The Hungarian Parliament has significantly restricted the fundamental right to freedom of assembly in Hungary. In connection with the disproportionate and unnecessary restriction of fundamental rights, a number of important aspects can be highlighted, and great attention has also been paid to the…
Development and deployment of AI models in a GDPR-compliant way
The EDPB published its long-awaited opinion
The European Data Protection Board (EDPB), based on the request of the Irish Supervisory Authority, issued its opinion under Art. 64(2) GDPR on certain data protection aspects related to the processing of personal data in the context of AI models (the "Opinion").
Below, I briefly summarise the…
Deep Dive into the AI Act - Part 7: general-purpose AI models
The rules of the AI Act, which came into effect as of August 1, 2024, will become applicable in several stages. Initially, from February 2, 2025, the provisions related to prohibited AI practices must be applied, and from August 2, 2025, the rules related to general purpose AI models will become…
Product liability: cybersecurity vulnerability as defectiveness of a product
The adoption of the new Product Liability Directive (PLD, Directive 2024/2853) renews product liability rules after several decades and will make them better adapted to the digital age (e.g. one important novelty of the new PLD is that it covers libility for the defectiveness of software and AI…
How does the new Product Liability Directive affect liability for AI-systems?
The new Product Liability Directive (PLD, Directive 2024/2853) has recently been published in the Official Journal of the European Union, renewing the previous product liability regime established by the old product liability directive adopted in 1985. Member States shall bring into force the laws,…
Responsible authorities for the enforcement of the AI Act on national level
The AI Act entered into force on 1 August 2024 and its provisions on AI governance (Chapter VII) will apply from 2 August 2025. The AI governance on the EU level includes the AI Office, the European Artificial Intelligence Board, an advisory forum and a scientific panel of independent experts should…
What can be considered 'scientific research' in the application of GDPR?
In connection with scientific research involving the processing of personal data, the primary question is what can be considered scientific research during the application of the GDPR, and in which cases the specific rules of GDPR can be applied. Although the GDPR refers to "scientific and…
There is nothing new under the sun: shadow AI
The concept of shadow IT is by no means new, it is a decades-old phenomenon that gained momentum with the advent of cloud services and the spread of increasingly advanced computing devices among a wide range of users (especially with the advent of smartphones, laptops, tablets - cf. the so-called…
Do large language models store personal data?
The rise of large language models (LLMs) poses challenges to the applicability of data protection rules. There is a lot of debate about the question of whether or not LLMs themselves store personal data. Recently, the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburg DPA)…
Deep Dive into the AI Act - Part 6: AI literacy
In connection with the AI Act, which will enter into force shortly, on 1 August 2024 (and will become applicable in several steps thereafter), we most often talk about prohibited AI practices, high-risk AI systems and related obligations of service providers and deployers, or even specific rules for…