Marcus Evans

Partner, Norton Rose Fulbright

Marcus Evans is a data protection, privacy and cybersecurity lawyer based in London. As a partner in the communications media and technology team, Marcus leads our European Information Governance, Privacy and Cyber Security Group and our Artificial Intelligence Group and is a member of our International Outsourcing Group.

Marcus regularly coordinates multijurisdictional data privacy projects covering all aspects of data privacy compliance, including the roll out of privacy programmes, adoption of new technologies and working practices, cross border data flows, large scale or complex data subject right responses and liaison with regulators in relation to complaints and breaches. He also advises on artificial intelligence, data protection and freedom of information risks in e-commerce, commercial transactions, M&A and in relation to discovery and regulatory investigations, having had a broad outsourcing and tech practice before becoming focused on data and AI regulatory issues. He counsels clients across sectors.

Contributed to

1

Safeguarding personal data when procuring generative AI products—checklist

Checklists

This Checklist deals with areas of diligence and contractual terms relevant to personal data sharing by a customer with a vendor that is using generative AI (artificial intelligence that can create outputs such as text, images, video, or sound, referred to as Gen AI below) to provide services to the customer. We will refer both to the underlying Gen AI model and the AI system in which it operates as applicable, and will refer simply to Gen AI where vendors may be utilising either a Gen AI model or an AI system incorporating it.This Checklist only covers data protection issues under UK law (in particular, the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR)). It focuses on the salient points for Gen AI purposes when contracting in a data processing relationship, and should be read in conjunction with: Audit of a new or existing personal data processor—checklist and Stand-alone data processing

Information Law