ABSTRACT
Recent advances in Artificial Intelligence (AI) reveal a growing mismatch between the EU’s individual-centric data protection framework and automated systems’ capabilities to affect whole groups. AI routinely processes data about groups, while the GDPR still allocates rights and remedies to identifiable individuals. This design produces a structural collective redress gap where injunctions may be obtained without individual mandates (GDPR Art 80(2), RAD Art 8) but compensation remains tied to identifiability. Here, I show how the GDPR’s model (consent, data subjects’ rights, Art 80) fits in and why it fails against AI’s capacity to deanonymise and infer traits about persons whose data were never collected or volunteered. I then examine the AI Act 2024/1689. Although it repeatedly refers to ‘groups of persons’, trilogue negotiations removed the Parliament’s key collective tools, leaving only ex-ante risk and transparency duties. The example of online behavioural advertising or affinity profiling illustrates how AI-designed groups fall outside meaningful GDPR or AI Act remedies. I argue for a right to group protection and propose, for the 2028 review, four main revisions: 1) a definition of groups, 2) a mechanism for a group complaint and redress, 3) group-level impact assessment requirements and 4) a group data protection by design.
Nikiforov, Liubomir, Group Data Protection under the GDPR and AI Act: Closing the Collective Redress Gap in AI Inference (October 1, 2024).
Leave a Reply