Regulatory and Legal Landscape for Data Ethics
Scope
Regulatory items test whether you can identify which regime applies to a processing activity, what it actually requires, and where regimes overlap or conflict.
The EU stack
- GDPR: applies to personal data and reaches non-EU organisations under Art 3; fines reach EUR 20 million or 4% of global turnover.
- ePrivacy: cookies and electronic marketing, layered on top of GDPR consent.
- EU AI Act (Regulation 2024/1689): risk tiers. Prohibited practices include social scoring, certain biometric categorisation, emotion recognition in workplaces and schools, and untargeted facial scraping. High-risk systems cover Annex III areas such as employment, education, credit, essential services, migration and justice. Limited-risk systems carry transparency duties, and general-purpose AI models carry documentation, copyright-policy and, for systemic-risk models, evaluation and incident-reporting duties. Obligations phase in from 2025 to 2027.
- Companion laws: Data Governance Act, Data Act, Digital Services Act, Digital Markets Act.
US landscape
There is no omnibus federal privacy statute; sectoral and state law dominate. HIPAA covers health, FERPA education, GLBA financial data, COPPA children under 13, FCRA consumer reports, ECOA and Reg B credit, and the Fair Housing Act. FTC Act Section 5 reaches unfair or deceptive practices and functions as the de facto federal AI and privacy regulator. State comprehensive laws (CCPA/CPRA, Colorado, Virginia, Connecticut and others) share a rights-and-contracts core but differ on thresholds, sensitive-data rules and universal opt-out signals. Illinois BIPA drives biometric consent litigation, and Colorado and California have enacted AI-specific statutes.
Elsewhere and cross-border
China's PIPL and Data Security Law, Brazil's LGPD, India's DPDP Act 2023. Transfers rely on adequacy decisions, SCCs, BCRs and the EU-US Data Privacy Framework.
Soft law
OECD AI Principles, UNESCO Recommendation on the Ethics of AI, Council of Europe Convention 108+, NIST AI RMF, ISO/IEC 42001 for AI management systems and ISO/IEC 27701 for privacy information management.
Worked example
A US company sells an AI hiring tool used by EU employers. It is a provider of a high-risk AI system under Annex III, so it owes conformity assessment, technical documentation, logging, human-oversight design, and accuracy and robustness evidence. The EU employer is a deployer with its own duties. GDPR governs the tool's processing of candidate data, and the company may need an Art 27 representative. US state law may add bias-audit and disclosure duties. 'We comply with GDPR' is an incomplete answer.
Traps
Assuming the AI Act bans all profiling; assuming a US federal privacy statute exists; missing that deployers, not only developers, carry duties; confusing FTC deception authority with a general privacy code.