TFL Vsebine / Revija SIR*IUS

Data protection in the age of artificial intelligence - GDPR and copyright

Umetnointeligenčni sistemi za svoje učenje in delovanje potrebujejo velike količine podatkov, med katerimi so pogosto tudi osebni podatki in avtorsko zaščitene vsebine. To v povezavi z Aktom o umetni inteligenci odpira pomembna vprašanja glede skladnosti s Splošno uredbo o varstvu podatkov (GDPR) ter Direktivo o avtorski in sorodnih pravicah na enotnem digitalnem trgu. Kljub temu da sta bila oba akta sprejeta pred Aktom o umetni inteligenci, pa zgolj skladnost z Aktom o umetni inteligenci še ne pomeni, da so osebni podatki in avtorsko zaščitene vsebine ustrezno varovani in spoštovani. Razvijalci, upravljalci in drugi subjekti, vključeni v razvoj in implementacijo umetnointeligenčnih sistemov, morajo v vseh fazah življenjskega cikla umetne inteligence skrbeti za izvajanje določb tako Akta o umetni inteligenci kot GDPR-ja in Direktive o avtorskih pravicah. V času, ko vedno več organizacij vključuje umetnointeligenčne sisteme v svoje poslovne procese, je revizorjevo razumevanje prepletenosti in učinkov aktov osnovni pogoj za učinkovito in pravilno presojo skladnosti delovanja organizacij. Prispevek osvetljuje ključne pravne omejitve in zahteve evropske zakonodaje pri uporabi podatkov v umetnointeligenčnih sistemih ter predstavlja izzive in možne rešitve za revizorje in druge deležnike v digitalnem okolju.

Artificial intelligence systems require large amounts of data for their training and operation, often including personal data and copyright-protected content. In connection with the Artificial Intelligence Act, this raises important questions regarding compliance with the General Data Protection Regulation (GDPR) and the Directive on Copyright and Related Rights in the Digital Single Market. Although the last two mentioned acts were both adopted prior to the AI Act, the compliance with the AI Act alone does not ensure that personal data and copyright-protected content are adequately safeguarded and respected. Developers, operators and other entities involved in the development and implementation of artificial intelligence systems must ensure the implementation of the provisions of the AI Act, the GDPR and the Copyright Directive throughout all phases of the AI system lifecycle. In an era where an increasing number of organizations are integrating artificial intelligence systems into their business processes, the auditor’s understanding of the interconnection and effects of the regulations is a fundamental prerequisite for an effective and accurate assessment of organizational compliance. The article highlights key legal limitations and requirements imposed by European legislation on the use of data in AI systems and will present challenges and possible solutions for auditors and other stakeholders in the digital environment.