The proposed EU Artificial Intelligence Act was overwhelmingly adopted by the Internal Market and Consumer Protection (‘IMCO’) and the Civil Liberties, Justice and Home Affairs (‘LIBE’) Committees. This marks a significant step forward in its journey towards becoming law. Now, it will undergo final legal and linguistic checks before heading to the European Parliament plenary and formal Council approval, expected in April. Once approved, it will be published in the Official Journal, officially becoming part of EU law. 

***

Last week DPOrganizer reported the 2024 focus areas of the Dutch Data Protection Authority (AP), now those are also announced by the French watchdog (CNIL). 

In 2024, it will focus on minors’ data, files linked to the Olympic and Paralympic Games, electronic receipts and loyalty programs, as well as people’s right of access. Each year, CNIL conducts hundreds of checks (340 in 2023) following complaints, reports of data breaches or related to current events. CNIL also defines priority areas in order to guide its control policy on subjects of high stakes for the public and to assess the compliance in the chosen sectors. Checks falling within the scope of those priority areas represent on average 30% of all checks carried out.

Click here for more details. 

***

Continuing the topic of AI, the Italian supervisory authority – Garante – fined (€50,000) the municipality of Trento for making use of AI systems of surveillance for scientific research in violation of several GDPR provisions.

The municipality (controller) was carrying out processing of personal data relating to criminal conviction and offences under Article 10 of the GDPR. In fact, the algorithms were trained on data collected from the cameras already present in the territory of the municipality with the aim of detecting and documenting criminal activity and might thus include the processing of videos recording criminal activities. Garante also assessed the anonymization techniques in place. The municipality claimed that it adopted anonymization techniques right after collecting the data: the alteration of voice sounds in the voice recordings and the blurring of people’s faces in the videos. The DPA found these techniques to be inadequate as they did not guarantee a full anonymization of the personal data collected. Finally, Garante found that the data was processed contrary to the GDPR principles of lawfulness, fairness and transparency.

Click here for more details.