EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
How EY can Help
-
Discover how EY's data protection and privacy team can help your organization protect its information over the full data lifecycle.
Read more
The interplay between the GDPR and the AI Act
In the European Union, personal data privacy has been safeguarded since 2018 under the General Data Protection Regulation (GDPR). This regulation ensures that personal data is processed transparently and lawfully, emphasizing the need to protect individuals. The AI Act (AIA), becoming fully effective in 2026, aims to establish clear requirements for AI systems to respect fundamental rights, including privacy. However, the interplay between the GDPR and the AIA raises significant challenges due to their differing objectives and scopes.
Key privacy challenges in AI systems
- Lawfulness and fairness: AI systems require a clearly defined and legitimate purpose early in development, which conflicts with general-purpose AI solutions. The choice of the appropriate legal basis for processing must align with GDPR principles.
- Transparency: AI systems tend to be black boxes, making it difficult to be transparent towards data subjects.
- Purpose limitation & data minimization: AI systems training requires the use of as much data as possible, which conflicts with the GDPR's purpose limitation and data minimization principles.
- Accuracy and storage limitation: AI systems may struggle with accuracy and necessitate data retention for retraining or transparency purposes.
- Integrity, confidentiality, and accountability: Ensuring accountability becomes harder due to tensions with GDPR principles, requiring companies to justify and document decisions, and adapt to evolving guidelines.
- Automated Decision Making: According to Article 22 GDPR, individuals have the right not to be subject to decisions made solely by automated systems if these decisions significantly affect them. Hence, human monitoring is vital in AI systems.
- Data subject rights vs. AI model integrity: The GDPR grants individuals’ rights such as access to their data, correction of inaccuracies, and data deletion, which can conflict with the operational needs of AI systems. However, deleting individual data entries may compromise the performance or integrity of these systems, creating additional compliance challenges.
- Inference: AI's ability to infer new information from existing data raises significant privacy concerns. Even if an individual's data is not explicitly included in a training dataset, AI systems can generate identifying insights, a practice that falls outside the GDPR’s current scope on personal data.
- Governance Disparities: The GDPR and AIA assign roles and responsibilities differently, which can create inconsistencies and obstruct conformity regarding risk assessment and accountability.