artificial-intelligence-systems-and-the-gdpr---a-data-protection-perspective.pdf

Here are the key points summarized:

GDPR Requirements

• Process personal data fairly, lawfully, and transparently
• Obtain explicit consent or rely on a legitimate basis for processing
• Implement technical and organizational measures to ensure security and integrity of personal data
• Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities

AI Act Requirements

• Implement AI systems in a way that respects fundamental rights and freedoms
• Ensure transparency, fairness, and non-discrimination in decision-making processes
• Conduct Fundamental Rights Impact Assessments (FRIAs) for high-risk AI systems
• Maintain records of the legal basis for processing personal data
• Establish accountability mechanisms to demonstrate compliance with the AI Act

Examples

• Life insurance company implementing an AI system to calculate premiums: must obtain explicit consent or rely on a legitimate basis, conduct DPIA and FRIA, maintain records of the legal basis, and establish accountability mechanisms.
• High-risk AI systems listed in Annex III of the AI act: must conduct FRIAs and maintain records of the legal basis.

References

• General Data Protection Regulation (GDPR)
• Artificial Intelligence Act
• European Data Protection Board opinion on AI models and GDPR principles.