Personal Data Protection in the Era of Artificial Intelligence: Legal Challenges and Solutions

Abstract

The rapid development of artificial intelligence (AI) has created a series of unprecedented challenges in the field of personal data protection. AI systems, in particular those based on machine learning and algorithmic analysis, involve massive data processing, often in an opaque manner and difficult for data subjects to control. The main legal risks include the lack of decision-making transparency (‘black box’), the difficulty of obtaining informed consent, automated profiling, and the possibility of processing sensitive data without a clear legal basis.

The General Data Protection Regulation (GDPR) provides a solid legal framework at European level, based on principles such as lawfulness, transparency, purpose limitation and the accountability of controllers. However, its application in the context of AI faces practical difficulties, in particular as regards the interpretation of the provisions on automated decisions (Art. 22), impact assessment (Art. 35) and protection by design (Art. 25).

To address these challenges, the European Union has proposed a new regulatory framework through the Artificial Intelligence Act, which introduces a classification of AI systems according to the risk they pose and imposes transparency, security and human oversight obligations for high-risk systems.