Artificial Intelligence, Privacy

BSA Brings Policy Clarity to AI and Privacy Discussions at IAPP Global Privacy Summit

This slideshow requires JavaScript.

Policy leaders from the Business Software Alliance (BSA) led timely and incisive discussions on issues at the intersection of AI, privacy, and policy at this year’s IAPP Global Privacy Summit in Washington, DC.

Across sessions, BSA focused on key topics including the evolving state AI policy landscape, the role of data minimization in privacy laws, and how best to address generative AI policy implications in an effective, globally interoperable way.

Managing Director of Policy Kate Goodloe discussed why data minimization matters in privacy laws. The panel explored how state privacy laws increasingly include data minimization obligations, but with significant variation in how those obligations are defined and applied. Panelists emphasized the importance of ensuring that these standards both protect consumers and allow for beneficial uses of data, and highlighted the need for practical approaches that align organizational data practices with reasonable consumer expectations.

Director of Policy Meghan Pensyl led a panel on navigating the state AI landscape, examining trends and predictions shaping state-level policymaking. Panelists highlighted the rapid increase in state AI legislation and a shift toward more targeted approaches, including regulation of specific technologies, sectoral use cases such as employment and health care, and expanded transparency requirements. The discussion also underscored continued state-level experimentation, with emerging issues like agentic AI and liability likely to shape the next phase of policymaking.

Senior Director of Policy Shaundra Watson led a panel examining key perspectives on AI and privacy in the context of large language models. The discussion explored the tension between priorities such as privacy and safety, the importance of clearly defined roles and responsibilities through a shared accountability model, and the need to tailor transparency to relevant audiences while protecting security and intellectual property.

The distinction of hosting three panels at IAPP helped underscore the extent to which BSA continues to position itself as a leader on AI and privacy policy, along with the association’s ability to convene thoughtful and practical conversations about how policy supports responsible innovation.

Privacy

Privacy Law in 2026: A Global Snapshot

Privacy laws are now a fact of life across much of the global economy. From Europe and the United Kingdom to Asia, the Americas, and beyond, governments have put comprehensive data protection frameworks into place. What varies is how those frameworks are being put to work. Read More >>

Privacy laws are now a fact of life across much of the global economy. From Europe and the United Kingdom to Asia, the Americas, and beyond, governments have put comprehensive data protection frameworks into place. What varies is how those frameworks are being put to work. Read More >>

Artificial Intelligence, Privacy

BSA Testimony: Congress Can Craft Worthy Privacy Law by Drawing From Foundational Portions of State Laws

Congress should pursue a comprehensive federal privacy law worthy of preempting different states’ own privacy laws, BSA Managing Director of Policy Kate Goodloe said during a Senate Judiciary Subcommittee hearing. Read More >>

Congress should pursue a comprehensive federal privacy law worthy of preempting different states’ own privacy laws, BSA Managing Director of Policy Kate Goodloe said during a Senate Judiciary Subcommittee hearing. Read More >>

Artificial Intelligence, Privacy

A Legitimate Interest in AI Training

Privacy regulators worldwide are examining how existing privacy laws apply to companies that create and use AI systems. One key question regulators confront is why companies process personal data for AI-related activities — and if they do so for a reason recognized in their country’s privacy law, such as if it is based on consent, necessary to perform a contract or if the company has a legitimate interest in the activity. Read More >>

Privacy regulators worldwide are examining how existing privacy laws apply to companies that create and use AI systems. One key question regulators confront is why companies process personal data for AI-related activities — and if they do so for a reason recognized in their country’s privacy law, such as if it is based on consent, necessary to perform a contract or if the company has a legitimate interest in the activity. Read More >>