Keep pulling the thread on Eric Null.
Meta announced it will track employee keyboard inputs and mouse movements to train AI systems designed to learn their job functions.
The SECURE Data Act adopts a weak data minimization standard that allows companies to continue existing data practices as long as they are disclosed in a privacy policy.
Eric Null argues that an exemption in the SECURE Data Act for internal research effectively exempts all data collected for training AI systems from the bill's provisions.
The SECURE Data Act lacks protections against "dark patterns," allowing companies to use manipulative user interface designs to obtain consent for sensitive data collection.
The civil rights provisions in the SECURE Data Act merely restate existing federal law and do not add any new protections against discrimination.
Eric Null predicts that the SECURE Data Act's broad preemption clause would nullify stronger state-level civil rights and privacy laws if passed.
The preemption clause in the SECURE Data Act could nullify state laws such as Texas's biometric privacy law and the Illinois Biometric Information Privacy Act (BIPA).
The SECURE Data Act does not include a private right of action, which would allow individuals to sue companies for violations.
Eric Null warns that the interoperability mandates in California's BASED Act could force companies like Apple and Meta to decrypt end-to-end encrypted messages on services like iMessage and WhatsApp.
The United States does not have a comprehensive federal privacy law.
The American Data Privacy and Protection Act (ADPA) was a bipartisan bill introduced in 2022 that passed out of committee but never received a vote on the House floor.
The American Privacy Rights Act (APRA), a bipartisan bill introduced in 2024, did not pass out of committee.