Two-minute Recap of Platform Law Developments - December 2023
Bulut Girgin, Ceren Ceyhan, Hatice Nur Arslan, Efe Utku Çal, Alperen Gündüz, Pırıl Aytemiz, Zeynep Genç
The EU Data Act published
The Data Act ("Data Act") published in the European Union Official Journal on 22 December 2023 obliges manufacturers and service providers, both companies and individuals, to allow users to access and reuse data generated by the use of their products or services. The Data Act officially entered into force on 11 January 2024, with the majority of its provisions taking effect from 12 September 2025.
Utah's Consumer Privacy Act enters into force
The US state of Utah's Consumer Privacy Act ("Privacy Act") entered into force on 31 December 2023. The Privacy Act grants individuals several rights as consumers, including the ability to access, delete, or transfer their personal information, as well as the option to opt-out of targeted advertising and the sale of personal data.
PayPal to revise its terms and conditions to comply with European consumer law
PayPal has agreed to revise its terms and conditions to comply with European consumer law. The European Commission ("Commission") announced in a statement on 20 December 2023 that PayPal has committed to making its terms and conditions more understandable and transparent for consumers. The upcoming changes are expected to include clarifications on which provisions apply to consumers and to businesses, ensuring that consumers are not held liable for damages that they did not cause or could not foresee, and provisions allowing consumers to benefit from the law of their residence in case of a dispute. The amendments will be communicated to consumers on 21 February 2024 and will come into effect on 28 May 2024.
AI cannot be an inventor, UK Supreme Court rules in landmark patent case
Computer scientist Dr. Stephen Thaler has been denied recognition of his artificial intelligence ("AI") invention, "DABUS", as an inventor in a patent application. The UK Intellectual Property Office ("UKIPO") rejected the application in 2019, citing that under the Patents Act, only natural persons can hold patent rights. Both the High Court and the Court of Appeal dismissed appeals against this decision. On 20 December 2023, the Supreme Court published its judgment, which (i) affirmed the decisions of the lower courts, (ii) rejected the recognition of DABUS as a patent inventor, and (iii) did not acknowledge Dr. Thaler's patent rights. The UKIPO welcomed the decision but added that the government will continue to review this area to support AI innovations.
EU Commission opens formal proceedings against X under the Digital Services Act
On 18 December 2023, the Commission announced the launch of its investigation into social media platform X (formerly Twitter) under the Digital Services Act ("DSA"). The Commission will evaluate whether X is in breach of the DSA in areas related to risk management, content moderation, "dark patterns" (i.e., deceptive interfaces designed to mislead users), advertising transparency, and data access for researchers.
Apple suspends sales of smartwatches amidst patent dispute and impending US import ban
Apple has suspended sales of its latest smartwatches, the Apple Watch Series 9 and Apple Watch Ultra 2, on its online store due to an impending import ban. The ban imposed by the US International Trade Commission ("ITC"), which entered into force on 26 December 2023, arose from a patent dispute with medical device maker Masimo. In a ruling on 26 October 2023, the ITC found that Apple's sensor technology infringes upon Masimo's patents.
China issues draft contingency plan for data security incidents
On 8 December 2023, China introduced a four-tier classification system to enhance its response to data security incidents. The new system aims to address China's increasing concern over large-scale data breaches and cyber threats within its borders. The proposal, which is currently open to public input, outlines a color-coded system to evaluate the severity of harm to national security, a company's online and information network, and the overall economic infrastructure.
EU Commission welcomes political agreement on Cyber Resilience Act
On 4 December 2023, the Commission expressed its approval of the political agreement reached between the European Parliament and the Council on the Cyber Resilience Act ("Cyber Act"). The Cyber Act, which was initially proposed by the Commission in September 2022, seeks to strengthen the cybersecurity of digital products by mandating appropriate cybersecurity requirements for all hardware and software. This includes a wide range of products, from baby monitors, smartwatches, and computer games to firewalls and routers. The objective is for all products available on the EU market to be cyber-secure, in response to the increasing threat posed by cyber criminals and other malicious actors.