Skip to content
Photo of Lisa Peets

Lisa Peets

Lisa Peets is co-chair of the firm's Technology and Communications Regulation Practice Group and a member of the firm's global Management Committee. Lisa divides her time between London and Brussels, and her practice encompasses regulatory compliance and investigations alongside legislative advocacy. For more than two decades, she has worked closely with many of the world's best-known technology companies.

Lisa counsels clients on a range of EU and UK legal frameworks affecting technology providers, including data protection, content moderation, artificial intelligence, platform regulation, copyright, e-commerce and consumer protection, and the rapidly expanding universe of additional rules applicable to technology, data and online services.

Lisa also supports Covington’s disputes team in litigation involving technology providers.

According to Chambers UK (2024 edition), "Lisa provides an excellent service and familiarity with client needs."

Contact:Read more about Lisa PeetsEmail

On June 6 and June 9, 2022, the U.S. Treasury Department’s Office of Foreign Assets Control (“OFAC”) issued additional guidance on the sanctions that prohibit U.S. persons from making a “new investment” in Russia and from providing accounting, trust and corporate formation, and management consulting services to any person located in Russia.

Separately, from June 15, 2022, the UK Office of Financial Sanctions Implementation (“OFSI”) gained new powers to impose financial penalties for breaches of UK sanctions regulations (including, but not limited to, the UK sanctions regulations with respect to Russia) on a strict liability basis and to publish reports of cases where it is satisfied that a breach of financial sanctions has occurred but where no penalty is imposed.

This alert summarizes these new sanctions developments.

New U.S. Sanctions Developments

Guidance on the Prohibitions on “New Investment” by U.S. Persons in Russia

On June 6, 2022, OFAC issued guidance in the form of responses to new frequently asked questions (“FAQs”) to clarify certain aspects of the prohibitions on “new investment” in Russia by U.S. persons that were imposed under the following executive orders (“E.O.s”):

  • E.O. 14066, issued on March 8, 2022 (prohibiting new investment by U.S. persons in the energy sector of the Russian Federation, as described in our March 10 alert); 
  • E.O. 14068, issued on March 11, 2022 (prohibiting new investment by U.S. persons in any sector of the Russian Federation economy as may be determined by the Secretary of the Treasury, in consultation with the Secretary of State); and 
  • E.O. 14071, issued on April 6, 2022 (prohibiting “all new investment in the Russian Federation by U.S. persons, wherever located” as well as “any approval, financing, facilitation, or guarantee by a U.S. person, wherever located, of a transaction by a foreign person where the transaction by that foreign person would be prohibited by E.O. 14071 if performed by a U.S. person or within the United States,” as described in our April 11 alert.

Continue Reading Recent Developments in U.S. and UK Sanctions: OFAC Guidance on “New Investment” and Prohibition on the Provision of Certain Services to Any Person in Russia; UK Sanctions Enforcement Developments

On May 10, 2022, Prince Charles announced in the Queen’s Speech that the UK Government’s proposed Online Safety Bill (the “OSB”) will proceed through Parliament. The OSB is currently at committee stage in the House of Commons. Since it was first announced in December 2020, the OSB has been the subject of intense debate and scrutiny on the balance it seeks to strike between online safety and protecting children on the one hand, and freedom of expression and privacy on the other.

To what services does the OSB apply?

The OSB applies to “user-to-user” (“U2U”) services—essentially, services through which users can share content online, such as social media and online messaging services—and “search” services. The OSB specifically excludes  email services, SMS, “internal business services,” and services where the communications functionality is limited (e.g., to posting comments relating to content produced by the provider of the service). The OSB also excludes “one-to-one live aural communications”—suggesting that one-to-one over-the-top (“OTT”) calls are excluded, but that one-to-many OTT calls, or video calls, may fall within scope.Continue Reading Online Safety Bill to Proceed Through Parliament

Last month, the US-EU Trade and Technology Council (TTC) held its inaugural ministerial in Pittsburgh: US Secretary of State Antony Blinken, Commerce Secretary Gina Raimondo, and Trade Representative Katherine Tai met with European Commissioners Margrethe Vestager and Valdis Dombrovskis. Only three months after the TTC process was launched at the…
Continue Reading US-EU Trade and Tech Council: Takeaways and Next Steps

On 22 September 2021, the UK Government published its 10-year strategy on artificial intelligence (“AI”; the “UK AI Strategy”).

The UK AI Strategy has three main pillars: (1) investing and planning for the long-term requirements of the UK’s AI ecosystem; (2) supporting the transition to an AI-enabled economy…
Continue Reading The UK Government Publishes its AI Strategy

Three summits last week—G-7, NATO, and U.S.-EU—launched a wide range of transatlantic initiatives to coordinate policy, particularly on trade, technology, and defense. These new formats and dialogues can ensure a much deeper level of regulatory cooperation between the United States and Europe by exchanging perspectives, briefing materials, and in some cases, staff. For companies on both sides of the Atlantic, these emerging policy trends also open up new opportunities to engage decision-makers both in Washington and European capitals.
Continue Reading Transatlantic Summits: Main Takeaways for Tech and Defense

In April 2021, the European Commission released its proposed Regulation Laying Down Harmonized Rules on Artificial Intelligence (the “Regulation”), which would establish rules on the development, placing on the market, and use of artificial intelligence systems (“AI systems”) across the EU. The proposal, comprising 85 articles and nine annexes, is part of a wider package of Commission initiatives aimed at positioning the EU as a world leader in trustworthy and ethical AI and technological innovation.

The Commission’s objectives with the Regulation are twofold: to promote the development of AI technologies and harness their potential benefits, while also protecting individuals against potential threats to their health, safety, and fundamental rights posed by AI systems. To that end, the Commission proposal focuses primarily on AI systems identified as “high-risk,” but also prohibits three AI practices and imposes transparency obligations on providers of certain non-high-risk AI systems as well. Notably, it would impose significant administrative costs on high-risk AI systems of around 10 percent of the underlying value, based on compliance, oversight, and verification costs. This blog highlights several key aspects of the proposal.

Definition of AI systems (Article 3)

The Regulation defines AI systems as software using one or more “techniques and approaches” and which “generate outputs such as content, predictions, recommendations or decisions influencing the environments they interact with.” These techniques and approaches, set out in Annex I of the Regulation, include machine learning approaches; logic- and knowledge- based approaches; and “statistical approaches, Bayesian estimation, [and] search and optimisation methods.” Given the breadth of these terms, a wide range of technologies could fall within scope of the Regulation’s definition of AI.

Territorial scope (Article 2)

The Regulation would apply not only to AI systems placed on the market, put into service, or used in the EU, but also to systems, wherever marketed or used, “where the output produced by the system is used in the Union.” The latter requirement could raise compliance challenges for suppliers of AI systems, who might not always know, or be able to control, where their customers will use the outputs generated by their systems.

Prohibited AI practices (Article 5)

The Regulation prohibits certain AI practices that are deemed to pose an unacceptable level of risk and contravene EU values. These practices include the provision or use of AI systems that either deploy subliminal techniques (beyond a person’s consciousness) to materially distort a person’s behaviour, or exploit the vulnerabilities of specific groups (such as children or persons with disabilities), in both cases where physical or psychological harm is likely to occur. The Regulation also prohibits public authorities from using AI systems for “social scoring”, where this leads to detrimental or unfavourable treatment in social contexts unrelated to the contexts in which the data was generated, or is otherwise unjustified or disproportionate. Finally, the Regulation bans law enforcement from using ‘real-time’ remote biometric identification systems in publicly accessible spaces, subject to certain limited exceptions (such as searching for crime victims, preventing threat to life or safety, or criminal law enforcement for significant offenses).

Classification of high-risk AI systems (Article 6)

The Regulation classifies certain AI systems as inherently high-risk. These systems, enumerated exhaustively in Annexes II and III of the Regulation, include AI systems that are, or are safety components of, products already subject to EU harmonised safety regimes (e.g., machinery; toys; elevators; medical devices, etc.); products covered by other EU legislation (e.g., motor vehicles; civil aviation; marine equipment, etc.); and AI systems that are used in certain specific contexts or for specific purposes (e.g.; for biometric identification; for educational or vocational training, etc.).


Continue Reading European Commission Proposes New Artificial Intelligence Regulation

On 17 December 2020, the Council of Europe’s* Ad hoc Committee on Artificial Intelligence (CAHAI) published a Feasibility Study (the “Study”) on Artificial Intelligence (AI) legal standards. The Study examines the feasibility and potential elements of a legal framework for the development and deployment of AI, based on the Council

…
Continue Reading AI Update: The Council of Europe Publishes Feasibility Study on Developing a Legal Instrument for Ethical AI

On 25 November 2020, the European Commission published a proposal for a Regulation on European Data Governance (“Data Governance Act”).  The proposed Act aims to facilitate data sharing across the EU and between sectors, and is one of the deliverables included in the European Strategy for Data, adopted in February 2020.  (See our previous blog here for a summary of the Commission’s European Strategy for Data.)  The press release accompanying the proposed Act states that more specific proposals on European data spaces are expected to follow in 2021, and will be complemented by a Data Act to foster business-to-business and business-to-government data sharing.The proposed Data Governance Act sets out rules relating to the following:
  • Conditions for reuse of public sector data that is subject to existing protections, such as commercial confidentiality, intellectual property, or data protection;
  • Obligations on “providers of data sharing services,” defined as entities that provide various types of data intermediary services;
  • Introduction of the concept of “data altruism” and the possibility for organisations to register as a “Data Altruism Organisation recognised in the Union”; and
  • Establishment of a “European Data Innovation Board,” a new formal expert group chaired by the Commission.

Conditions for reuse of public sector data (Chapter II, Articles 3-8)

Chapter II of the Data Governance Act would impose conditions on public-sector bodies when they make certain protected data that they hold available for re-use.  These provisions apply to data held by public-sector bodies that are protected on grounds of commercial or statistical confidentiality, intellectual property rights, or personal data protection.  The Act does not impose new obligations on public-sector bodies to allow re-use of data and does not release them from their existing legal obligations with respect to data.  But if public-sector bodies do make protected data available for re-use, they must comply with the conditions set out in Chapter II.

Specifically, the Act prohibits public-sector bodies from granting exclusive rights in data or restricting the availability of data for re-use by entities other than the parties to such exclusive agreements, with limited derogations.  In addition, if a public-sector body grants or refuses access for the re-use of data, it must ensure that the conditions for such access (or refusal) are non-discriminatory, proportionate, and objectively justified, and must make those conditions publicly available. The Act also provides that public bodies “shall” impose conditions “that preserve the functioning of the technical systems” used to process such data, and authorizes the Commission to adopt implementing acts declaring that third countries to which such data may be transferred provide IP and trade secret protections that are “essentially equivalent” to those in the EU.

In addition, where specific EU acts establish that certain non-personal data categories held by public-sector bodies are  “highly sensitive,” such data may be subject to restrictions on cross-border transfers, as specified by the Commission through delegated acts.

Obligations on “providers of data sharing services” (Chapter III, Articles 9-14)

Chapter III of the Act introduces new rules for the operation of data intermediaries, termed “providers of data sharing services”.  Specifically, it would establish a notification and compliance framework for providers of the following data sharing services:

  • Intermediation services between data holders and data users, which include platforms or databases enabling the exchange or joint exploitation of data, such as industry data spaces;
  • Intermediation services between data subjects that seek to make their personal data available and potential data users; and
  • “Data cooperative” services that support individuals or SMEs to negotiate terms and conditions for data processing.

The Act set out several requirements that providers of these data sharing services would need to comply with, including:

  • Notifying the relevant EU Member State authority of its intent to provide such services;
  • Appointing a legal representative in one of the Member States, if the company is not established within the EU;
  • Not using the data collected for other purposes, and using any metadata only for the development of that service;
  • Placing its data sharing service in a “separate legal entity” from its other services;
  • Having in place adequate security safeguards; and
  • Imposing a fiduciary duty towards data subjects to act in their best interests.

Continue Reading The European Commission publishes a proposal for a Regulation on European Data Governance (the Data Governance Act)

On October 3, 2019, the United States and United Kingdom signed an agreement on cross-border law enforcement demands for data from service providers (“Agreement”). The Agreement is the first bilateral agreement to be entered under the Clarifying Lawful Overseas Use of Data (CLOUD) Act. It obligates each Party to

…
Continue Reading U.S. and U.K. Sign CLOUD Act Agreement

On 18 September, Scotland voted “no” in a referendum on whether it should be an independent country.  The UK remains intact, the financial markets responded positively, and, according to David Cameron, the Queen “purred”.  Had the Scots chosen independence, difficult issues would require addressing. Among these are what …
Continue Reading Business breathes a sigh of relief as Scotland votes “no”, but uncertainties remain