Data economy

Europe, the risk is to go backwards on data protection

The revision of the GDPR risks deregulation. Precisely at a time when Leo XIV calls for the humane governance of Ai

by Rocco Panetta

22 May 2025

Aggiungi Il Sole 24 Ore
ai preferiti su Google

4' min read

Key points

Pope Leo XIV and the challenges of the Ia
European position
Simplification of the Gdpr
The role of rules

4' min read

On the one hand, a new Pontiff who, even with the choice of his name, intends to send out a message on the Church's anything but neutral role with respect to the development of artificial intelligence; on the other hand, the European Commission, grappling with an ambitious (for some belatedly, for others improperly) project to simplify certain rules on the data economy. Two very different and only apparently distant events, but which if read in combination can tell us a lot about one of the most important issues of these years: the governance of data and new technologies. From here passes the economy, technological progress and sustainable development, social policies, rights, rules and new humanism.

Pope Leo XIV and the challenges of the Ia

No one doubted that the challenges posed by the advent of artificial intelligence would be addressed during the new pontificate of Pope Leo XIV. This was also in continuity with the important work already done by Pope Francis, who on several occasions called upon the international community to develop an ethics of innovation in order to make this technology an instrument of service and progress for all mankind and, in the meantime, had given impetus to several initiatives, including the issuing in January this year of rules on the dangerous and prohibited uses of AI.

Perhaps few, however, expected that the new pontiff would have launched such a strong message on the subject already with one of the very first acts of his pontificate. "I thought of taking the name Leo XIV. There are several reasons, but mainly because Pope Leo XIII, with the historic Encyclical Rerum novarum, addressed the social question in the context of the first great industrial revolution; and today the Church offers its heritage of social doctrine to all to respond to another industrial revolution and developments in artificial intelligence, which bring new challenges for the defence of human dignity, justice and work".

The Supreme Pontiff thus immediately wished to trace the path that should guide humanity and every State in their choices on the governance of AI, placing at the service of all the values of a doctrine that has already in the past faced revolutions such as that of intelligent machines, always placing at the centre an anthropocentric vision and the protection of the values and fundamental rights of the person.

The European position

Artificial intelligence must be positioned and guided within these fundamental tracks, for the benefit of all mankind. This position is resoundingly close to that adopted by the European Union years ago, which since the first edition of the legislation on the free movement and protection of data in 1995 has placed at the centre of automated processing of personal data precisely the integral protection of the dignity of individuals as a precondition for the enjoyment of the fundamental rights and freedoms recognised by the various European constitutional charters and the Lisbon Treaty. There is therefore an unexpected red thread linking the thinking of the founding fathers of so-called privacy, from Rodotà to Simitis and Buttarelli, to that of the newly elected Holy Father. The only instrument available to achieve this non-negotiable objective are Community and national regulations, the only ones capable of translating fundamental values and rights into market rules, design requirements, and governance and control tools, which also benefit businesses and public entities, exactly as the European Union has done with the new AI law (the Artificial Intelligence Act), offspring of the revolutionary General Data Protection Regulation (the GDPR).

The simplification of the Gdpr

Interestingly, however, a different wind is blowing in Europe at the moment. The European Commission, with its first omnibus packages, has in fact started a process of revising some regulations, such as those on sustainability reporting and corporate due diligence. Now, the next rules that could be changed to foster the competitiveness of small and medium-sized enterprises are those of the Gdpr.

The proposed revision would concern, in particular, one of the central obligations of the data protection legislation, namely the keeping of the register of processing activities, which constitutes the dynamic inventory of all personal data processing carried out by a company or public body. With this new omnibus intervention, the European Commission would like to broaden the range of subjects that could benefit from the exemption already provided by the GDPR for keeping the register. Fortunately, it did not occur to anyone to make a clean sweep of this important aid for keeping track of data processing, as unfortunately happened in Italy with its predecessor, the Documento Programmatico della Sicurezza (the DPS).

Recently, the two most important European data protection authorities - the European Data Protection Board (Edpb) and the European Data Protection Supervisor (Edps) - also wrote to the European Commission to present their views on the draft revision of the GDPR currently in the pipeline. There was of course no shortage of comments from academia and practitioners, with often divided and contrasting opinions.

The role of rules

While one must always welcome without prejudice any possible streamlining of rules, in order to avoid the bureaucratic whitewash and the creation of alibis offered by complex laws simply not to do, there is, however, a limit that must never be overstepped, namely, one must avoid embarking on the path of deregulation without balancing the protection of fundamental rights with the benefits to economic competitiveness and the market.

This is especially so in a season like the present, where rules - on the one hand - are the first and most important shield and implementer of fundamental rights in relation to technological development, the data economy and the advent of AI, and - on the other - constitute a competitive advantage that European companies cannot deprive themselves of, especially in the international geopolitical chessboard.