Module 6: Current Laws that apply to AI Systems: Spotlight on the GDPR

Question 1

How does Article 22 of the GDPR impact AI?

Answer 1

The GDPR imposes a general prohibition on automated decision-making that can have a serious effect on an individual. Mitigations under the GDPR to allow automated decision-making include:
- explicit, freely given and informed consent
- a mechanism for individuals to request human intervention (a human review of an automated decision)
- contract fulfillment
- providing a means to opt-out
- redress (manual human review of an AI decision)

Question 2

How does Article 35 of the GDPR impact AI?

Answer 2

It requires that a DPIA be conducted when processing poses a high risk to rights and freedoms of natural persons. One of those high risks is the use of new technology, such as AI. DPIAs have become a best practice to understand the implications of AI processing.

Question 3

How does Recital 26 of the GDPR impact AI?

Answer 3

Pseudonymization can be an important tool to protect personal information used to train AI models. Pseudonymized data is considered personal data under the GDPR. (The GDPR does not apply to anonymized data.). True anonymization is very difficult to achieve, especially at scale, and greatly diminishes the utility of the data.

Question 4

When is an AI conformity assessment triggered per the EU AI Act?

Answer 4

Depending on the risk to health, safety and fundamental rights of individuals.

Question 5

What do DPIAs and AI conformity assessments have in common?

Answer 5

They are both methods of providing accountability in developing new technology and using data.