Extract

There are two main reasons why the field of data protection is instructive in order to elucidate the legal challenges associated with AI. First, we note that data feeding, or data processed by AI systems, consists of personal data, often collected by algorithms. Article 4(1) of the 2016 EU data protection regulation, the GDPR, indicates an expansive definition of personal data, which includes names, ID numbers, location data, online identifiers, or “one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” And according to the ruling of the EU Court of Justice, in Breyer v. Deutschland, even IP addresses can be considered personal data “in certain circumstances.”1 The above list represents personal data processed by AI, and falls under the provisions of the GDPR.

The second reason why data protection is instructive for law and AI is the fact that EU law, mainly the GDPR, provides an (almost) allencompassing regulation, which represents a reference point for many legal systems around the world.2 For example, in 2019, the European Commission adopted its adequacy decision in relation to Japan, recognizing each other’s personal data protection system as equivalent, thus creating the world’s largest area of “safe data flows.” Whereas the relevant article of the GDPR for data protection is Article 45, together with Article 6 of the Japanese data protection laws (APPI) a common ground exists based on the global standards enshrined in the OECD Privacy Guidelines. Similar...