EDPB and EDPS support streamlining AI Act implementation but call for stronger safeguards to protect fundamental rights
The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have adopted a Joint Opinion on the European Commission’s Proposal for the ‘Digital Omnibus on AI’. The Proposal seeks to simplify the implementation of certain harmonised rules under the AI Act to ensure their effective application.
The EDPB and the EDPS support the objective of addressing practical challenges relating to the implementation of the AI Act. Administrative simplification must not, however, lower the protection of fundamental rights. The Joint Opinion acknowledges the complexity of the AI landscape and welcomes efforts to ease burdens for organisations However, certain proposed changes could undermine the protection of individuals in the context of AI.
“Innovation and efficiency are crucial and can coexist with maintaining accountability of AI providers. We welcome EU-level regulatory sandboxes and simplified procedures to promote innovation and support SMEs in Europe. However, Data Protection Authorities must maintain a central role when it comes to the processing of individuals’ personal data. Cooperation between Data Protection Authorities, the AI Office and Market Surveillance Authorities is essential to ensure legal certainty for organisations and foster innovation while upholding individuals’ fundamental rights.”
- EDPB Chair, Anu Talus
“Simplification is welcome when it clarifies obligations, empowers individuals, and strengthens trust. A careful balance needs to be kept by reducing administrative burden where possible, without undermining the protection of fundamental rights. Furthermore, we must ensure that the role of the AI Office is clearly defined and does not affect the independent supervision of European Union Institutions’ own use of AI systems.”
- European Data Protection Supervisor, Wojciech Wiewiórowski
The Proposal would extend the possibility to process special categories of personal data (such as ethnicity or health data) for bias detection and correction to providers and deployers of any AI systems and models, subject to appropriate safeguards. The EDPB and the EDPS recommend specifying that these data may be used for bias detection and correction only in circumscribed situations where the risk of adverse effects from such bias is considered sufficiently serious.
The EDPB and the EDPS advise against the proposed deletion of the obligation to register AI systems, when they fall under the categories listed as high-risk, even if the providers deem their systems to be ‘non-high risk’. The EDPB and the EDPS consider that this change would significantly undermine accountability and create an undesirable incentive for providers to unduly claim exemptions to avoid public scrutiny.
The EDPB and the EDPS welcome the creation of EU-level AI regulatory sandboxes to promote innovation. To ensure legal certainty, the Joint Opinion recommends the direct involvement of competent Data Protection Authorities (DPAs) in the supervision of data processing within sandboxes. In addition, the EDPB should be afforded an advisory role and the status of observer at the European Artificial Intelligence Board to ensure consistency in relation to EU-level sandboxes. Furthermore, the supervisory role of the AI Office with regard to AI systems based on a general-purpose AI model should be clearly delineated in the operative part and should not overlap with the independent supervision by the EDPS of AI systems developed or used by Union institutions, bodies, offices or agencies.
The EDPB and the EDPS support the goal of streamlining cooperation between fundamental rights authorities or bodies and market surveillance authorities (MSAs), and the reliance on a central point of contact to increase efficiency. However, they recommend clarifying the role of MSAs as administrative points of contact for the execution and transmission of requests to providers and deployers, and ensuring that the independence and powers of DPAs are unaffected.
The EDPB and the EDPS also recommend maintaining a duty for AI providers and deployers to ensure AI literacy among their staff. Any new obligation to foster AI literacy placed on the Commission or Member States should complement, not replace, the responsibilities of the organisations actually developing and using these systems.
Finally, the EDPB and the EDPS express concerns regarding the proposed postponement of core provisions for high-risk AI systems. Given the rapid evolution of the AI landscape, they invite the co-legislators to consider whether the original timeline can be maintained for certain obligations, such as transparency requirements, and to minimise delays to the extent possible.
Questions to the EDPB can be directed to: edpb@edpb.europa.eu
https://www.edpb.europa.eu/edpb_en
Questions to the EDPS can be directed to: press@edps.europa.eu