EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
regime: companies may anonymise and use patient data for development or research where valid grounds exist and robust safeguards are in place, while future access will increasingly depend on EHDS governance compliance. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Under EU law, any AI system that processes personal data is subject to the GDPR. Controllers must iden - tify a valid Article 6 legal basis (and Article 9 excep - tion where special categories are involved), comply with the core principles in Article 5 (including fair - ness, transparency, purpose limitation, data minimi - sation and accuracy), and implement data protection by design and by default (Article 25). Given the scale and complexity of AI training and inference, Article 32 security obligations are particularly significant. A Data Protection Impact Assessment is required under Article 35 where AI processing is likely to result in a high risk, including large-scale profiling, behavioural inference or use of sensitive data. Article 22, GDPR also specifically restricts decisions based solely on automated processing that produce legal or similarly significant effects. Such decisions are prohibited unless one of the narrow exceptions apply: necessity for entering into or performing a contract, authorisation by EU or member state law with appro - priate safeguards, or explicit consent. In those cases, controllers must ensure meaningful human interven - tion and enable individuals to express their views and contest the decision, and must provide meaningful information about the logic involved and the envis - aged consequences. The Artificial Intelligence Act (AI Act) also established a harmonised, risk-based framework for the develop - ment, placing on the market and deployment of AI systems in the EU. It classifies systems into prohibit - ed, high-risk, limited-risk and minimal-risk categories: • prohibited practices (eg, certain manipulative techniques, social scoring and specific biometric identification uses) may not be deployed; • high-risk systems, including those used in employ - ment, creditworthiness, law enforcement, migra - tion, education and critical infrastructure, are
subject to ex ante conformity assessments and ongoing compliance obligations; • limited-risk systems, mainly subject to transpar - ency obligations; and • minimal-risk systems, which are largely unregu - lated under the AI Act. For high-risk systems, the Act imposes extensive requirements centred on risk management, techni - cal documentation, record-keeping, robustness and cybersecurity. A core focus is data governance: pro - viders must ensure appropriate data management practices, assess the quality of training, validation and testing datasets, implement bias detection and mitigation measures, and document data sources and preprocessing methods. Transparency is required across several risk levels. Users must be informed when interacting with an AI system (eg, chatbots) or when content is AI-generat - ed (eg, deepfakes). High-risk systems must also be accompanied by clear instructions for use and suf - ficient information to enable effective oversight. Human oversight is a structural requirement for high- risk systems: they must be designed so that natu - ral persons can understand system capabilities and limitations, monitor outputs and intervene or override where necessary. The regimes are complementary: the GDPR governs the lawfulness of personal data processing and indi - vidual rights, while the AI Act regulates AI systems from a product safety and governance perspective. In practice, GDPR compliance is always required where personal data is involved, and additional AI Act obli - gations apply depending on risk classification, with transparency, data governance and human oversight forming the core pillars for high-risk AI. 1.6 Data Breach Requirement Under EU law, a “personal data breach” is defined as a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4 (12), GDPR). This covers confidentiality breaches (unauthorised access/disclosure), availability breaches (loss/inac -
91 CHAMBERS.COM
Powered by FlippingBook