DPM Radar
Glossary of terms
Came across a term in a law, a contract or a lawyer's letter? Here is its definition from the law, word for word, with a link to the section and a short explanation of ours. 30 terms from privacy laws and the EU AI Act.
Personal data
When you will meet it: Whenever you ask whether the law covers what you collect.
Our explanation, not the text of the law: Information about a person who can be identified, even if their name is not written.
Privacy Protection Law (Israel), Section 3
”מידע אישי“ – נתון הנוגע לאדם מזוהה או לאדם הניתן לזיהוי; לעניין הגדרה זו, ”אדם הניתן לזיהוי“ – מי שניתן לזהותו במאמץ סביר, במישרין או בעקיפין, ובכלל זה באמצעות פרט מזהה, כגון שם, מספר זהות, מזהה ביומטרי, נתוני מיקום, מזהה מקוון, או נתון אחד או יותר הנוגע למצבו הפיזי, הבריאותי, הכלכלי, החברתי או התרבותי;
GDPR (EU), Article 4(1)
(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
CCPA (California), Section 1798.140(v)
(v) (1) “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household: (A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers. (B) Any personal information described in subdivision (e) of Section 1798.80. (C) Characteristics of protected classifications under California or federal law. (D) Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. (E) Biometric information. (F) Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement. (G) Geolocation data. (H) Audio, electronic, visual, thermal, olfactory, or similar information. (I) Professional or employment-related information. (J) Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99). (K) Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. (L) Sensitive personal information. (2) (A) “Personal information” does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. (B) (i) For purposes of this paragraph, “publicly available” means any of the following: (I) Information that is lawfully made available from federal, state, or local government records. (II) Information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media. (III) Information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. (ii) “Publicly available” does not mean biometric information collected by a business about a consumer without the consumer’s knowledge. (3) “Personal information” does not include consumer information that is deidentified or aggregate consumer information. (4) “Personal information” can exist in various formats, including, but not limited to, all of the following: (A) Physical formats, including paper documents, printed images, vinyl records, or video tapes. (B) Digital formats, including text, image, audio, or video files. (C) Abstract digital formats, including compressed or encrypted files, metadata, or artificial intelligence systems that are capable of outputting personal information. Full definition
Processing
When you will meet it: When you check whether an action on data, such as storing or sending it, counts under the law.
Our explanation, not the text of the law: Any operation performed on personal data, including just keeping it.
Privacy Protection Law (Israel), Section 3
”עיבוד“, ”שימוש“ – כל פעולה שמבוצעת על מידע אישי, לרבות קבלתו, איסופו, אחסונו, העתקתו, עיון בו, גילויו, חשיפתו, העברתו, מסירתו או מתן גישה אליו;
GDPR (EU), Article 4(2)
(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
CCPA (California), Section 1798.140(y)
(y) “Processing” means any operation or set of operations that are performed on personal information or on sets of personal information, whether or not by automated means.
Controller
When you will meet it: When you need to decide who is responsible for the data, you or your vendor.
Our explanation, not the text of the law: Whoever decides what the data is used for.
Privacy Protection Law (Israel), Section 3
”בעל שליטה“ במאגר מידע – מי שקובע, לבדו או יחד עם אחר, את מטרות עיבוד המידע שבמאגר המידע או גוף שהוא או בעל תפקיד בו הוסמך בחיקוק לעבד מידע במאגר מידע;
GDPR (EU), Article 4(7)
(7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
CCPA (California), Section 1798.140(d)
(d) “Business” means: (1) A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers’ personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information, that does business in the State of California, and that satisfies one or more of the following thresholds: (A) As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95. (B) Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households. (C) Derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information. (2) Any entity that controls or is controlled by a business, as defined in paragraph (1), and that shares common branding with the business and with whom the business shares consumers’ personal information. “Control” or “controlled” means ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business; control in any manner over the election of a majority of the directors, or of individuals exercising similar functions; or the power to exercise a controlling influence over the management of a company. “Common branding” means a shared name, servicemark, or trademark that the average consumer would understand that two or more entities are commonly owned. (3) A joint venture or partnership composed of businesses in which each business has at least a 40 percent interest. For purposes of this title, the joint venture or partnership and each business that composes the joint venture or partnership shall separately be considered a single business, except that personal information in the possession of each business and disclosed to the joint venture or partnership shall not be shared with the other business. (4) A person that does business in California, that is not covered by paragraph (1), (2), or (3), and that voluntarily certifies to the California Privacy Protection Agency that it is in compliance with, and agrees to be bound by, this title. Full definition
Processor
When you will meet it: In a contract with a vendor that processes data for you, such as a cloud or a call centre.
Our explanation, not the text of the law: An outside vendor that processes data for the controller.
Privacy Protection Law (Israel), Section 3
”מחזיק“, לעניין מאגר מידע – גורם חיצוני לבעל השליטה במאגר המידע המעבד בעבורו מידע;
GDPR (EU), Article 4(8)
(8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
CCPA (California), Section 1798.140(ag)
(ag) (1) “Service provider” means a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumer’s personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the person from: (A) Selling or sharing the personal information. (B) Retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract for the business, including retaining, using, or disclosing the personal information for a commercial purpose other than the business purposes specified in the contract with the business, or as otherwise permitted by this title. (C) Retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business. (D) Combining the personal information that the service provider receives from, or on behalf of, the business with personal information that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer, provided that the service provider may combine personal information to perform any business purpose as defined in regulations adopted pursuant to paragraph (9) of subdivision (a) of Section 1798.185, except as provided for in paragraph (6) of subdivision (e) of this section and in regulations adopted by the California Privacy Protection Agency. The contract may, subject to agreement with the service provider, permit the business to monitor the service provider’s compliance with the contract through measures, including, but not limited to, ongoing manual reviews and automated scans and regular assessments, audits, or other technical and operational testing at least once every 12 months. (2) If a service provider engages any other person to assist it in processing personal information for a business purpose on behalf of the business, or if any other person engaged by the service provider engages another person to assist in processing personal information for that business purpose, it shall notify the business of that engagement, and the engagement shall be pursuant to a written contract binding the other person to observe all the requirements set forth in paragraph (1). Full definition
Consent
When you will meet it: In a form, a website or an app that asks for permission.
Our explanation, not the text of the law: The two definitions are worded differently, so it is worth reading both.
GDPR (EU), Article 4(11)
(11) ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
CCPA (California), Section 1798.140(h)
(h) “Consent” means any freely given, specific, informed, and unambiguous indication of the consumer’s wishes by which the consumer, or the consumer’s legal guardian, a person who has power of attorney, or a person acting as a conservator for the consumer, including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose. Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information, does not constitute consent. Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Likewise, agreement obtained through use of dark patterns does not constitute consent. Full definition
Sensitive personal information
When you will meet it: When you collect data on health, family life, sexual orientation or biometrics.
Our explanation, not the text of the law: Types of data that the law defines as especially sensitive. The list differs from law to law.
Privacy Protection Law (Israel), Section 3
”מידע בעל רגישות מיוחדת“ – כל אחד מאלה: (1) מידע אישי על צנעת חיי המשפחה של אדם, על צנעת אישותו ועל נטייתו המינית; (2) מידע אישי המתייחס למצב בריאותו של אדם, ובכלל זה מידע רפואי כהגדרתו בחוק זכויות החולה, התשנ״ו–1996; (3) מידע אישי שהוא מידע גנטי כהגדרתו בחוק מידע גנטי, התשס״א–2000; (4) מידע אישי שהוא מזהה ביומטרי המשמש או המיועד לשמש לזיהוי אדם או לאימות זהותו באופן ממוחשב; (5) מידע אישי על מוצאו של אדם; (6) מידע אישי על אודות עברו הפלילי של אדם; (7) מידע אישי על אודות דעותיו הפוליטיות או אמונותיו הדתיות של אדם או השקפת עולמו; (8) מידע אישי שהוא הערכת אישיות שנערכה מטעם גורם מקצועי שכדרך עיסוק מחווה דעתו על אישיותו של אדם, או שנערכה באמצעי שמיועד לביצוע הערכה של מאפייני אישיות מהותיים, ובכלל זה קווי אופי, יכולת שכלית ויכולת תפקוד בעבודה או בלימודים; (9) מידע אישי שהוא נתוני מיקום ונתוני תעבורה, כהגדרתם בחוק סדר הדין הפלילי (סמכויות אכיפה – נתוני תקשורת), התשס״ח–2007, שנוצרו על ידי ספק מורשה כהגדרתו בחוק האמור, לגבי אדם, ונתונים על אודות מיקומו של אדם שיש בהם כדי ללמד על מידע לפי פסקאות (1) עד (7) ו–(11); (10) מידע אישי על נתוני שכר של אדם ועל פעילותו הפיננסית; (11) מידע אישי שחלה עליו חובת סודיות שנקבעה בדין; (12) מידע אישי אחר שקבע שר המשפטים, באישור ועדת החוקה, בתוספת השנייה, ובלבד שהוא מידע אישי במאגר מידע הנמצא בישראל שהועבר אליו מחוץ לגבולות המדינה, ושבמקום שממנו הועבר חלות על מידע אישי מסוגו הוראות דין מיוחדות ביחס לדין החל על מידע אישי אחר; Full definition
CCPA (California), Section 1798.140(ae)
(ae) “Sensitive personal information” means: (1) Personal information that reveals: (A) A consumer’s social security, driver’s license, state identification card, or passport number. (B) A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account. (C) A consumer’s precise geolocation. (D) A consumer’s racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership. (E) The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication. (F) A consumer’s genetic data. (G) (i) A consumer’s neural data. (ii) “Neural data” means information that is generated by measuring the activity of a consumer’s central or peripheral nervous system, and that is not inferred from nonneural information. (2) (A) The processing of biometric information for the purpose of uniquely identifying a consumer. (B) Personal information collected and analyzed concerning a consumer’s health. (C) Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation. (3) Sensitive personal information that is “publicly available” pursuant to paragraph (2) of subdivision (v) shall not be considered sensitive personal information or personal information. Full definition
Filing system
When you will meet it: When you check whether a customer list or an employee file is a database under the law.
Our explanation, not the text of the law: In the Israeli law, a digital collection of personal data, with exceptions listed in the definition.
Privacy Protection Law (Israel), Section 3
”מאגר מידע“ – אוסף פרטי מידע אישי המעובד באמצעי דיגיטלי, למעט אחד מאלה: (1) אוסף לשימוש אישי שאינו למטרות עסק; (2) אוסף הכולל רק שם, מען ודרכי התקשרות, לגבי 100,000 בני אדם או פחות, שאינו מלמד כשלעצמו על מידע אישי נוסף לגבי בני האדם ששמותיהם כלולים בו, ובלבד שלבעל האוסף או לתאגיד בשליטתו אין אוסף אחר הכולל פרטי מידע אחרים לגבי אותם בני אדם;
GDPR (EU), Article 4(6)
(6) ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
Biometric data
When you will meet it: With a fingerprint time clock, face recognition or a scan at the door.
Our explanation, not the text of the law: Data on a unique human characteristic, used to identify a person or verify their identity.
Privacy Protection Law (Israel), Section 3
”מזהה ביומטרי“ – נתון ביומטרי המשמש לזיהוי אדם או לאימות זהותו, או אמצעי ביומטרי שניתן להפיק ממנו נתון כאמור; לעניין הגדרה זו, ”ביומטרי“ – מאפיין אנושי, פיזיולוגי או התנהגותי, ייחודי, הניתן למדידה ממוחשבת;
Data Security Regulations (Israel), Regulation 1
”מידע ביומטרי“ – מידע המשמש לזיהוי אדם, שהוא מאפיין אנושי פיזיולוגי, ייחודי, הניתן למדידה ממוחשבת;
GDPR (EU), Article 4(14)
(14) ‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;
CCPA (California), Section 1798.140(c)
(c) “Biometric information” means an individual’s physiological, biological, or behavioral characteristics, including information pertaining to an individual’s deoxyribonucleic acid (DNA), that is used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information. Full definition
Data security
When you will meet it: Whenever you ask what must be protected, and against what.
Our explanation, not the text of the law: Protecting the integrity of personal data, or protecting it from processing without lawful permission.
Privacy Protection Law (Israel), Section 3
”אבטחת מידע“ – הגנה על שלמות המידע האישי או הגנה על המידע האישי מפני עיבוד, ללא רשות כדין;
Data integrity
When you will meet it: After a fault or an unauthorised change to the data.
Our explanation, not the text of the law: The data in the database matches its source and was not changed, disclosed or destroyed without permission.
Privacy Protection Law (Israel), Section 3
”שלמות המידע“ – זהות הנתונים במאגר מידע למקור שממנו נשאבו, בלא ששונו, נמסרו או הושמדו ללא רשות כדין.
Direct mail
When you will meet it: When you plan a marketing approach to customers chosen by a shared feature.
Our explanation, not the text of the law: A personal approach to someone because they belong to a group chosen by features from a database.
Privacy Protection Law (Israel), Section 3
”דיוור ישיר“ – פנייה אישית לאדם, בהתבסס על השתייכותו לקבוצת אוכלוסין, שנקבעה על פי אפיון אחד או יותר של בני אדם ששמותיהם כלולים במאגר מידע;
Personal data breach
When you will meet it: After a leak or an intrusion, when you check whether you must report.
Our explanation, not the text of the law: In the EU, a security breach that leads, accidentally or unlawfully, to the destruction, loss or alteration of personal data, or to unauthorised disclosure of or access to it. In the Israeli regulations, a 'severe security incident' is defined only for databases at the high or medium security level, and depends on the level.
Data Security Regulations (Israel), Regulation 1
”אירוע אבטחה חמור“ – כל אחד מאלה: (1) במאגר מידע שחלה עליו רמת אבטחה גבוהה – אירוע שנעשה בו שימוש במידע מן המאגר, בלא הרשאה או בחריגה מהרשאה או שנעשתה פגיעה בשלמות המידע; (2) במאגר מידע שחלה עליו רמת אבטחה בינונית – אירוע שנעשה בו שימוש בחלק מהותי מן המאגר, בלא הרשאה או בחריגה מהרשאה או שנעשתה פגיעה בשלמות המידע לגבי חלק מהותי מן המאגר;
GDPR (EU), Article 4(12)
(12) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
Profiling
When you will meet it: When a system scores customers or employees automatically.
Our explanation, not the text of the law: Automated processing of personal data to evaluate personal aspects of a person, for example to analyse or predict them.
GDPR (EU), Article 4(4)
(4) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
CCPA (California), Section 1798.140(z)
(z) “Profiling” means any form of automated processing of personal information, as further defined by regulations pursuant to paragraph (15) of subdivision (a) of Section 1798.185, to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
Pseudonymisation
When you will meet it: When you replace names with codes before analysing data.
Our explanation, not the text of the law: The data no longer points to a person without extra information, which is kept separately and protected.
GDPR (EU), Article 4(5)
(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
CCPA (California), Section 1798.140(aa)
(aa) “Pseudonymize” or “pseudonymization” means the processing of personal information in a manner that renders the personal information no longer attributable to a specific consumer without the use of additional information, provided that the additional information is kept separately and is subject to technical and organizational measures to ensure that the personal information is not attributed to an identified or identifiable consumer.
Deidentified
When you will meet it: When you want to use data that is not linked to a particular consumer, under the California law.
Our explanation, not the text of the law: Information that cannot reasonably be linked to a person, under the conditions the definition sets out.
CCPA (California), Section 1798.140(m)
(m) “Deidentified” means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer provided that the business that possesses the information: (1) Takes reasonable measures to ensure that the information cannot be associated with a consumer or household. (2) Publicly commits to maintain and use the information in deidentified form and not to attempt to reidentify the information, except that the business may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision. (3) Contractually obligates any recipients of the information to comply with all provisions of this subdivision. Full definition
Recipient
When you will meet it: When a privacy notice lists who receives the data.
Our explanation, not the text of the law: Anyone the data is disclosed to, whether a third party or not, except public authorities receiving it in a particular inquiry under the law.
GDPR (EU), Article 4(9)
(9) ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing; Full definition
Third party
When you will meet it: When you check whether a partner is your vendor or a separate party.
Our explanation, not the text of the law: Anyone who is not the organisation, its vendor, people authorised to process the data on their behalf, or the person the data is about. The California definition differs in detail.
GDPR (EU), Article 4(10)
(10) ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
CCPA (California), Section 1798.140(ai)
(ai) “Third party” means a person who is not any of the following: (1) The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumer’s current interaction with the business under this title. (2) A service provider to the business. (3) A contractor.
Genetic data
When you will meet it: In genetic testing, insurance or research.
Our explanation, not the text of the law: Data on a person's genetic features, usually from testing a biological sample.
GDPR (EU), Article 4(13)
(13) ‘genetic data’ means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;
Data concerning health
When you will meet it: With any medical information, also outside a hospital, such as in an employee file.
Our explanation, not the text of the law: Data on a person's physical or mental health, including care they received.
GDPR (EU), Article 4(15)
(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;
Sell
When you will meet it: When you pass California customers' data to another party for value.
Our explanation, not the text of the law: Under the California law, a sale includes disclosure for value other than money.
CCPA (California), Section 1798.140(ad)
(ad) (1) “Sell,” “selling,” “sale,” or “sold,’’ means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration. (2) For purposes of this title, a business does not sell personal information when: (A) A consumer uses or directs the business to intentionally: (i) Disclose personal information. (ii) Interact with one or more third parties. (B) The business uses or shares an identifier for a consumer who has opted out of the sale of the consumer’s personal information or limited the use of the consumer’s sensitive personal information for the purposes of alerting persons that the consumer has opted out of the sale of the consumer’s personal information or limited the use of the consumer’s sensitive personal information. (C) The business transfers to a third party the personal information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business, provided that information is used or shared consistently with this title. If a third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection, it shall provide prior notice of the new or changed practice to the consumer. The notice shall be sufficiently prominent and robust to ensure that existing consumers can easily exercise their choices consistently with this title. This subparagraph does not authorize a business to make material, retroactive privacy policy changes or make other changes in their privacy policy in a manner that would violate the Unfair and Deceptive Practices Act (Chapter 5 (commencing with Section 17200) of Part 2 of Division 7 of the Business and Professions Code). Full definition
AI system
When you will meet it: In the first question: does the AI Act apply to your product?
Our explanation, not the text of the law: A system that infers from its input how to generate outputs, such as predictions, content, recommendations or decisions.
EU AI Act, Article 3(1)
(1) ‘AI system’ means a machine-based system that is designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment, and that, for explicit or implicit objectives, infers, from the input it receives, how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments;
Provider
When you will meet it: When you develop a system and market it under your name.
Our explanation, not the text of the law: Whoever develops the system, or has it developed, and places it on the market or puts it into service under their own name.
EU AI Act, Article 3(3)
(3) ‘provider’ means a natural or legal person, public authority, agency or other body that develops an AI system or a general-purpose AI model or that has an AI system or a general-purpose AI model developed and places it on the market or puts the AI system into service under its own name or trademark, whether for payment or free of charge;
Deployer
When you will meet it: When your organisation uses a system someone else developed.
Our explanation, not the text of the law: Whoever uses an AI system under their authority, except for personal non-professional use.
EU AI Act, Article 3(4)
(4) ‘deployer’ means a natural or legal person, public authority, agency or other body using an AI system under its authority except where the AI system is used in the course of a personal non-professional activity;
General-purpose AI model
When you will meet it: When you build a product on a large language model.
Our explanation, not the text of the law: A model that can perform a wide range of distinct tasks, not just one.
EU AI Act, Article 3(63)
(63) ‘general-purpose AI model’ means an AI model, including where such an AI model is trained with a large amount of data using self-supervision at scale, that displays significant generality and is capable of competently performing a wide range of distinct tasks regardless of the way the model is placed on the market and that can be integrated into a variety of downstream systems or applications, except AI models that are used for research, development or prototyping activities before they are placed on the market; Full definition
Deep fake
When you will meet it: When a system generates images, voice or video of real people.
Our explanation, not the text of the law: Image, audio or video generated or altered by AI that resembles existing people, objects, places or events and would falsely appear authentic.
EU AI Act, Article 3(60)
(60) ‘deep fake’ means AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful;
Emotion recognition system
When you will meet it: In a system that analyses customers' or employees' faces or voices.
Our explanation, not the text of the law: A system that identifies or infers people's emotions or intentions from their biometric data.
EU AI Act, Article 3(39)
(39) ‘emotion recognition system’ means an AI system for the purpose of identifying or inferring emotions or intentions of natural persons on the basis of their biometric data;
Remote biometric identification system
When you will meet it: With cameras that identify people in a public space or on a site.
Our explanation, not the text of the law: A system that identifies people without their active involvement, typically at a distance, by comparing biometric data with a reference database.
EU AI Act, Article 3(41)
(41) ‘remote biometric identification system’ means an AI system for the purpose of identifying natural persons, without their active involvement, typically at a distance through the comparison of a person’s biometric data with the biometric data contained in a reference database;
Serious incident
When you will meet it: When an AI system caused serious harm or disrupted infrastructure.
Our explanation, not the text of the law: An incident or malfunction of a system that directly or indirectly leads to one of the serious outcomes listed in the definition.
EU AI Act, Article 3(49)
(49) ‘serious incident’ means an incident or malfunctioning of an AI system that directly or indirectly leads to any of the following: (a) the death of a person, or serious harm to a person’s health; (b) a serious and irreversible disruption of the management or operation of critical infrastructure; (c) the infringement of obligations under Union law intended to protect fundamental rights; (d) serious harm to property or the environment;
AI literacy
When you will meet it: When you plan training for staff who use AI.
Our explanation, not the text of the law: The skills and understanding to use AI systems in an informed way and to be aware of their risks.
EU AI Act, Article 3(56)
(56) ‘AI literacy’ means skills, knowledge and understanding that allow providers, deployers and affected persons, taking into account their respective rights and obligations in the context of this Regulation, to make an informed deployment of AI systems, as well as to gain awareness about the opportunities and risks of AI and possible harm it can cause;