DP News – Week 18. Members of the European Parliament reached a political agreement on the AI Act, Ireland’s supervisory authority has issued guidance for employers, the EDPB has launched a guide for small and medium businesses.

***

On 27 April, members of the European Parliament reached a political agreement on the AI Act, meaning that all controversies have been successfully sorted out.

As Euractiv reports, “the only significant last-minute change was on generative AI models [like ChatGPT], which would have to be designed and developed in accordance with EU law and fundamental rights, including freedom of expression”. As a matter of next steps, “the text might still be subject to minor adjustments at the technical level ahead of a key committee vote scheduled on 11 May, but it is expected to go to a plenary vote in mid-June.”

***

Ireland’s supervisory authority (DPC) has published guidance for employers “Data Protection in the Workplace”.

As official DPC’s press release explains, the guidance “is specifically aimed at assisting employers as data controllers regarding their data processing obligations and duties when processing the personal data of their employees, former employees and prospective employees. Employers collect and process significant amounts of personal data on prospective and current employees. In some instances, employers may also continue to process personal data of former employees. This personal data can range from basic information such as names, addresses and PPSNs, but can also include information on occupational health, sick leave, performance reviews or disciplinary actions. Therefore, employers, as data controllers must be mindful of their responsibilities, obligations and duties under the GDPR and the Data Protection Act 2018” .

Interestingly, the document also includes guidelines as regards workplace monitoring and tracking.

***

The EDPB has published a dedicated guide for small and medium enterprises (SMEs) to help them improve compliance with the data protection rules.

As the official press-release clarifies, “the Guide covers various aspects of the GDPR, from data protection basics, to data subject rights, data breaches, and more. It contains videos, infographics, interactive flowcharts, and other practical materials to help SMEs put data protection into practice. In addition, the Guide contains an overview of handy materials developed for SMEs by the national Data Protection Authorities”.