Preparing for the AI Act - 5 years into GDPR enforcement

Preparing for the AI Act
5 years into GDPR enforcement
1

MEASURESUMMIT 2023
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates –
Data Governance & Privacy Engineer
2
AURELIE POLS,
DATA GOVERNANCE
& PRIVACY ENGINEER
• DPO for mParticle (Customer Data Platform) – contractor (USA, New York)
• Founder – Aurélie Pols & Associates
• Group expert member for the Observatory on the Online Platform Economy (E03607) – EU
Commission
•Guest professor DPO certification courses Maastricht University, faculty of law (NL) & Solvay
Business School Brussels (B)
• Board Member European Center On Privacy and Security, Maastricht University (NL)
• Ethics Advisory Group (EAG) – European Data Protection Supervisor (EDPS) Towards a digital
ethics
• Former Vice-chair P7002 – Data Privacy Process – IEEE
• Speaker/writer/consiglieri: Mobile World Congress, SWSX, Strata (+ Hadoop World), IAPP, Piwik,
AT Internet, industry associations, AdTech & MarTech vendors, …
2003:
OX2 Co-founder
Webanalytics.be
2008:
Sold to Digitas LBi
(Publicis)
Data is the New infrastructure – Privacy is the New Green – Trust is the New Currency
Dutch nationality, French mother tongue, works in English, lives in Spain

MEASURESUMMIT 2023
In a nutshell
3

MEASURESUMMIT 2023
Harmless GenAI?
4
Source: elpais.com/opinion/2023-
09-25/la-pornografia-sintetica-es-
propaganda.html
Las niñas de Almendralejo sentirán vergüenza
por algo que no han hecho, incluso cuando
todo el mundo sabe que no es verdad.
“The girls in Almendralejo will feel
shame for something they have not
done, even when everyone knows it
is not true.”
Hay que estar atentos porque la degradación y
deshumanización de un colectivo suele anunciar
episodios de violencia masiva. Es la justificación
preventiva de lo que va a pasar a continuación.
“We must be vigilant because the
degradation and dehumanisation of
a collective often heralds episodes of
mass violence. It is the pre-emptive
justification for what will happen
next.”

MEASURESUMMIT 2023
The basis of European democracy: The Charter
5

MEASURESUMMIT 2023
Add the TFEU* and you get? A living instrument
The law is a living instrument,
eternally under construction
6
* TFEU = Treaty of
Functioning of the EU

MEASURESUMMIT 2023
aurelie.pols@protonmail.com © prepared by Aurélie Pols for Aurelie Pols & Associates – 7

MEASURESUMMIT 2023
The journey in the EU + int. started with Convention 108
8
Source: https://www.coe.int/en/web/data-protection/convention108/background

MEASURESUMMIT 2023
While in the US – forwarding thinking also!
9
Source: https://www.fpc.gov/fair-info-practice-principles/

MEASURESUMMIT 2023
GDPR and ePrivacy address art. 8 and 7 of the Charter
1
0
Source:
https://www.europarl.europa
.eu/charter/pdf/text_en.pdf
The GDPR is the
evolution of the 1995 Data
Protection Directive
ePrivacy dates back to
2002, the Telecoms
package and has
incorporated consent for
“cookies” in 2009. The
ePrivacy Regulation
remains in trialogue to this
date

MEASURESUMMIT 2023
High level: opt-in vs. opt-out laws
Comparing roles in 2 major privacy laws:
GDPR is a horizontal law, which took 5 years to mature, is enshrined within EU law (Charter + TFEU), enforced by
supervisory authorities
CCPA was originally proposed as a ballot proposition by a privacy group known as Californians for Consumer Privacy.
1
1
CCPA/CPRA GDPR
Business Data controller
Service provider Data processor
3rd party/data broker Joint controller Accountability
Fundam
ental right
Lim
ited
rights
Data
to
support growth

MEASURESUMMIT 2023
Building on top (or next to) the GDPR
● In terms of competition
○ The Platform to Business Directive
○ The DMA => gatekeepers
● In terms of consumer protection
○ Directive on Consumer Rights (CRD)
○ The DSA => VLOPs
● The AI Act falls under Trust and Safety
1
2

MEASURESUMMIT 2023
Governance obligations in the EEA
● GDPR:
○ Broad scope of personal data => beyond PII, what is NOT PD? + accountability
○ Abidance to principles + lawful basis
○ Defined roles + obligations
● ePrivacy (interaction between art. 5(3) and GDPR)
○ Wider material scope (any information) and not just PD
○ BUT narrower situational scope: only triggered for terminal equipment…
○ And then yes, those consent banner, for better or worse? Personal opinion: which remain rather uninteroperable due to
lack of purpose classification
1
3

MEASURESUMMIT 2023
A word on the DSA
And section 230 on the other side of the pond…
1
4

MEASURESUMMIT 2023
DSA Transparency database: take downs at scale
Summary statistics on the statements of reasons submitted by providers of online platforms to the Commission,
https://transparency.dsa.ec.europa.eu/analytics
Note: the spike is
Google Shopping

MEASURESUMMIT 2023
On the DMA
iOS17 evolutions are welcome as DPO interested in (mobile) SDKs
Puzzled? Start here https://developer.apple.com/videos/play/wwdc2023/10060
1
6

MEASURESUMMIT 2023
Note however that industry initiatives are not always law
How Apple defines tracking:
“Tracking refers to the act of linking user or device data collected from your app with user or device data collected from
other companies’ apps, websites, or offline properties for targeted advertising or advertising measurement purposes.
Tracking also refers to sharing user or device data with data brokers.”
From https://developer.apple.com/app-store/user-privacy-and-data-use/
1
7

MEASURESUMMIT 2023
Link between the GDPR and the AI act: art. 22
1
8

MEASURESUMMIT 2023
Why am I telling you this?
1
9
Source: https://www.datenschutz-berlin.de/pressemitteilung/computer-sagt-nein/
AI enforcement is already here

MEASURESUMMIT 2023
Are fines the real risk?
It’s the visible part of the iceberg
Powers of SAs in art. 58:
1. Warnings &/or reprimands
2. Comply with DSRs
3. Bring processing operations into compliance
4. Communicate data breaches
5. Ban on processing &/or suspension of data flows
6. Withdraw certification
2
0

MEASURESUMMIT 2023
What am I responsible for as DPO?
21
Data
subject
Data
controller
Data
processor
Sub-
processor
It depends?
The GDPR defines roles:
1. Data controller
2. Data processor
Understand who you are
Collaborate to support signals
And fundamental rights? B2C (+ B2B)
B2B
B2B
Privacy Notices
Lawful basis
Data Subject Rights
MSA
SOW
T&C

MEASURESUMMIT 2023
Translate this into AI?
2
2
Source: https://storage02.forbrukerradet.no/media/2023/06/generative-ai-rapport-2023.pdf

Please regulate AI
Privacy AI whitewashing
Excuse me?
23

MEASURESUMMIT 2023
Getting our feet back on the ground
1. For an EEA company (+UK for now), all personal data processing falls under the GDPR
2. For prescriptive data, this means data processing obligations => accountability
3. For probabilistic data, this means ADM obligations ie
a. Art 22 “the right not to be subject to a decision based solely on automated processing, including profiling, which produces
legal effects concerning him or her or similarly significantly affects him or her.”
b. Art 13 to 15 “the existence of ADM, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful
information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data
subject.”
2
4

MEASURESUMMIT 2023
Common AI harms?
1. Physical harms
2. Economic harms
3. Reputational harms
4. Psychological harms
5. Autonomy harms
6. Discrimination harms
7. Relationship harms
8. Loss of opportunity
9. Social stigmatization and dignitary
harms
2
5
Source: https://epic.org/wp-
content/uploads/2023/05/EPIC-
Generative-AI-White-Paper-May2023.pdf

MEASURESUMMIT 2023
Know thy systems
As part of GDPR compliance preparation, your company should
1. Know which systems process personal data – as a data
controller/processor/joint controller
2. Make sure these systems have been vetted: security + privacy!
3. Abide by the obligations of the GDPR in terms of accountability –
grounded in each department: HR, marketing, customer support, …
Ø Includes re-use of personal data for potentially other
purposes?
4. List personal data used within art. 30 obligations (ROPA)
5. Be transparent with customers about how their data is used +
enforce their rights (DSR mechanisms)
2
6

MEASURESUMMIT 2023
Which often means drawing data flows
2
7
Source:
https://www.rosenthal.c
h/downloads/VISCHER-
AI-KB-Approach.pdf

MEASURESUMMIT 2023
Imperfect systems and dynamic challenges
The reality however shows that
1. Systems remains imperfect as they rarely include purpose, lawful basis
2. Data/product teams don’t really talk to privacy counsel/DPOs, do they?
3. DPOs don’t really get data science/technology, do they?
4. Deleting data is hard? And how do you prove it?
5. How transparent do you need to be?
6. What is fair?
7. Are we there yet?
8. How about undergoing systematic privacy/
data protection impact assessments? (DPIA)
2
8

MEASURESUMMIT 2023
With AI, the table got even more crowded!
2
9
Source
https://crfm.stanf
ord.edu/2023/06/
15/eu-ai-act.html

MEASURESUMMIT 2023
Because AI (ironically!) brings back IP challenges
3
0
Source:
https://www.theverge.co
m/2023/1/17/23558516/
ai-art-copyright-stable-
diffusion-getty-images-
lawsuit

MEASURESUMMIT 2023
And discussions about 💵 / 💶 / 💷 / 💴
Source:
https://www.theverge.com/20
23/9/25/23884679/getty-ai-
generative-image-platform-
launch

MEASURESUMMIT 2023
In conclusion what do we see?
1. More reliance on data by society, more regulation, evolving
enforcement => risk? depends on culture
2. More granularity of controls between actors, including data subjects
=> Privacy by Design + education!
3. More transparency around data processing operations, explainability
obligations between actors
4. Increased global coordination (AIAct based on OECD guidelines) &
also more lobbying
3
2

Thank you for your attention
Email:
Aurelie.pols@protonmail.com
The recovering dataholic turned Privacy Engineer
34

Preparing for the AI Act - 5 years into GDPR enforcement

Recomendados

Recomendados

Mais conteúdo relacionado

Semelhante a Preparing for the AI Act - 5 years into GDPR enforcement

Semelhante a Preparing for the AI Act - 5 years into GDPR enforcement (20)

Mais de Aurélie Pols

Mais de Aurélie Pols (20)

Último

Último (18)

Preparing for the AI Act - 5 years into GDPR enforcement