Why?

The rapid development of GenAI and its widespread uptake has given rise to a raft of legal issues that are now being tested in courts around the world. The growing list includes intellectual property, privacy, unfair trade practices, product liability, defamation, professional misconduct, and more. Some notable recent cases include:

• Privacy: Developers of GenAI rely on vast amounts of data to train the tools. A variety of techniques are used to gather the data, ranging from collecting user inputs to the controversial practice of “web-scraping” (an automated process of trawling the internet to extract and store data from millions of users). In June and September 2023, two separate class action claims were filed against OpenAI, the developer of ChatGPT, in the US. Both claims alleged, among other things, that OpenAI stole private and personal information from millions of internet users without consent or knowledge in order to train its GenAI products. While the first of these claims was voluntarily dismissed, the other will be an opportunity for the US courts to provide some insight and clarity on the privacy issues underlying GenAI. 
• Intellectual property: GenAI developers are also facing claims that the outputs generated by GenAI tools infringe intellectual property rights. In a pending US lawsuit, Getty Images has alleged that an AI image generator, developed by Stability Diffusion AI, has infringed its copyright by copying more than 12 million photographs and metadata from Getty Images’ collection, and reproducing these images (often in a distorted form). Other high-profile US cases include a class action by artists suing multiple GenAI developers, claiming that their copyright work was used to train the GenAI and produce unauthorised derivatives. The issue affects a wide range of creative industries, with similar lawsuits filed by music publishers and authors. 

Areas to watch in New Zealand include the following:

• Lawsuits including class actions: We expect to see AI-related disputes of the sort described above to begin hitting the New Zealand courts, particularly as overseas judgments start to be released, providing guidance from similar jurisdictions.
• Privacy investigations: The Office of the Privacy Commission (OPC) has made it clear that the Privacy Act applies to the collection and processing of personal information, including by businesses using or building GenAI. It has issued non-binding guidance intended to help organisations comply with their privacy obligations and responsibilities when using GenAI. It also announced that it will be working to ensure that GenAI use by businesses is compliant with privacy obligations and that it will be conducting investigations where appropriate. 
• AI-specific regulation and legislation: The use and supply of AI systems in New Zealand are regulated through existing laws (for example, privacy, data protection, copyright, human rights, consumer protection, and harmful digital communications laws) and to date no comprehensive AI legislation has been tabled. However, we are seeing an uptick in non-binding guidance around the development, deployment and use of AI being issued by regulators and industry groups, to help fill perceived gaps in our legislative approach. This includes, for example, the OPC guidelines discussed above and the New Zealand Law Society’s guidelines.
• In late February 2024, Justice Minister Judith Collins announced that the Government was committed to getting New Zealand up to speed on AI but that there would be no extra-regulation at this stage. However, New Zealand legislators will no doubt be closely monitoring the regulatory approaches of the EU (shortly set to enact the world first Artificial Intelligence Act (you can read our report on the Act here) and our other key trading partners. These include Australia where the federal government has indicated it may look to implement legislation that controls the use of AI in high-risk settings and China where the state council recently announced a comprehensive AI law is on the legislative agenda.

What it means for you

Businesses and individuals will need to be vigilant when developing or deploying GenAI to protect against exposure to the developing legal risks. This will include:

• Being aware of and complying with the OPC’s guidelines on AI use
• Auditing the use, development, and supply of AI systems within the business and its supply chains
• Mapping and documenting relevant processes (eg databases and training)
• Conducting privacy impact and algorithmic assessments before AI systems are implemented/developed and putting in place procedures for ongoing risk identification, and
• For businesses whose AI systems are placed on the market in the EU or whose use of AI systems affects people located in the EU, being aware of the requirements of the EU AI Act, including its staggered deadlines for enforcement.

Get in touch

For more information please contact our data and privacy experts below.