News and developments

Artificial Intelligence and Data Protection: Call for Firm GDPR Enforcement in the Age of Algorithms

Cristina Savulescu - Cristina Săvulescu - Head of Whistleblowing & GDPR Bradu Neagu & Associates

Authored by: Cristina Savulescu, Partner

In the context of the exponential development of artificial intelligence (AI), rigorous enforcement of theGeneral Data Protection Regulation (GDPR) is becoming more important than ever. The emergence of advanced algorithmic systems - from facial recognition to conversational chatbots - has brought innovative benefits, but also significant risks to privacy and fundamental rights. The launch of generative AI services such as ChatGPT (considered the fastest-adopted app in history) has triggered increased attention from regulators, highlighting the need for GDPR principles to be strictly applied in the algorithmic era. Thus, the European Union is strengthening its legislative framework (through the preparation of the AI Act) and gearing its supervisory authorities towards increased cooperation to ensure compliance with data protection rules in the development and use of AI systems.

AI data protection risks

The widespread deployment of artificial intelligence systems poses a number of inherent risks

to the protection of personal data. Among the most important are:

Massive data collection and legality of processing - Many AI models train on huge volumes of data (including personal data) processed automatically, sometimes without adequate legal basis or without the information and consent of data subjects. For example, there is a tendency to use huge amounts of personal data in the training phase of algorithms, sometimes without the knowledge or consent of the individuals whose data is being useddataprotection.ie. This is contrary to the principles of lawfulness, fairness and transparency imposed by the GDPR.

Lack of transparency and explainability - Complex algorithms (in particular black box machine learning models) make it difficult for operators to explain in an understandable way how they make decisions or process data. This opacity makes it difficult for data subjects to exercise their rights and is contrary to the information obligations under the GDPR (Art. 13- 14). The authorities emphasize that both at the development and implementation stage, operators must ensure transparency - including explaining the logic behind automated decisions - in order to comply with the GDPR and maintain public trust.

Data Inaccuracy and BIAS - The quality of input data directly influences the quality of AI results. Erroneous, incomplete or biased training data can lead to factual errors and systematic biases in algorithm decisions, affecting individuals or In the ChatGPT case, for example, the Italian authority found that the information provided may be inaccurate and not correspond to the actual data, violating the principle of accuracy (Art. 5(1)(d) GDPR). Algorithmic BIAS may also lead to unlawful discrimination, which is in conflict with both the GDPR (principle of fairness) and other non-discrimination rules.

Indefinite storage and unintended reuse of data - AI models can retain large volumes of data for long periods of time, sometimes beyond what is necessary, in violation of the GDPR's principle of limited storage. Furthermore, the personal data initially used to train a model could later be reused in new contexts without the data subjects' awareness or consent. For example, an AI model trained on personal data may be shared or sold to third parties who use it for other purposes, exposing the data to unanticipated processingdataprotection.ie. This contravenes both the purpose limitation principle and the obligation to obtain a new legal basis for secondary uses.

Impact on children and vulnerable groups - Without adequate safeguards, AI can expose minors to serious risks. One example is the Replika app, an AI chatbot used as a "virtual friend": in February 2023, Garante (the Italian authority) found that the lack of age verification allowed minors access to inappropriate interactions and data processing without parental consent. ChatGPT was also temporarily blocked in Italy because it did not have an effective mechanism to restrict access for those under 13. Protecting children in AI environments is essential, and failure to comply with GDPR requirements on parental consent and minimizing data about minors can result in severe

Automated decisions with significant legal or similar significant effect - More and more organizations are using AI for profiling and automated decision making (e.g., resume filtering, credit granting, risk assessments) that may significantly affect individuals. The GDPR (Art. 22) prohibits decisions based solely on automated processing that produce legal or significant effects on individuals, in the absence of safeguards (such as explicit consent or contractual necessity, plus the right to human intervention). The use of AI for such purposes raises questions of lawfulness (is there a valid basis or applicable exception?), as well as the obligation to provide for the possibility of human intervention and to conduct a Data Protection Impact Assessment (DPIA) prior to implementation. Failure to comply with these requirements may constitute a serious breach of the GDPR - for example, an EU supervisory authority fined a bank for automated lending decisions without prior assessment and without proper customer information (illustrative hypothetical case).

In essence, AI risks in the area of personal data stem from the volume and complexity of processing, which may be beyond the individual's traditional control over his or her data. These risks call for a firm application of the GDPR principles - lawfulness, transparency, fairness, minimization, accuracy, purpose limitation and storage - from the very beginning of the design of IA (privacy by design) systems. The authorities emphasize that the development of AI is compatible with data protection only if these principles are strictly respected: "the development of AI systems is compatible with the challenges of privacy protection... only then will citizens be able to put their trust in these technologies". For operators, this translates into an obligation to identify and mitigate risks through appropriate technical and organizational measures (including impact assessments and regular audits), while ensuring that data subjects' rights (access, erasure, objection, etc.) can be exercised even in complex algorithmic contexts.

Recent examples of AI enforcement

European Data Protection Authorities have demonstrated a firm and proactive approach in recent years in sanctioning GDPR abuses and breaches related to AI-based systems. Below

some relevant and exemplary cases are presented, illustrating the enforcement trend and serving as lessons for the technology industry:

Clearview AI - An emblematic case on facial recognition and massive biometric data collection without consent. Clearview AI, an American company, scraped more than 20 billion images from the internet (including social media) to build a facial identification tool, which was then sold to law enforcement authorities. This practice has been considered a blatant breach of GDPR in multiple EU jurisdictions: the Italian authority (Garante) fined Clearview €20 million and banned it from further processing of Italian individuals' data, and ordered the deletion of all illegally collected data. Similarly, the French authority (CNIL) in October 2022 imposed a maximum fine of €20 million€ and ordered the company to delete the data of French citizens from its database. For non-compliance with these orders, CNIL subsequently imposed additional penalties of 5.2 million€ (May 2023). Other authorities, such as the UK's ICO and the Greek authority, have also sanctioned Clearview, totaling tens of millions of fines across Europe. The Clearview case highlights that the processing of facial images (sensitive biometric data) without a valid legal basis and without informing data subjects is considered unlawful - and the fact that the controller was non-EU did not exempt it from liability, as the GDPR has extraterritorial effect (Art. 3(2)). The message from the authorities is clear: mass biometric mass surveillance technologies, if they violate privacy rights, will be severely sanctioned in order to protect citizens from a "surveillance society" incompatible with European values.

OpenAI - ChatGPT - The emergence of the ChatGPT generative language model (launched by OpenAI) tested the limits of GDPR application to generative AI and triggered the first coordinated actions at the European level. In March 2023, after a security breach incident that exposed some users' data, the Italian Data Protection Authority issued an urgent order temporarily suspending ChatGPT in Italy. Garante invoked several alleged breaches of the GDPR by OpenAI: failure to adequately inform users and the individuals whose data was collected (breach of Art. 13-14), the absence of a legal basis for the processing of personal data for the purpose of algorithm training (legitimate interest could not be invoked in this context), the inaccuracy of the processed data (the model providing often erroneous information about individuals) and the failure to implement an age verification mechanism (allowing access to potentially inappropriate content to minors under 13). This was the first case of a nationwide restriction of an AI service on data protection grounds, marking a bold approach by Garante, which gave the company 20 days to remedy the deficiencies.

OpenAI responded by quickly implementing a number of measures: it updated privacy policies and user notices, introduced a form through which individuals (including non-users) can request deletion of their data from the training set, and implemented an age (self-declaratory) filter to block access by minors as a result, on April 28, 2023, the Italian authority lifted the ban, allowing ChatGPT to resume in Italy, conditional on continued compliance with the agreed compliance plan. This plan included, among other things, carrying out a public information campaign in Italy about how ChatGPT works and how data is used to train algorithms - a novel measure designed to increase transparency to the public.

In parallel, other European authorities have launched similar actions: for example, the Spanish authority (AEPD) opened in April 2023 its own investigation into OpenAI for potential breaches of the GDPR, making Spain the second country to formally initiate an investigation in this regard. At the same time, the EDPS asked the European Data Protection Board (EDPB/ EDPS) to put the ChatGPT topic on the European agenda - an initiative that led to the creation of a task force at EDPB level to coordinate the authorities' actions on generative AI tools.

The Italian investigation into ChatGPT was finalized in December 2024, when Garante Garante announced important results: OpenAI was fined 15 million€ for violating GDPR. The Authority concluded that OpenAI had processed users' personal data (and that of other individuals, extracted from online sources) without an adequate legal basis for algorithm training and in breach of its transparency obligations to individuals. The failure to implement a robust age verification system, exposing minors to inappropriate content, was also noted. In addition to the fine, the Garante imposed an obligation on OpenAI to run a six-month campaign on Italian media channels to educate the public on how ChatGPT collects and uses data - a measure designed to improve transparency and public awareness. OpenAI has announced that it will contest the sanction as "disproportionate", while emphasizing that it has taken compliance measures and that its revenues in Italy were modest compared to the amount of the fine. The ChatGPT case confirms that AI models that heavily process personal data fall directly under the scope of the GDPR, and innovation does not exempt companies from fundamental legal obligations: transparency, consent (or other valid basis), protection of minors and data security.

Replika - Another relevant example is the authorities' intervention against AI chatbots designed to interact with users, which can process sensitive data and affect vulnerable groups. Replika is an AI app that provides users with a "virtual friend" with whom they can converse freely, including on intimate topics. In February 2023, the Garante (Italy) issued an emergency measure banning Replika from processing the personal data of users in Italy. The decision came following complaints about the negative impact on minors (who could access the app and receive age- inappropriate replies) and the finding that Replika was processing sensitive data (emotions, psychological states) without any legal basis or proper consent mechanisms. The Italian authority considered that such a service, although based on innovative AI, cannot operate in a vacuum of legal accountability: the operator is obliged to comply with the GDPR from the design phase, by ensuring the filtering of underage users, clearly informing adults about how their conversations are stored and used, and obtaining explicit consent if special categories of data are processed (e.g. mental health data inferable from chats). The Replika case highlights that "experimenting" with AI on real users, without safeguards, calls for prompt intervention by authorities to prevent potential emotional or privacy abuses, especially when minors are involved.

X (formerly Twitter) - Social networks are a rich breeding ground for personal data used to train AI algorithms, and the practices of collecting and using this data are closely scrutinized by authorities. A recent example concerns the X/Twitter platform and its plans to use users' public posts to train AI models (including its own model called Grok.) In July 2024, under new management, X changed its policy on

privacy so that EU users would have to explicitly opt-out if they did not want their public postings to be used by the company for AI training purposes. The Irish authority (DPC), being the lead authority for X in the EU, expressed concern that such a massive processing of European users' data could violate the GDPR (especially the principles of lawfulness and transparency). The DPC initiated an emergency action and referred the matter to the Irish Supreme Court, arguing that these changes could violate citizens' privacy rights. In August 2024, an unprecedented agreement was reached: X agreed to suspend all collection and use of EU user data for AI training. Essentially, the company promised to stop including EU citizens' tweets in the datasets for its Grok model unless it obtained their consent.

The CPD welcomed the outcome, stressing that EU users' rights have been protected. However, the case did not end there. The Irish authority raised the issue with the EDPB, calling for a unified EU-wide position on the legality of using public social media posts to train AI. The EDPB has been asked to determine whether or not X's actions constituted a breach of the GDPR (proceeding under Art. 64-65 GDPR). At the same time, the NOYB organization has filed separate complaints in several countries against xAI (sister company developing Grok), accusing violations of 16 articles of EU privacy law. X has labeled the DPC order as "unjustified and discriminates the platform against other scraping companies", citing the fact that many AI companies mine data from the internet. Regardless of these objections, the X/Twitter case demonstrates that European authorities are willing to take immediate legal action to prevent massive data processing without a legal basis, even forcing tech giants to comply. It also highlights the importance of cooperation between authorities at EU level to uniformly tackle such practices affecting users in multiple countries.

Meta (Facebook/Instagram) - Major social media and technology platforms have also been forced to adapt their business models as a result of GDPR enforcement, especially around algorithmic profiling for targeted advertising and international data transfers - issues closely related to the use of AI in personalization. A turning point was the January 2023 decision by the Irish Data Protection Commission (DPC) in conjunction with the EDPB, regarding the legality of personalized ads delivered by Meta on Facebook and Instagram. Following strategic complaints (made by activist Max Schrems' organization NOYB), Meta was found to have forced user consent for behavioural advertising, effectively hiding data processing under the guise of "necessity for the performance of the contract" (acceptance of the terms of use). The EDPB has determined in a binding decision that this practice is unlawful - the personalization of advertisements is not necessary for the provision of the contractual social network service, but is a separate processing that requires a different legal basis (basically, explicit consent). As a result, the DPC issued the final decision fining Meta 390 million€ (210 million for Facebook and 180 million for Instagram) and ordered the company to bring its processing in line with GDPR requirements within 3 months. This major penalty has forced Meta to phase out its "contract- based" model for personalized advertising in the EU - by the end of 2023 Meta announced opt-out options from targeted advertising and its intention to seek consent from European users for such data processing.

Also in the Meta case, another high-profile action concerned transatlantic data transfers (the issue of GDPR compliance of the transfer of Europeans' data to the U.S., following the invalidation of the Privacy Shield mechanism by the CJEU's Schrems II decision). After a lengthy process of investigation and coordination between authorities, in May 2023 the Irish DPC - bound by the EDPB through the dispute resolution procedure - fined Meta Platforms a record €1.2 billion, the largest GDPR fine ever. The sanction was justified by the seriousness of the breach: Meta continued to transfer personal data of EU Facebook users to the US in a systematic and repetitive manner without adequate safeguards, in breach of Article 46 of the GDPR. The company was also ordered to suspend any future transfers and to bring its operations into compliance with Chapter V of the GDPR (protection of data transferred outside the EEA) within 6 months. EDPB Chairwoman Andrea Jelinek emphasized the significance of this outcome: "The unprecedented fine is a strong signal that serious breaches have far-reaching consequences. The message to the industry is that even global corporations are not above European data law - on the contrary, the greater the volume of data and the impact on citizens, the stronger the authorities will react. The Meta case highlights that compliance with data protection requirements needs to be built into the way business algorithms operate, whether it's behavioral targeting or international transfers in global AI networks.

The above examples, along with many others (such as investigations into content recommendation algorithms or AI-based credit scoring systems), confirm a clear trend: EU data protection authorities do not hesitate to apply unprecedented maximum sanctions and remedies when AI-based technologies violate the GDPR. From fines in the hundreds of millions of euros to orders to suspend services, the palette of enforcement tools is being used to the full to ensure that individuals' rights are also protected in the algorithmic digital age. These actions have a dual role - to sanction illegalities and to act as a deterrent (i.e. a 'by example effect')

- and send a strong call to developers and operators: innovation must be responsible, and compliance with the GDPR is a necessary minimum, not an optional obstacle.

Legal implications for data controllers and AI developers

The increasing enforcement of the GDPR in relation to AI technologies brings to the forefront a number of practical legal implications that data controllers and developers of algorithmic solutions need to consider. In this section, we look at the main legal obligations and compliance issues highlighted by the cases discussed and authorities' guidance.

Choice and documentation of the legal basis for processing. AI systems that process personal data (either in the training phase or in the use/service phase) must be based on a valid legal basis under Art. 6 GDPR. Recent cases show that inappropriate reliance on legitimate interest or performance of a contract will be challenged by authorities. For example, training an AI model on data collected from public sources cannot simply be based on the commercial interest of the developer if it disproportionately affects the rights of individuals (as established in the Clearview AI case, where the "legitimate interest" invoked by the company was rejected). Similarly, personalization of advertisements by

Profiling cannot be hidden under contractual pretext, but requires explicit consent. The practical implication is that operators need to conduct a careful analysis of the legal basis: in many cases, the informed consent of data subjects (Art. 6(1)(a)) will be the most appropriate, especially if the processing is invasive or not strictly necessary for the underlying service. Where legitimate interest is invoked (Art. 6(1)(f)), it is imperative to carry out a rigorous balancing test and implement safeguards (e.g. opt-out options, data minimization) to pass the authorities' scrutiny. At the same time, if special categories of data are involved (Art. 9, such as biometrics or AI inferred health data), a valid exception (explicit consent, substantial public interest provided by law, etc.) must also be identified, otherwise processing is prohibited.

Compliance with the principle of transparency and adequate information. Operators that develop or use AI systems must provide clear, accessible and complete information about the processing carried out, as required by Articles 13 and 14 GDPR. This includes: what data the algorithm collects and uses, for what purpose, what the legal basis is, how long the data is stored, to whom it is disclosed (including whether it is shared with other providers or transferred outside the EU) and the existence of any significant automated decision-making. Cases show that a lack of such transparency is severely penalized: OpenAI was fined mainly for failing to inform individuals that it was using their online data to train ChatGPT, and Meta was penalized because its terms of service did not clearly explain to users how their data is processed for advertising purposes. To comply, companies should draft and make available AI module- specific privacy policies, possibly explanatory FAQ sections or even interactive tools that show users, in an understandable way, the general logic of algorithmic processing (within the limits of trade secrets). Also, in case of use of data collected from third party sources (e.g. web scraping), the obligation to inform data subjects from indirect sources (Art. 14 GDPR) becomes applicable, which implies notifying them (if possible) or publishing general information and the possibility to opt-out. Failure to comply with these requirements can lead to data erasure orders and fines (CNIL, for example, ordered Clearview to delete citizens' data for failing to inform and honor their rights).

Ensuring data subjects' rights in the context of AI. Even though the technology is complex, data subjects do not lose their GDPR rights over their data processed by AI systems. These rights include, among others: the right of access to one's own data (including the data entered into the system and, to a certain extent, to the outputs relating to it), the right to rectification of inaccurate data, the right to erasure (especially if the data has been processed unlawfully), the right to object to processing based on legitimate interest and the right not to be subject to automated decision (under the conditions of Art. 22). AI operators must put in place procedures and technical means to facilitate the exercise of these rights. For example, in the case of a generative model, provide users and non-users with a channel through which they can request the removal of information about them from the training dataset or block the generation of content about them. Clearview AI severely violated the right to access and object - ignoring people's requests to check and remove their photos - which weighed in authorities' decisions to impose sanctions and So effective implementation of rights (including through automated processes where data volumes are large) is a key obligation. Moreover, in the context of automated decisions, human intervention on demand and the possibility of

the person to express his/her point of view or contest the decision (Art. 22(3)), even if the original decision was generated by the AI.

Conducting impact assessments (DPIA) and risk management. The GDPR requires a Data Protection Impact Assessment (DPIA) to be carried out when a type of processing is likely to result in a high risk to the rights and freedoms of individuals (Art. 35). Many AI applications fall into this category - e.g. use of new or innovative technologies, large-scale processing of sensitive data, systematic profiling - which explicitly appear on the list of situations requiring DPIAs. Developers and operators should therefore formally assess the risks to personal data and document mitigation measures before implementing an IA system. A robust DPIA will consider, among other things: the proportionality of processing (is AI necessary for the proposed purpose?), measures to reduce data volume (e.g. anonymization or synthesization of training data where possible), the potential impact on individuals in case of algorithm failure, the risk of discrimination or exclusion, and plans to remedy any potential harms. Supervisors may require prior consultation (Art. 36) if the DPIA indicates high residual Failure to conduct a DPIA when it was required constitutes a breach itself - for example, if a bank implements an AI credit scoring system without a DPIA, the authority can impose fines even independently of the existence of an incident. In addition, the privacy by design approach (Art. 25) requires AI developers to integrate data minimization and protection measures (e.g. pseudonymization of training data, inclusion of erasure mechanisms, auditability of algorithmic decisions) from the design phase. The compliance plans presented by the OpenAI Garantee - such as the introduction of erasure and information options - can be seen as a belated result of a DPIA that was initially lacking. Ideally, such measures should be proactively anticipated by operators, not reactively imposed by authorities after a breach.

Responsibility and delineation of roles in the AI chain. The AI ecosystem often involves several actors: the developer of the underlying model (provider), the entity that customizes it or offers it as a service to other operators (secondary provider or processor), and the end operator that integrates it into its business (user). Under the GDPR, it is essential to correctly establish the roles of each actor - data controller, processor or joint controllers - in order to allocate compliance responsibilities. For example, if a company uses an AI service from a third-party (cloud) provider that processes the company's customer data, then the company is the data controller and the AI provider is the processor, requiring an 28 contract that imposes data protection clauses. On the other hand, if the provider reuses the data of multiple customers to improve its own model, it could become a joint controller with those companies, sharing responsibility. CNIL's recent guidance emphasizes the importance of determining the applicable legal regime and the legal classification of actors (controller vs. processor) at the outset of IA projects. Lack of clarity in this regard can lead to liability gaps: for example, after the ChatGPT security incident in March 2023, it was initially unclear whether OpenAI (as provider) would notify end-users, and companies using the ChatGPT API also had to assess whether the incident also affected their breach notification obligations. Therefore, all parties involved in an IA system need to understand and document their role under the GDPR, enter into processing agreements where appropriate, and each ensure their respective share of compliance.

International data transfers and alien Many providers of advanced AIsolutions are based outside the European Economic Area (e.g. OpenAI in the U.S.) Under Chapter V of the GDPR, the transfer of personal data to third countries is restricted and requires an adequate level of protection. The Meta case - 1.2 billion€ fine underlines the consequences of non-compliance. For AI developers, the implication is that if they train models on personal data collected in the EU and stored on servers outside the EU, they must have legal mechanisms in place such as approved Standard Contractual Clauses (SCC), Corporate Business Rules (BCR) or ensure that the recipient is in a country with an adequacy decision. Without these, processing is illegal. Authorities are also vigilant about government access to data - for example, if a US AI provider can allow US authorities access to Europeans' data, this (under Schrems II case law) must be counterbalanced by additional safeguards or may lead to a ban on the use of that service in the EU. Any cross-border flow of data in the context of AI must therefore be carefully mapped and covered by contractual clauses and case-by-case assessments (so-called transfer assessments, TIAs). In addition, if a model possibly containing personal data (or from which stored personal data could be extracted) is intended to be published or open-sourced, this would amount to a transfer to any global recipient, raising serious compatibility issues with GDPR rules.

In the light of the above, it is clear that AI developers and operators in the EU (or targeting EU individuals) need to include GDPR compliance as an integral part of their development and business strategy. Moreover, data-related legal risk management should be a central concern - not only to avoid hefty fines, but also to ensure sustainability and social acceptance of AI products. As recent guidelines show, compliance with the GDPR is not a barrier to innovation, but a prerequisite for trusted AI aligned with European values. Operators who ignore these obligations expose themselves not only to sanctions, but also to the loss of trust of users and partners, which in the long run can be as damaging as a financial penalty. By contrast, those that implement privacy by design principles, that transparently document and justify how they use data and cooperate with the authorities, will be better positioned in an increasingly demanding legal and reputational environment.

Recent guidance from EU authorities on AI and data protection

To support both industry and citizens' rights, EU data protection authorities have stepped up efforts in the last two years to clarify the rules and best practices on the application of GDPR in the AI context. This recent guidance provides a compliance framework and outlines regulators' expectations. Below, we review the most notable initiatives and guidance:

CNIL action plan and guidelines (France) - CNIL, the reputed French data protection authority, has started a broad program focused on responsible AI as early as 2022. In May 2023, CNIL published an AI action plan and launched stakeholder consultations to identify the challenges of applying GDPR to AI. As a result, in

October 2023 and later in June 2024, the CNIL issued the first official recommendations on the development of AI systems in compliance with the GDPR. The CNIL guidance emphasizes that "the development of AI systems can be reconciled with privacy" and provides principles and practical sheets ("AI how-to sheets") for operators. Key recommendations include:

Respect the purpose limitation: AI systems should be developed for specific and legitimate purposes, clearly defined from the outset - a vague purpose such as "improving the algorithm" is not considered valid. Any extension of the original purpose requires re-evaluation and possibly new

Data minimization: it is recommended to use as little personal data as possible when training and operating AI. For example, the CNIL suggests anonymizing or synthesizing data whenever the purpose can be achieved in this way, reducing reliance on raw personal data.

Determining roles and responsibilities: the guide provides criteria for determining who is a data controller and who is a processor in the different configurations of AI development, avoiding the gray area of processing without accountability.

Choosing the right legal basis: the CNIL reiterates that in many situations of use of AI (especially those secondary to the main purpose), consent remains the preferable basis, and when legitimate interest is invoked, it must be well documented. Attention is also drawn to the processing of special categories of data in the context of AI (e.g. emotion recognition is considered as processing of sensitive data requiring special grounds).

Individual rights: CNIL devotes recommendations on how to facilitate data subjects' rights in IA projects. It states that these rights must be respected both at the level of training datasets (individuals have the right to know if and what of their data has been used) and at the level of models (individuals can request, for example, the deletion of their data from a trained model, if identification is possible).

Impact assessments: for AI projects, the CNIL recommends early DPIAs, tailored to the specifics of the technology, and the involvement of the DPO at all stages of

Security and risk prevention: cybersecurity measures are considered, as AI models can be the target of attacks (such as model inversion or membership inference that can extract personal data from the model). Protection against unauthorized access and logging access to training data are essential.

The CNIL's recommendations are accompanied by concrete examples and case studies and are intended to provide a practical benchmark for AI companies. These guidelines essentially confirm the interpretation that the GDPR already provides a sufficiently comprehensive framework to cover most of the challenges brought by AI - the key is to apply the existing principles to new technological contexts. The CNIL has announced that it will continue to issue further sets of "factsheets" on specific topics (e.g. anonymization in the context of AI, assessment and prevention of algorithmic BIAS, etc.), thus strengthening the compliance arsenal available to professionals.

Garante Initiatives (Italy) - Although best known for its enforcement actions, the Italian authority has also provided informal post-factum guidance following the ChatGPT and Replika cases. After the ChatGPT block on ChatGPT was lifted, Garante published details of the requirements imposed on OpenAI, which can serve as best practices: Implementing an online form through which anyone (including non-users) can object to the use of their data in training, including dedicated information in the service interface that conversational data can be used to refine the model, conducting a public education campaign on AI, and accelerating the development of a robust age verification systemGarante also initiated in 2023 a national working group on AI, bringing together experts to develop guidelines on AI risk assessment, which will align with the upcoming EU regulation. Italy emphasizes the importance of cooperation between the data protection authority and other sectoral authorities (e.g. Competition Authority, Communications Authority) when AI affects related areas, an approach that anticipates the cooperation mechanisms in the AI Act.

DPC Ireland Guidance on AI and LLM - As the authority responsible for the oversight of large technology companies, DPC Ireland published on July 18, 2024 an analysis and guidance on "AI, Large Language Models and Data Protection"ie. The document (in the form of an article on the DPC blog) describes in accessible language the risks involved in using LLM products, both for organizations and individuals, and provides practical recommendations. The CPD highlights risks such as:

Excessive use of personal data to train models without the knowledge or consent of the data subjectsdataprotection.ie.

Accuracy and data retention issues - models that may generate erroneous content about people or that may retain data entered by users longer than necessary.

The possibility of disseminating personal data to third parties by sharing the models (without individuals knowing or consenting to the new purposes)dataprotection.ie.

BIAS and discrimination resulting from incomplete or biased datasets, which may lead to incorrect decisions affecting individuals or groups.

For organizations that plan to use AI tools, the CPD recommends a diligent approach: conduct an internal audit of the data used by the tool (what data are we inputting? where where does this data end up? is stored by the provider? is used for retraining?)dataprotection.ie, review the terms of the provider (whether they act as a controller or processor, and whether they offer privacy guarantees), and implement control processes. For example, the CPD suggests that if employees enter customers' personal data into a service such as ChatGPT, the organization becomes the controller and must ensure GDPR compliance - possibly through policies prohibiting the entry of sensitive or identifiable data into such insecure cloud services. The Irish guidance also emphasizes the need to facilitate the rights of individuals: companies using AI must be prepared to respond if a person asks them "what data about me did you put into an AI model and what did you do with it?". In addition, the CPD mentions the importance of accountability - i.e. documenting decisions related to AI implementation, training staff on the ethical use of new tools, and updating the organization's data protection policies to reflect any AI processing.

Actions by other European authorities - Many European authorities and bodies have recently issued statements and recommendations on AI:

The European Data Protection Board (EDPB/CEPD) has shown increased interest: after the creation of the ChatGPT Taskforce in 2023, in February 2025 the EDPB decided to expand its into a general Taskforce on AI enforcement. The aim is to ensure cooperation between authorities in investigating AI systems and to prepare common guidelines. Moreover, in July 2024, the EDPB adopted a Statement on the role of Data Protection Authorities in the AI Act in July 2024, emphasizing the expertise they have in fundamental rights and recommending that Data Protection Authorities be designated as Supervisory Authorities (MSAs) for AI areas involving the processing of personal data. At the same time, the EDPB insisted on the need to establish clear procedures for cooperation between future IA supervisory authorities and data protection authorities, as well as close cooperation between the EU IA Office and the EDPB itself. These positions foreshadow how the GDPR regime and the future AI Act regime will interact (as detailed in the next section).

The Spanish authority (AEPD) has published since 2020 a detailed guidance on adapting systems incorporating AI to the GDPR (aimed at engineers and IT managers). The AEPD has also developed free tools, such as an impact assessment generator for AI systems and a methodology for identifying BIAS, showing a very practical approach.

The Dutch Authority (AP) published in 2023 a report on the impact of algorithmic assessments and recommended the inclusion of independent experts in the evaluation of government AI systems as part of transparent decision-making.

ICO (UK) - even though the UK is no longer part of the EU, the ICO's experience is worth mentioning: the ICO issued in 2020 an extensive AI and Data Protection Guidance, which remains a technical landmark, addressing topics such as fairness, explanations for algorithmic decisions and machine learning security. Many EU authorities have leveraged these concepts in their own guides.

The Council of Europe (a separate organization from the EU) is working on a Treaty on Artificial Intelligence, which will include strong references to data protection compliance and the role of specialized authorities. European views and standards thus align: data protection is recognized as a central element of the AI governance ecosystem.

Through these multiple guidelines - from the national to the EDPB level - a set of best practices and normative expectations is taking shape. The common message is that GDPR already provides the basic principles, and AI actors need to operationalize these principles in the design and use of systems. At the same time, the ground is being prepared for the future AI- specific legal framework (AI Act), with data protection authorities taking an active role in defining interpretations and synergies. For professionals in the field, familiarization with these guidelines is essential: they not only spell out the legal obligations, but also offer practical solutions (e.g. how to ensure algorithmic transparency, how to grant rights in a black box model, which internal procedures to implement when adopting an AI service). A rigorous bibliography, presented at the end of the article, brings together

the main documents - regulations, opinions, reports, decisions - which underpin these guidelines and can serve as a reference for further study.

GDPR - AI Act relationship: complementary regulations in a common ecosystem

As the European Union prepares to adopt the Artificial Intelligence Regulation (AI Act) - the first legal framework dedicated to AI at a global level - it becomes crucial to understand how it will interact with the GDPR and what practical implications will arise from the coexistence of the two regulatory regimes. In essence, the GDPR and the AI Act are complementary: they approach AI from different angles, but converge in the common goal of ensuring that the development and use of algorithms respect the fundamental rights of individuals.

Scope and objectives: the GDPR (in force since 2018) is a horizontal regulation, covering any processing of personal data, regardless of technology or sector, with the aim of protecting privacy and data protection. The AI Act, currently in the final stages of adoption (a political agreement on the text was reached in December 2023), is a sector-specific regulation, focused on AI systems, regardless of whether they process personal data or not, with the main objective to ensure that AI is safe, transparent, ethical and in line with EU values. The AI Act classifies AI systems by risk levels (unacceptable, high, limited, minimal) and imposes differentiated requirements: from bans on certain practices (e.g. social scoring by public authorities, real-time biometric surveillance in the public space - except in strict cases) to strict compliance requirements for high-risk systems (such as those used in recruitment, credit, education, health, critical infrastructure, law enforcement, etc.), transparency requirements for limited-risk AI (e.g. obligation to signal users when they interact with a chatbot or when content is generated by AI) and finally voluntary codes of conduct for minimal-risk AI.

Overlaps and differences: In terms of overlap, any AI system that processes personal data (which in practice will be the case for many systems, especially high-risk systems that make decisions about individuals) will be subject to both regulations simultaneously. For example, an AI-based recruitment algorithm is considered high-risk by the AI Act, so it must fulfill requirements such as evaluating training data to reduce BIAS, keeping technical documentation, being transparent to the user (employer), and notifying candidates that they have been evaluated by an automated system. In parallel, the same algorithm, processing candidates' CVs (personal data), falls under the GDPR: the company using it must have a legal basis (probably candidate consent or legitimate interest with safeguards), make DPIA, ensure the candidate's right to request human intervention in the decision (as per Art. 22 GDPR) etc. Compliance with the AI Act doe

Legal 500

FAQs

Marketing

Careers

Contact us

Bradu Neagu & Associates