in the above video, Technology Sector lead, Oisín Tobin discusses the top trends likely to impact clients in the tech sector in 2024.

Other most read insights include: •

What is AI Governance?

•

European Accessibility Act Implemented into Irish Law

•

Age Assurance: An Essential Three-step Guide to Ensuring Compliance

Oisín Tobin Partner, Technology Sector Lead otobin@mhc.ie

Philip Nolan Partner, Head of Technology pnolan@mhc.ie

Contact our Technology Sector team

2

Technology Sector Update - In Brief

What is AI Governance?

Brian McElligott Partner, Head of Artificial Intelligence brianmcelligott@mhc.ie

At the best of times, artificial intelligence terms can be a challenge to understand. When it comes to broader and even deeper AI topics like governance and ethics, it’s even more challenging and we often find ourselves grappling with the distinctions between them. In this article we are going to tackle, at a very high level, some of the key differences between:

• Data governance • AI governance, and • Ethical AI

Data governance In a corporate setting, data governance involves setting policies and procedures to ensure that data is managed properly across the entire organisation.

This encompasses defining data standards, implementing data security measures, and ensuring compliance with regulations like the GDPR. Data governance ensures that the company’s data is accurate, available, and protected, providing a foundation for informed decision-making and use of that data in the context of internal and external channels. Responsibilities might include oversight of data storage, access controls, data quality, and auditing data usage to prevent misuse and to conform to legal standards.

AI governance AI governance, on the other hand, is a broader concept that encompasses not only the data used

by AI systems but also the design, development, implementation, and operation of the AI systems themselves. It is an overarching concept that

includes various aspects of managing AI systems, such as technical, legal, and ethical considerations.

While the legal and regulatory components of AI governance focus on compliance with existing laws and regulations like the GDPR and the EU AI Act, the ethical dimension goes further by addressing moral type implications and societal impacts of AI technologies. AI governance involves creating a framework of policies, ethical guidelines, standards, and practices to manage the risks and maximize the benefits of AI systems. It deals with questions about the transparency of AI decisionmaking processes (explainability), accountability for AI decisions, the fairness of outcomes (bias mitigation), and overall, AI impact on society.

Ethical AI Finally, we have ethical AI, which means putting in place principles and practices to ensure that AI systems and products are not only compliant with laws and regulations but also adhere to ethical standards that may go above and beyond legal requirements. This would involve creating ethical guidelines for AI design and use, such as ensuring AI is fair, transparent, and respects user privacy.

Ethical considerations may demand involvement from diverse stakeholders, including customers, employees, and potentially external advisors, to ensure a wide array of perspectives is considered.

The aim is to prevent harm, discrimination, and other negative impacts that could arise from AI systems and to promote trust in the company and its products.

3

Technology Sector Update - In Brief

Comment In conclusion:

•

Data governance is about managing and regulating the use of data within organizations.

•

AI governance is a wider term that includes the management of both the data and the AI systems that use this data, ensuring they are used safely and responsibly.

•

Ethical AI focuses on the moral principles guiding the use and development of AI, often going beyond legal compliance to address societal concerns and values

The key take-away for those new to AI technology is the need to understand the difference between these terms and use them appropriately (especially in market-facing materials). Companies also need to be aware of the well-known tensions between commercial goals, governance and ethical AI principals. It’s possible to marry these concepts on a case-by-case basis, but it needs a lot of advance consideration and planning to avoid future commercial and ethical conflicts which can lead to reputational damage.

For more information and expert advice, please contact a member of our Artificial Intelligence team.

4

Technology Sector Update - In Brief

European Accessibility Act Implemented into Irish Law Dermot McGirr Partner, Commercial dmcgirr@mhc.ie

In an important development, the European Accessibility Act (EAA) has been implemented into Irish law through the European Union (Accessibility Requirements of Products and Services) Regulations 2023. The EAA is significant for businesses in a number of sectors and industries including e-commerce, telecoms, banking, transport and for companies in the technology products space.

It will apply from 28 June 2025 and will introduce accessibility requirements for in-scope products and services. These have been outlined in previous updates here and here.

At its core, the EAA is about ensuring products and services within its scope are accessible to persons with disabilities. It does this by setting baseline accessibility requirements for all in-scope products and services with further, specialised requirements for specific products and services.

These may require companies who supply in-scope products and services to make amendments to their products and services. It is therefore important for these companies to start planning for when the EAA becomes effective in 2025.

Wendy Hederman Partner, Commercial whederman@mhc.ie

Clarity on the EAA in Ireland The Regulations provide greater clarity on the effect of the EAA in Ireland. In particular, the Regulations confirm that the EAA will not be extended to the built environment for all in-scope services.

Additionally, the Regulations confirm that Ireland will be implementing an exemption for self-service terminals, such as ATMs and payment terminals, which are lawfully used by service providers for the provision of services before the Regulations come into force. Service providers may continue to use these until the end of their economically useful life, up to a maximum of 20 years after their entry into force.

Market surveillance authority and compliance authorities The Regulations clarify who the relevant authorities are for ensuring compliance with the accessibility requirements. The Competition and Consumer Protection Commission (CCPC) is the market surveillance authority for products which are subject to the EAA.

5

Technology Sector Update - In Brief

The compliance authorities for services covered under the EAA are more diverse as follows: Services

Authority

In-scope electronic communications services

Commission for Communications Regulation

Services providing access to audiovisual media services

Coimisiún na Meán

In-scope elements of Irish Aviation Authority air passenger transport services

Enforcement and penalties The Regulations give enforcement powers to the market surveillance authority and compliance authorities. These include the power to issue directions to businesses to comply with its provisions. In addition, they outline a procedure for individual consumers to take an action against businesses in the Irish courts where the consumer believes that the business is not complying with the Regulations. They also provide for public bodies and private associations, organisations or other legal entities with a legitimate interest to support these consumer actions with their approval. This is a particularly noteworthy development as it means private individuals, perhaps backed by interest groups, can bring court proceedings directly.

In-scope elements of bus, rail and waterborne passenger transport services

National Transport Authority

Consumer banking services

Central Bank of Ireland

•

On summary conviction, a class A fine (€5,000) or imprisonment of up to 6 months or both

E-books and dedicated software and e-commerce services

CCPC

•

On conviction on indictment, a fine of up to €60,000 or imprisonment of up to 18 months or both

Answering emergency Commission for communications to Communications the single European Regulation emergency number ‘112’

The National Disability Authority is also given a special status under the Regulations to advise the relevant authorities on the accessibility requirements under the EAA and the Irish Regulations.

The Regulations also provide for penalties for breaches of its requirements as follows:

Both companies and their directors, managers, secretaries and other officers can be found guilty of an offence under the Regulations. It will be a defence for a person, including a company, charged with an offence if they can prove that they exercised due diligence and took all reasonable precautions to avoid the commission of the offence.

6

Technology Sector Update - In Brief

Harmonised standards

Conclusion

Under Article 15(1) of the EAA, products and services which conform with harmonised standards published in the Official Journal of the European Union are presumed to conform with the accessibility requirements of the EAA, where the standards or parts of the standards cover those requirements. The European Commission has formally requested the drafting of standards in support of the EAA. This request provides for the following existing standards to be revised:

While Ireland missed the deadline of 28 June 2022 for implementing the EAA, the implementation of the Regulations are a very welcome development.

They provide greater certainty to businesses as to the impact the EAA will have on their businesses in Ireland. With only about 18 months left before the Regulations apply in Ireland, businesses should use the lead-in time to assess its effect on their business, including preparing for the compliance steps that they will have to take in advance of June 2025.

•

EN 301 549 Accessibility requirements for ICT products and services

•

EN 17161:2019 Design for All - Accessibility following a Design for All approach in products, goods and services - Extending the range of users

For more information on the implementation on what in-scope businesses need to do in advance of the Act coming into force, contact a member of our Technology team.

•

EN 17210 Accessibility and usability of the built environment - Functional requirements

The Regulations confirm that products and services which comply with these standards will be presumed to be in conformity with the Regulations.

Therefore, those standards may be useful for businesses to consider relating to their compliance with the EAA.

7

TechnologySector Sector Update - In Brief Technology Update - In Brief

Age Assurance and Digital Services An Essential Three-step Guide to Ensuring Compliance Hannah Perry Partner, Privacy & Data Security hperry@mhc.ie

The protection of minors when using digital services has become a key priority for European politicians and legislators. As a result, we are seeing increased focus on the implementation of appropriate and adequate age assurance. This has been reflected in several decisions from the Data Protection Commission (DPC) and the introduction of the EU Digital Services Act (DSA) and Online Safety and Media Regulation Act 2022 (OSMR Act).

But what is age assurance and what are the measures that organisations are obliged to implement?

What is age assurance?

Age assurance simply means different methods of estimating or verifying an individual’s age.

The recent increased focus on age assurance comes from several new pieces of EU legislation – including the DSA and the OSMR. These new laws impose obligations on digital services providers relating to “minors”, i.e. anyone under the age of 18.

Article 28 of the DSA requires online platforms to implement appropriate and proportionate measures which ensure a high level of data protection and safety for minors. In addition, this legislation prohibits providers from presenting personalised advertisements to recipients whereby they know or have reasonable certainty that the recipient is a minor.

The OSMR Act sets out online safety codes which aim to protect users, especially minors, from commercial communications including advertising and promotional content.

The OSMR Act sets out the procedures by which a service is designated as falling within the scope of a specific online safety code, including a list of the factors that must be taken into account.

These factors include the levels of risks of harm to users, especially children, which are posed by the availability of harmful online content on a service or a category of services.

Needless to say, the starting point for complying with these new obligations is determining if minors are using your service.

What age assurance measures do you need to take?

None of the relevant pieces of legislation – whether the DSA, OSMR or GDPR - prescribe the methods of age assurance that must be adopted.

However, the DPC has published guidance on the processing of children’s data, also known as the “Fundamentals”, which touches on the issue of age assurance. In this guidance, the DPC explains that there is no one-size-fits-all approach to age assurance. Rather, organisations are expected to implement appropriate age assurance measures by having regard to:

• The state of the art • The cost of implementation • The nature of the processing, and • The risks associated with the processing

8

Technology Sector Update - In Brief

To help navigate this difficult undertaking, we’ve set out a three-step process for determining what age assurance measures you should have in place.

Step 1: Identify the risk associated with your processing The DPC’s Fundamentals clarify that organisations should take a risk-based approach when determining the appropriate age assurance package for their specific processing operations.

Accordingly, the first step in determining what age assurance measures your organisation needs to adopt is to identify the risks associated with your processing. The DPC’s Fundamentals recommend that organisations consider the following, (nonexhaustive) factors when assessing the risk of their processing:

• What personal data is being processed – are

you processing a high volume of personal data that can directly identify the data subject, eg the data subject’s full name, age, address, images / videos?

• How sensitive is the personal data –are you

processing special category data, eg race/ ethnicity/sexual orientation, or other sensitive information like birth status?

• What service is being offered – is your service an educational service, a healthcare service, a social media platform or a gaming app whereby strangers can contact the minor?

measures which are deemed as “state of the art”. The reference to state of the art imposes an obligation on controllers to consider technological advancements. This means that organisations must assess the appropriateness and effectiveness against relevant technological advancements.

Step 3: Consider drawbacks of relevant age assurance measure Once you have identified a proposed age assurance solution in light of the risks associated with your processing and the relevant state of the art, you then need to consider whether the solution presents any conflicting privacy issues. These include:

• Data minimisation issues: Certain measures

may fall foul of the data minimisation principle under Article 5(1)(c) of the GDPR, and involve the processing of excessive personal data,

• Discrimination / bias issues: Certain measures

may have a direct, or indirect, discriminatory effect on minors from different ethnic and socioeconomic backgrounds, and

• Freezing effect: Certain measures could have the

effect of locking certain minors out of the service.

These considerations can be difficult for organisations to navigate, particularly when balancing the need to implement effective age assurance solutions.

How accessible is the personal data – is the user’s information accessible to the world at large?

Step 2: Assess the ‘state of the art’ relevant to that risk profile Once the risks associated with your processing activities have been determined, i.e. low, medium or high, you must then look to the market and implement appropriate age assurance measures which have been determined in light of the identified risks.

In this regard, Article 25(1) of the GDPR obliges controllers to implement appropriate technical and organisational measures, taking into account

9

Technology Sector Update - In Brief

By way of illustration, we examine two types of age assurance measures which may be appropriate for high-risk processing to demonstrate the tensions between the effectiveness, cost and proportionality of different age assurance measures.

Example 1: Hard identifiers Hard identifiers like those used in the issuance of government-issued IDs or payment cards can also be used to verify an individual’s age. The Fundamentals identify that hard identifiers may be suitable for high-risk processing.

On an assessment of the risk profile and state of the art, this measure benefits from a reasonably high degree of confidence and is a tried and tested method of age verification. It is difficult to circumvent and relatively easy (and low cost) to implement.

However, on the other hand, privacy regulators have raised concerns that this form of age assurance solution falls foul of the data minimisation principle and is potentially excessive.

Regulators have also expressed concerns that the collection of hard identifiers presents a risk of exclusion or indirect discrimination, as there may be socio-economic or even political barriers to holding a formal ID document.

Based on these conflicting privacy issues, the collection of hard identifiers has been recommended as a ‘last resort’ and only for very high-risk processing or prohibited items, such as gambling or tobacco.

Example 2: Facial age analysis Another form of age assurance for high-risk processing is facial age analysis. This method analyses the individual’s real-time selfie to estimate their age based on their facial geometry. Several independent suppliers, such as VerifyMyAge and Jumio, currently provide these services to a variety of companies and firms.

While this solution has been identified as state of the art and endorsed by certain European regulators, there are also significant downsides to its implementation. Academics and industry experts have raised significant concerns about the inherent racial bias of the technology and the potential freezing effect on minors accessing core services. Accordingly, organisations looking to implement this solution will need to carry out a high-level of due diligence to verify the accuracy of the supplier’s solution and their compliance with data protection laws, particularly rules on data retention and further processing.

Conclusion Age assurance is still an area of both regulatory and technological uncertainty. EU regulators are currently commissioning several studies and projects on this topic, including the euCONSENT proposal, which aims to design and test an EUwide solution for age verification and parental consent. In addition, the International Standards Organisation is currently preparing a draft international standard of age assurance systems.

While these are helpful developments, it is clear that organisations cannot defer the implementation of effective age assurance measures given the DPC’s recent decisions on this issue. Accordingly, digital service providers should take stock of and (re-) assess their current age assurance measures, or lack thereof, based on:

• The legal obligations that apply to their business • The risk of their processing activities • The relevant state of the art, and • Any conflicting privacy issues For more information and expert advice on age assurance, please contact a member of our Privacy & Data Security team.

10

Technology Sector Update - In Brief

11

Technology Sector Update - In Brief

About Us

What Others Say

We are a business law firm with 117 partners and offices in Dublin, London, New York and San Francisco.

Our Technology Team

Our legal services are grounded in deep expertise and informed by practical experience. We tailor our advice to our clients’ business and strategic objectives, giving them clear recommendations.

This allows clients to make good, informed decisions and to anticipate and successfully navigate even the most complex matters.

Our working style is versatile and collaborative, creating a shared perspective with clients so that legal solutions are developed together. Our service is award-winning and innovative. This approach is how we make a valuable and practical contribution to each client’s objectives.

Dublin

London

New York

“…always go over and above, no matter the issue. They have a wonderful ability to turn advice on complex points around quickly and concisely.”

Chambers & Partners, 2023

Our Technology Team “Vast experience in dealing with technology companies headquartered in Ireland.” “They remain the “go to” firm for privacy matters.”

Legal 500, 2023

San Francisco

The contents of this publication are to assist access to information and do not constitute legal or other advice. Readers should obtain their own legal and other advice as may be required. © Copyright 2024. Mason Hayes & Curran. February 2024.