The European Union’s regulatory landscape concerning artificial intelligence (AI) and data protection presents a multi-layered challenge for organizations deploying AI systems. Particularly complex is the task of navigating compliance with the EU AI Act alongside the General Data Protection Regulation (GDPR) when dealing with sensitive personal data. Companies must ensure that AI systems are not only impartial in design but also adhere to rigid data protection standards.
A particular challenge arises from the delicate balance between maintaining algorithmic fairness and securing sensitive personal data, a balance complicated by potentially conflicting provisions within the EU AI Act and the GDPR. Article 10(5) of the AI Act allows for the processing of sensitive data when necessary to detect and correct bias in high-risk AI systems, seemingly creating a new legal basis for such processing, albeit in conflict with Article 9 of the GDPR, which restricts data processing without explicit consent or recognized legal justification like substantial public interest.
This disparity creates an ambiguous regulatory environment, leading to uncertainty for organizations trying to ensure compliance and fairness in AI operations. A recent report by the European Parliament Research Service acknowledged these complexities, suggesting potential legislative intervention, yet in the current climate, businesses must manage the balance on their own.
Legal practitioners are considering various pathways to compliance. One involves interpreting “substantial public interest” under GDPR’s Article 9(2)(g) to support data processing necessary for bias detection and correction. This approach hinges on a consensus from supervisory authorities to provide clear legal guidance. Another option suggested by a Belgian supervisory authority involves aligning bias correction with GDPR’s principles of fair processing, although this does not officially constitute a legal basis under Article 9, necessitating broader regulatory agreement.
In this regulatory ambiguity, a proactive and well-documented strategy is paramount. Organizations should perform risk assessments that accommodate both the AI Act and GDPR mandates, particularly considering the high-risk classification and conducting data protection impact assessments. Additionally, it is crucial for businesses to document their processes meticulously, ensuring transparent communication about data usage and implementing robust governance for AI systems handling sensitive data.
Despite awaiting unified guidance from regulatory bodies, entities must implement state-of-the-art security measures, limit data access through strong controls, and employ data minimization and anonymization techniques where possible. Moreover, when feasible, obtaining explicit consent for processing special category data remains a viable route alongside exploring substantial public interest claims.
This dual compliance landscape requires organizations to maintain detailed records and ensure their compliance documentation is thorough, underpinning the importance of a structured approach in navigating the present regulatory gaps. For further insights, the original article can be accessed here.