EU Trends and Developments Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
Recent enforcement demonstrates the continued sen - sitivity of transfer risk. In 2025, the Irish Data Protec - tion Commission imposed a EUR530 million fine on TikTok Technology Limited, finding that transfer impact assessments had not sufficiently addressed Chinese legal risks. The decision reinforces that documenta - tion alone cannot compensate for deficiencies in sub - stantive risk assessment or technical safeguards. For AI systems operating across distributed infra - structure, transfer risk extends beyond hosting loca - tion. Remote administrative access, cross-border inference processing and sub-processor chains may constitute transfers under Article 44. In AI ecosys - tems characterised by continuous optimisation and federated infrastructure, data flows are often dynamic rather than static, complicating transfer mapping and impact assessments. Beyond strict legal doctrine, data sovereignty has also evolved into both a regulatory and a commercial expectation. European enterprise customers increas - ingly request EU-based hosting, regional inference endpoints and contractual restrictions on secondary training uses. These requirements often exceed mini - mum legal standards, but reflect heightened sensitiv - ity to strategic autonomy and geopolitical risk. Accordingly, transfer compliance is no longer a dis - crete legal assessment but an architectural consid - eration. Data sovereignty increasingly shapes infra - structure design, vendor selection and governance strategy, reinforcing the GDPR’s role as the constitu - tional benchmark for cross-border data flows. Special categories and inference risk Article 9, GDPR prohibits processing of special cate - gories of personal data, subject to limited exceptions. These categories – including data revealing health, political opinions, religious beliefs, trade union mem - bership, genetic and biometric data – reflect height - ened constitutional sensitivity within the EU legal sys - tem. AI systems capable of large-scale inference signifi - cantly complicate this framework. Supervisory author - ities have indicated that outputs revealing health sta - tus, political opinions or ethnic origin may fall within
Article 9, even where not explicitly collected. In this respect, the legal qualification of processing may turn not only on the nature of the data collected, but on the attributes that can reasonably be derived from them. The CJEU’s protective jurisprudence in cases such as OT v Vyriausioji tarnybinės etikos komisija (Case C-184/20) supports broad interpretation of sensitive data protections. The court has consistently empha - sised that Article 9 must be interpreted in light of its objective of ensuring enhanced protection for data that exposes individuals to particular risks of discrimi - nation or social exclusion. For AI systems deployed in biometric identification, behavioural analytics, sentiment analysis or predic - tive profiling contexts, inference capability becomes legally determinative. The assessment must consider both input data and the reasonably foreseeable out - puts that a model is capable of generating. A system that derives sensitive attributes through probabilistic modelling may fall within Article 9 even if such attrib - utes were not intentionally targeted. The expansion of inference capability therefore broad - ens the potential scope of Article 9 beyond traditional data collection paradigms. In AI-driven environments, sensitive data risk arises not only from what is col - lected, but from what can be inferred. Conclusion: procedural recalibration and strategic positioning in 2026 Taken together, the AI Act, the Data Act, the DMA, the DSA and related cybersecurity instruments rep - resent not fragmentation but consolidation within the Union’s digital framework. However, none of these instruments displace the GDPR’s constitutional sta - tus. Where personal data is processed, the assess - ment of digital systems continues to be anchored in the GDPR’s principles of lawfulness, purpose limita - tion, fairness, transparency and accountability. For technology providers, this architecture precludes siloed compliance. AI Act risk classification, data governance obligations under the Data Act, platform responsibilities under the DSA and competition-fac - ing duties under the DMA intersect with, rather than replace, data protection governance. Risk assess -
109 CHAMBERS.COM
Powered by FlippingBook