Categories
Archives
We use cookies to ensure that we give you the best experience on our website. If you continue to use this site we will assume that you are happy with it.
Data Matters
Cybersecurity, Privacy, Data Protection, Artificial Intelligence, Internet Law, and Policy
Data Protection in Financial Services Week 2025 – Webinar Recordings Now Live
Data Protection in Financial Services (DPFS) Week 2025 consisted of a series of webinars featuring industry leaders who offered invaluable insights on balancing AI with privacy, cybersecurity, and regulatory challenges within the financial services industry. DPFS Week was relevant to all those in financial services, including those in banking, insurance, fintech, funds, payments, private equity, securities, wealth management, and other sectors.
(more…)
Michael Hochman
Washington, D.C.
michael.hochman@sidley.com
Jennifer Seale
Washington, D.C.
jseale@sidley.com
Colleen Theresa Brown
Washington, D.C.
cbrown@sidley.com
Sheri Porath Rockwell
Century City
sheri.rockwell@sidley.com
Thomas D. Cunningham
Chicago
tcunningham@sidley.com
Stephen W. McInerney
Chicago
smcinerney@sidley.com
U.S. FDA and CMS Actions on Generative AI-Enabled Mental Health Devices Yield Insights Across AI Product Development
Industry is increasingly exploring the use of AI chatbots to potentially diagnose and treat various medical conditions, including in the area of mental health. FDA is just beginning to develop its regulatory framework for approved, cleared, or authorized devices in the mental health space based on generative AI technology. The medtech industry, healthcare providers, and the public are closely watching FDA developments and guidance regarding the use of generative AI across the medical device space.
(more…)
Rebecca K. Wood
Washington, D.C.
rwood@sidley.com
Deeona R. Gaskin
Washington D.C.
dgaskin@sidley.com
Elizabeth Hardcastle
Washington, D.C.
ehardcastle@sidley.com
Andrew James
Washington, D.C.
ajames@sidley.com
Abigail K. Caroll
Washington, D.C.
abigail.carroll@sidley.com
The UK’s First Copyright vs. AI Decision: Key Takeaways on a Win for the AI Industry
The UK’s first “Copyright vs. AI” decision (Getty Images (US) Inc & ors vs. Stability AI Limited [2025] EWHC 2863 (Ch)) marks a clear win for the artificial intelligence industry. The English High Court raised the rhetorical question on the industry’s lips, “whether this judgment will, in reality, have anything to say on the balance to be struck between the two warring factions…”. The Judge’s answer is clear: the case does not answer whether training and development of AI models in the UK is an indefensible infringement of copyright. As to deployment of that trained model, the High Court concluded that an AI model itself cannot constitute an infringing copy. On Stability AI’s reproduction of the Getty trademarks, the High Court found that there was a historic and limited infringement.
(more…)
Clive Gringras
London
clive.gringras@sidley.com
Elisabetta Righini
Brussels
erighini@sidley.com
David Smith
London
dsmith@sidley.com
Women in Privacy – Global Privacy Leadership Lunch
Join us in Brussels for our next Women in Privacy – Global Privacy Leadership Lunch.
(more…)
Data Matters Contributors
sidleyprivacyblog@sidley.com
U.S. SEC Regulation S-P and Checklist: Compliance Deadline, December 3, 2025, Approaching for Large Entities
On May 16, 2024, the U.S. Securities and Exchange Commission (SEC or Commission) issued amendments to Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information, which became effective on August 2, 2024 (the Final Amendments). The deadline for larger entities to comply with the Final Amendments is December 3, 2025, and for smaller entities, June 3, 2026.
(more…)
Ranah Esmaili
Washington, D.C.
resmaili@sidley.com
Jonathan M. Wilan
Washington, D.C.
jwilan@sidley.com
New York Department of Financial Services (NYDFS) Clarifies Expectations for Third-Party Cybersecurity Risks Under its Cybersecurity Regulation, and Additional Amendments Go into Effect on November 1, 2025
On October 21, 2025, NYDFS, the New York State agency responsible for regulating financial services and products, issued an Industry Letter clarifying how “Covered Entities”[1] should manage cybersecurity risks arising from Third‑Party Service Providers (TPSPs) under the NYDFS Cybersecurity Regulation (23 NYCRR Part 500).
(more…)
David Lashway
Washington D.C.
dlashway@sidley.com
Jennifer Seale
Washington, D.C.
jseale@sidley.com
Michael Hochman
Washington, D.C.
michael.hochman@sidley.com
Sasha Hondagneu-Messner
New York
shondagneumessner@sidley.com
EU Court of Justice Issues Landmark Judgment on Concept of “Personal Data”
On 4 September 2025, the EU Court of Justice (the “CJEU”) issued a landmark ruling in SRB v. EDPS confirming that pseudonymous data is not automatically personal data in all cases (the “SRB Case”). Instead, the key question is whether the controller can realistically re-identify the individual. This judgment is expected to have a significant impact on instances where effective technical and/or organisational measures prevent re-identification by the controller. Importantly, although the ruling arose under EU Regulation 2019/1725 – i.e., the EU data protection law applicable to EU Institutions (such as the Commission) – the CJEU confirmed that the same interpretation applies under the General Data Protection Regulation (the “GDPR”).
(more…)
Francesca Blythe
London
fblythe@sidley.com
Lauren Cuyvers
Brussels
lcuyvers@sidley.com
Oscar Beghin
Dr. Kwabena Tenkorang
Trainee Solicitor
ktenkorang@sidley.com
Regulatory Update: National Association of Insurance Commissioners Summer 2025 National Meeting
The National Association of Insurance Commissioners (NAIC) held its Summer 2025 National Meeting (Summer Meeting) August 10–13, 2025. This blog summarizes the highlights from this meeting in addition to interim meetings held in lieu of taking place during the Summer Meeting. Highlights include adoption of guidance on asset adequacy testing for reinsurance transactions, renewed focus on the risks of offshore reinsurance transactions, evaluation of insurers’ use of funding-agreement-backed note (FABN) and funding-agreement-backed securities (FABS) programs, and consideration of additional regulatory frameworks to address insurers’ use of artificial intelligence (AI).
(more…)
Andrew R. Holland
New York
aholland@sidley.com
Sara N. Africano
Chicago
safricano@sidley.com
Stephanie H. Dobecki
Chicago
sdobecki@sidley.com
Ellen M. Dunn
New York
edunn@sidley.com
Michael L. Rosenfield
Los Angeles
mrosenfield@sidley.com
Chris H. Burusco
Los Angeles
cburusco@sidley.com
Jacob A. Grossman
Chicago
jgrossman@sidley.com
Upcoming Events
Resources