Privacy and digital, companies in the maze of EU rules

The risk of a short circuit is just around the corner. The same regulatory conflict also recurs between the Ai Act on artificial intelligence and, again, the Privacy Regulation. The former imposes a risk assessment for the use of data (also to train the system, as illustrated in the first example in the factsheet) that could give a positive result, indicating a 'low' risk, because the objective of training generative Ia is considered primary, but then a second assestment must be carried out on the treatment of the same data on the basis of the Gdpr, which, on the contrary, could indicate a high risk, because in this case the focus is on the protection of confidentiality, sensitive information and the minimisation of the data to be used.

The EU itself is aware of 'interferences and overlaps': the topic was also raised in the Report of the European Parliament's Research Office on Privacy Regulation and AI ('The impact of the General Data Protection Regulation (GDPR) on artificial intelligence'), which emphasised that a number of questions relating to data processing in artificial intelligence are not answered by the privacy regulation and that much more guidance is needed from the EU Commission, governments but also supervisory authorities to avoid 'costs related to legal uncertainty' for companies.

Complicating matters is also the fact that some countries, including Italy, have chosen to entrust the supervision of the various regulations to different authorities: to the Privacy Guarantor that for the GDPR, to the Digital Agency and the Cybersecurity Agency (Agid and Acn) that for the Ai Act. "They are two separate entities that might have different views and sensitivities on the same issues," observe Gaudino and Brozzetti. The result is that in this first phase of compliance with European regulations, companies are at a standstill, stuck in innovation or, at best, navigating by sight. This was also emphasised by Mario Draghi: in his Report on the Future of European Competitiveness, he counted no less than 100 regulatory acts of European source regulating the use of digital technologies and networks and 270 Supervisory Authorities in the Member States. A Babel that - according to Draghi - holds back the innovation capacity and competitiveness of companies.

Other intersections are on the horizon, in particular, between the GDPR and the Data Governance Act (DGA), which establishes a real 'data market' to foster economic growth and also introduces the concept of data altruism. The regulation still awaits some implementing provisions including the identification of intermediaries for the purchase and sale of data. For the lawyers, 'it will bring a completely new point of view: the Gdpr does not provide for data re-use, now instead the Dga encourages it. We will have to wait for the change of perspective'. Also on the part of companies that will have to move from being afraid to use the information collected to valuing it as a real strategic asset, even in their balance sheets.