GDPR and the AI Act: two laws, one system

The GDPR (2018) protects personal data. The AI Act (2024) regulates how AI is used. They do not replace each other. They overlap. Complying with one does not exempt you from the other.

The critical intersection: when you use AI with personal data. This activates both regulations simultaneously:

• GDPR: legal basis, minimization, data subject rights, DPIA, transfers
• AI Act: risk classification, transparency, human oversight, documentation

A CV screening system with AI triggers: Art. 22 GDPR (automated decision-making), Annex III.4 AI Act (employment, high-risk), DPIA obligation (Art. 35 GDPR), and AI Literacy (Art. 4 AI Act). All at once.

Legal basis for processing data with AI

Every processing of personal data with AI requires a legal basis under Art. 6 GDPR. The 3 most relevant for enterprise AI:

1. Legitimate interest (Art. 6.1.f)

The most commonly used for internal AI. Requirements:

• Real and specific interest (not generic "improve service")
• Necessity: AI is necessary to achieve that interest
• Balancing: your interests do not override the data subject's rights
• Document the balancing test

Valid example: "We use AI to detect fraud in transactions. Legitimate interest: protecting our customers and the company. The AI analyzes transaction patterns (not sensitive data). The impact on the data subject is minimal (only suspicious transactions are blocked with human review)."

2. Performance of a contract (Art. 6.1.b)

When AI is necessary to deliver the contracted service. Example: a customer service chatbot that processes the user's query to resolve it.

3. Consent (Art. 6.1.a)

Rarely the best option for enterprise AI. Consent must be freely given, specific, informed, and unambiguous. And revocable. If the data subject revokes it, you must stop processing their data with AI. This can be operationally complex.

DPIAs for AI systems

The Data Protection Impact Assessment (DPIA, Art. 35 GDPR) is mandatory when the processing "is likely to result in a high risk to the rights and freedoms" of natural persons. AI triggers this obligation in multiple scenarios.

When it is mandatory with AI

• Systematic evaluation of personal aspects (profiling, scoring)
• Large-scale processing of special category data (Art. 9)
• Systematic monitoring of a publicly accessible area
• Use of new technologies (AI is considered "new technology")
• The system is on the national authority's list (each DPA has its own list)

DPIA structure for AI

DPIA: [Name of AI system]

1. DESCRIPTION OF PROCESSING
   - What AI system is used (name, provider, version)
   - What personal data it processes (categories, volume)
   - Purpose of the processing
   - Legal basis invoked
   - Data flow (where data comes from, where it goes, who accesses it)

2. ASSESSMENT OF NECESSITY AND PROPORTIONALITY
   - Is AI necessary or is there a less invasive alternative?
   - Is the data the minimum necessary?
   - Is there a defined retention period?

3. RISK ASSESSMENT
   - Risk of discrimination/algorithmic bias
   - Risk of re-identification (if data is pseudonymized)
   - Risk of errors (hallucinations, false positives)
   - Risk of unauthorized access
   - Risk of transfer to third countries

4. MITIGATION MEASURES
   - Human oversight implemented
   - Anonymization/pseudonymization applied
   - Encryption in transit and at rest
   - Access control (who can see data)
   - Bias testing conducted
   - Incident plan

5. DPO CONSULTATION
   - DPO opinion
   - Prior consultation with supervisory authority if residual risk is high

6. DECISION AND REVIEW
   - Approved/rejected/conditional
   - Next review date

Art. 22: automated decision-making

Art. 22 GDPR is especially relevant for AI. It establishes that the data subject has the right not to be subject to a decision based solely on automated processing which produces legal effects or similarly significantly affects them.

What this means in practice

• If AI makes the final decision without real human intervention, Art. 22 applies
• If a human reviews the AI's decision before execution, it probably does not apply (if the review is genuine, not rubber-stamping)
• "Significant effects": credit denial, non-selection in hiring, insurance denial, access to services

Exceptions (Art. 22.2)

1. Necessary for entering into or performance of a contract
2. Authorized by EU or member state law
3. Based on the data subject's explicit consent

Mandatory safeguards (Art. 22.3)

Even with an exception, you must guarantee:

• Right to obtain human intervention
• Right to express their point of view
• Right to contest the decision

International transfers with AI providers

Most AI providers (OpenAI, Anthropic, Google) have servers in the US. If you send personal data to these services, there is an international data transfer.

Transfer mechanisms

• Adequacy decision: the US has the EU-US Data Privacy Framework (DPF) since July 2023. If the provider is DPF-certified, the transfer is lawful. OpenAI and Google are certified.
• Standard contractual clauses (SCCs): if the provider is NOT in the DPF. Requires an additional Transfer Impact Assessment (TIA).
• No transfer: use local models (self-hosted on your servers). Maximum security, zero transfer.

Practical verification

1. Check if the provider is in the DPF: dataprivacyframework.gov/list
2. If not: request signed SCCs + conduct TIA
3. Document in the record of processing activities
4. Review periodically (the DPF could be invalidated like Safe Harbor and Privacy Shield before it)

Anonymization vs pseudonymization in AI

Anonymization

Data that does NOT allow identifying the person either directly or indirectly, even when combined with other data. If data is truly anonymized, the GDPR does not apply.

The problem: true anonymization is extremely difficult with AI. Models can re-identify persons from combinations of apparently anonymous data (location + schedules + purchase patterns = identifiable person).

Pseudonymization

Data that does not directly identify but could identify with additional information (the pseudonymization key). GDPR DOES apply to pseudonymized data, but considers it a valid mitigation measure.

Practical recommendation

• For sharing data with external AI: pseudonymize at minimum (replace names, IDs, emails with codes)
• Do not assume pseudonymization = anonymization. GDPR still applies
• For aggregate analyses: use aggregated data (not individual) when possible
• Document the anonymization/pseudonymization techniques used

Data minimization applied to AI

Art. 5.1.c GDPR: data must be "adequate, relevant and limited to what is necessary." With AI, the temptation is "give it all the data so it performs better analysis." Mistake.

Practical application

• Before uploading data to AI: ask "do I need ALL these fields?" If you only need to analyze sales trends, do not include customer names or emails
• Filter columns: remove PII fields before uploading CSV/Excel to AI
• Prompts without data: when possible, describe the problem without pasting the actual data. "I have 500 customers in 3 categories, the distribution is 40/35/25. What segmentation strategy do you recommend?"
• Synthetic data: for testing and development, use synthetic data that replicates the structure without containing real data

Data subject rights with AI

When you process personal data with AI, data subjects retain all their GDPR rights:

• Access (Art. 15): right to know what data of theirs your AI systems process and for what purpose
• Rectification (Art. 16): if the data is incorrect, it must be corrected. This includes data used as AI input
• Erasure (Art. 17): right to be forgotten. If you delete a customer's data, you must also delete it from any dataset used by AI
• Objection (Art. 21): the data subject can object to AI processing based on legitimate interest
• Not be subject to automated decision-making (Art. 22): see previous section
• Information (Art. 13-14): inform that you use AI to process data, what logic is applied, and what consequences it has

Ejercicio practico

Puntos clave