November 2023 in Brief: Internet Law & Cybersecurity

SAG-AFTRA’s Tentative AI Protections

By Brian Jones, J.D. Candidate, Class of 2026, University of Chicago

Shortly after their previous three-year deal with the Alliance of Motion Picture and Television Producers (AMPTP) for TV/theatrical contracts expired on July 12, 2023, the Screen Actors Guild – American Federation of Radio and Television Artists (SAG-AFTRA) went on strike over wage increases, streaming-based compensation, artificial intelligence (AI) protections, and other issues. On November 10, 2023, the SAG-AFTRA National Board approved a tentative deal reached with the AMPTP, effectively ending the strike. The summary of the tentative agreement has been sent to union members for ratification, with votes due by December 5. The full memorandum of agreement is expected to be released within the next few weeks.

Notably, the agreement distinguished four different types of digital performers created with AI. Each type has varying terms governing the required compensation for its creation, as well as its initial and potentially ongoing use. They fit into two broad categories: digital replicas and synthetic performers. Digital replicas are based on the voice and/or likeness of human performers (and require their consent), whereas a synthetic performer is not based on any human performer.

There are two different kinds of digital replicas for principal performers.

(1) Employment-Based Digital Replicas (EBDR)

• Definition: The performer physically participates in its creation, in connection with her employment on a specific project.
• Compensation for replica’s use in the original project: With exceptions, performer is compensated at her pro rata daily rate (or daily minimum if higher) for the number of production days it would have taken her to appear in the scenes.
• Compensation for replica’s use in another project: With exceptions, compensation is determined by bargaining, with the minimum set at day performer rate (or minimum wages/residuals under SAG-AFTRA agreements for other mediums).

(2) Independently Created Digital Replicas (ICDR)

• Definition: ICDR are defined similarly to EBDRs, but there is no employment arrangement for the project in which the replica will appear.
• Compensation for replica’s use: Determined by bargaining prior to use.

There is also a third type of digital replica for non-principal performers.

(3) Background Actor Digital Replica (BADR)

• Definition: The background actor physically participates in the creation of the replica, which depicts her in a scene in which she does not actually appear.
• Compensation for replica’s use in the original project: If the replica is used in a principal capacity, compensation is required based on the number of production days the performer would have been required to work in the absence of the replica.
• Compensation for replica’s use in another project: Subject to background actor daily minimum (or minimum wages/residuals under SAG-AFTRA agreements for other mediums).

Finally, there are synthetic performers, which are explicitly not digital replicas.

(4) Synthetic Performers

• Definition: A synthetic performer is defined as a digitally created asset where it is not a digital replica, there is no employment arrangement with a natural person for the role, and it is not recognizable as a natural performer or voiced by a natural performer.
• Compensation: Union receives the opportunity to bargain for “appropriate consideration” when a synthetic performer is used for the role of a human character that would have otherwise gone to a human performer.

Texas Hospital Associations and Hospitals File Claim against HHS Rules on Web-Tracking Technology

By Jessica Varda, J.D. Candidate, Class of 2026, Louis D. Brandeis School of Law at the University of Louisville

On November 2, 2023, the American Hospital Association, the Texas Hospital Association, Texas Health Resources, and United Regional Health Care System filed a claim against the U.S. Department of Health and Human Services (HHS) and HHS’s Office of Civil Rights (OCR) in U.S. District Court for the Northern District of Texas, Fort Worth Division, against a rule in a bulletin issued by OCR in December 2022 titled “Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates.” The OCR bulletin provides guidance on the obligations of entities covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) when using web tracking technologies. OCR administers and enforces the HIPAA Privacy, Security, and Breach Notification Rules (HIPAA Rules), and any failure to comply with HIPAA Rules may result in a civil money penalty. Per the OCR bulletin, “Regulated entities are not permitted to use tracking technologies in a manner that would result in impermissible disclosures of PHI [(protected health information)] to tracking technology vendors or any other violations of the HIPAA Rules.”

The OCR bulletin states that all individually identifiable health information (IIHI), including “an individual’s medical record number, home or email address, or dates of appointments, as well as an individual’s IP address or geographic location,” generally is PHI, even if no “specific treatment or billing information like dates and types of health care services” is included and “even if the individual does not have an existing relationship with the regulated entity” because it “connects the individual to the regulated entity . . . and thus relates to the individual’s past, present, or future health or health care or payment for care.”

The claim by Texas hospital associations and hospitals discusses a balance that HIPAA strikes between protecting private health information while also sharing non-private health-related information with the public, on publicly accessible websites. Per the claim, third-party technologies—such as analytic tools, video technologies, translation technologies, and map and location technologies—enhance health websites and typically use IP addresses to function, to allow for honing a website’s functionality and the helpfulness of the information, and to adjust to the public’s needs to improve public health. The claim asks for relief against the OCR position in the bulletin that, in the claim’s description, “when an online technology connects (1) an individual’s IP address with (2) a visit to an Unauthenticated Public Webpage that addresses specific health conditions or healthcare providers, that combination of information . . . is subject to restrictions on use and disclosure under HIPAA.”