Impact of the EU Artificial Intelligence Act From a Personal Data Protection and IP Perspective │Romania
As the final vote on the proposed EU AI law approaches, PwC Legal’s Daniel Vinerean and Irina Neagu offer a snapshot of its potential consequences for data privacy and IP rights.
Data is an indispensable element of digital development, especially in the fields of artificial intelligence (AI), machine learning (ML) and deep learning (DL). The increasingly rapid development of AI is outpacing legal regulation, with the climax of this race based on the type and source of data used to train AI on the one hand and the purpose of data use on the other. From personal photos to copyrighted works, from social scoring to chatbots, AI’s datasets and uses are as diverse as they are vast.
With the focus on harnessing the economic power of AI, the need to protect the rights of individuals in general – and privacy and IP rights, in particular – is gaining ground in this battle. By way of example, the world’s first comprehensive legislation on AI was introduced in April 2021. The AI Proposal Act announced by the EC marked a milestone in the era of AI regulation. Since this turning point, there have been and continue to be important steps on all fronts to develop and adopt a system across the EU that will encourage investment in the field and ensure the development of safe, transparent, traceable and legal AI, which respects fundamental rights (as also enshrined in EU legislation).
“Given the groundbreaking nature and broad scope of the EU AI Act, it has the potential to set a global standard for AI regulation, along the lines of the EU GDPR.”
With negotiators from the European Parliament and the European Council having reached a provisional agreement on the EU AI law at the end of 2023 after more than two years of negotiations, 2024 is off to a strong start and promises to be a key year for AI legislation in the EU. In early February 2024, the Committee of Permanent Representatives voted unanimously to advance the EU Artificial Intelligence Act (the “EU AI Act”). On 13 February 2024, the Internal Market and Civil Liberties Committees of the European Parliament voted to approve the EU AI Act, with the final vote in plenary to take place in April 2024.
What Challenges Does AI Pose for EU Legislation?
Given the groundbreaking nature and broad scope of the EU AI Act, it has the potential to set a global standard for AI regulation, along the lines of the EU General Data Protection Regulation (GDPR). Although the GDPR does not specifically mention AI, many of its provisions are relevant, given the frequently innovative ways in which AI processes personal data. The real challenge is to balance data protection principles (such as purpose limitation and data minimisation, as well as limiting profiling and automated decisions) with the full development of the power of AI and big data.
In addition to GDPR issues, the rapid development of AI is also challenging the boundaries of IP and its protection. By way of example, the use of copyrighted works as training material for generative AI is quite problematic and requires extended transparency obligations regarding the content used for AI training, as well as solutions to protect copyright holders from unlawful use of their works. Furthermore, the development of innovative licensing models to ensure conditions and remuneration for such use should be considered with the utmost urgency. Finally, the debate on IP protection for AI-generated content calls for practical solutions.
How Does the EU AI Act Address Data Privacy and IP Issues?
In the light of the foregoing, it is worth mentioning the main issues addressed by the EU AI Act, which are:
- classifying AI systems and imposing obligations based on the level of risk associated with their use, with reference to possible violations of fundamental rights;
- imposing obligations on providers of general-purpose AI systems, such as creating and making publicly available a detailed summary of the content used to train the AI model as well as implementing a policy to comply with EU copyright law;
- imposing strict obligations on providers of high-risk AI systems, such as carrying out a fundamental rights impact assessment, registering in the EU database, keeping documentation and establishing rigorous procedures;
- limiting the use of AI systems for biometric identification to cases where their use is strictly necessary to achieve strictly defined objectives (and making their use subject to prior authorisation);
- prohibiting the use of AI systems whose purpose or effect is to manipulate or exploit the vulnerability of a group; and
- prohibitions on AI social scoring systems that rate or rank individuals with a score assigned based on social behaviour.
The Outlook
The forthcoming adoption of the EU AI Act and legislation in this area is continuously supported by other initiatives, such as the Communication adopted by the EC setting out its strategic approach to operationalise the EU AI Act, along with the package of measures adopted at the end of January to support European start-ups and SMEs in developing trustworthy AI. Some of the key actions are:
- amendment of the EuroHPC Regulation to include conditions for fast ML, training large general-purpose AI models, and facilitating access to dedicated supercomputers so that AI can be used by as many users as possible (including start-ups and SMEs);
- establishing an AI office within the EC to oversee the implementation and compliance of the EU AI Act; and
- financial support for generative AI from the EC through the Horizon Europe and Digital Europe programmes, a package that will leverage EUR4 billion of additional public and private investment by 2027.
While there are still several steps to go before the finalisation and entry into force of the EU AI Act, which is expected in the summer of 2024, the vote by the EU Parliament’s committees on 13 February 2024 represents another important step towards a set of rules that will change the dynamics of AI use and aims both to ensure the protection of rights from high-risk AI systems by imposing obligations based on the potential risks and level of impact of AI and to support the development and evolution of AI.
PwC Legal
