Convergence and Tension between the EU Artificial Intelligence Act and the GDPR

Sammanfattning

This thesis examines the relationship between the General Data Protection Regulation (GDPR) and the EU Artificial Intelligence Act (AIA) in regulating automated decision-making involving personal data. Emphasis is given to the legal intersection between Article 22 GDPR outlining automated-decision making regime and the AIA’s human oversight requirements for high-risk AI systems (Article 14), particularly in relation to their convergence, overlap and normative tension. From a legal-dogmatic and EU legal method, the thesis examines the scope of Article 22 GDPR, the requirements for meaningful human intervention, the classification and regulation of high-risk AI systems, and the role of human oversight under the Article 14 AIA. The results demonstrate that both instruments are concerned with safeguarding individuals against risks resulting from automated and AI-driven decision-making, albeit in different ways. Article 22 GDPR acts as a safeguard against individual automated decisions producing legal or similarly significant effects, whereas Article 14 AIA introduces system-level obligations for the design, deployment and use of high-risk AI systems. The thesis highlights a number of areas of convergence and overlap, especially with regard to the use of personal data by high-risk AI systems and the impact of AI outputs on decisions affecting individuals. The analysis reveals, however, that normative tension persists. Human oversight under Article 14 of the AIA should not be considered equivalent to human intervention under Article 22 GDPR, and compliance with the AIA should not be interpreted as a substitute for the individual safeguards provided by the GDPR. The thesis is drawn to the conclusion that the two regimes are complementary but not interchangeable, and that there is a need for further clarification in order to make their protection effective in automated decision-making situations.