Big tech aligning with EU compliance rules

The IDPC, which oversees major firms like Google, Meta, Microsoft, TikTok, and OpenAI, noted that while its authority has not yet been applied to AI, they might need to mandate business model adjustments to safeguard data privacy in the future.

In an interview this week, the DPC’s senior officials highlighted how AI introduces new complexity and several potential challenges for data privacy, underscoring the need for ongoing regulatory vigilance.

Regulators must determine if companies can scrape public data from the internet to train AI models and establish the legal framework for using personal data. AI developers also need to demonstrate how they will protect individuals’ data rights, such as the right to delete data. Additionally, the issue of AI models potentially providing inaccurate personal information about individuals needs to be resolved, an IDPC spokesperson stated.

Dale Sunderland, one of Ireland’s two Data Protection Commissioners described “extensive engagement” taking place between high profile US internet companies including Google and Meta.

“They’re seeking our views on some of their new products in the AI space, particularly the large language model space,” Mr Sunderland said. Google has already pushed back its release of the Gemini AI chatbot to make room for a consultation with the Irish DPC, and any necessary alterations to the platform.

Ireland acts as the primary regulator for many leading US internet companies as it is home to many of data firms’ EU headquarters. However, other regulators can influence decisions through the European Data Protection Board, which is developing guidelines for AI compliance with EU data protection laws.

Starting next month, AI model operators must adhere to the EU’s new AI Act. Additionally, they must comply with the General Data Protection Regulation (GDPR), which allows for penalties of up to 4% of a company’s worldwide revenue for violations.

Know the risks

This element of dual compliance underscores the stringent regulatory environment that AI operators must navigate within the EU. In such a climate, it is imperative that organisations conduct due diligence around the potential consequences of new products and services.