9:00 am –
9:30 am CET

9:30 am –
9:35 am CET

Co-Hosts

• Dr. Gabriela Zanfir-Fortuna, VP for Global Privacy, Future of Privacy Forum
• Prof. Gianclaudio Malgieri, Associate Professor & Co-Director, Leiden University & Brussels Privacy Hub

9:35 am –
10:00 am CET

10:00 am –
10:45 am CET

Panel I – Unpacking Notions of Risk: From the Data Protection Impact Assessment to Generative AI Systemic Risk, and Back Again

Notions of risk and their often-complex relationship to a variety of tools and assessments designed to address them form an integral part of the EU AI Act. There are at least three parallel references to risk in the EU AI Act: 

• The systemic risk assessment for Generative AI purposes (Article 51); 
• The Fundamental Rights Impact Assessment (FRIA) to be carried out by deployers governed by public law or by private entities providing public services (Article 27);
• The Conformity Assessment for high-risk AI systems (Article 6(1)(b) – Article 43); 

Annex 4 on the “Technical Documentation” to be provided in order to comply with Article 11(1) details the requirement for AI system providers to provide, inter alia, detailed documentation on the technical elements, development process, and risk management process of the relevant AI system. 

With ongoing legal uncertainty surrounding the practical application of these central requirements of the EU AI Act, this multi-disciplinary panel will unpack the different notions of risk and the tools designed to address and mitigate them. It will also discuss lessons learned from our experience with the GDPR’s Data Protection Impact Assessment (DPIA), and whether and how its ongoing relevance and applicability can be leveraged in the EU AI Act context.

Moderator

• Prof. Gianclaudio Malgieri, Associate Professor & Co-Director, Leiden University & Brussels Privacy Hub

Panelists

• Maryant Fernandez Perez, Head of Digital Policy at The European Consumer Organization (BEUC) 
•  Dr. Laura Caroli, Former Senior Policy Advisor at the European Parliament 
• Lorelien Hoet, Government Affairs Director, Microsoft

10:45 am –
11:15 am CET

11:15 am –
11:30 am CET

Lightning Talk

Highlighting impactful research and work in the field of data protection and privacy.

11:30 pm –
12:15 pm CET

Panel II  – The Sensitive Personal Data Spectrum: From Obligations to Prohibitions

By following the threat of sensitive personal data throughout the EU data strategy package, a series of prohibitions and obligations emerge that significantly highlight the areas of interplay between the AI Act, the DSA, and the GDPR. 

Notably, we find that Article 26(3) of the DSA prohibits presenting ads to users based on profiling, as defined by Article 4(4) of the GDPR, and on the basis of the processing of their sensitive personal data, as defined by Article 9 of the GDPR. Similarly, Article 28(2) of the DSA prohibits targeted advertising to minors on online platforms based on profiling. 

Finally, Article 10(5) of the AI Act contains an exception to processing special categories of personal data for the purposes of detecting and correcting bias, which applies to providers of high-risk AI systems. 

This expert panel will aim to address the importance of balancing prohibitions and obligations for sensitive personal data processing, the practical challenges that accompany this task, and how to approach it from the GDPR, DSA and AI Act perspectives.

Moderator

• Michael van den Poel, Research Engineer, EDHEC Business School

Panelists: 

• Emerald de Leeuw-Goggin, Global Head of Privacy and AI Governance, Logitech 
• Lex Zard, Technology and Human Rights Fellow, Harvard Carr Center for Human Rights
• Kim Smouter-Umans, Executive Director, European Network Against Racism (ENAR)

12:15 pm –
1:15 pm CET

1:15 pm –
2:00 pm CET

Breakout Workshops – Have your say: How do the different proposals of the Data Strategy package interact, overlap, or create tension with key provisions of the GDPR?

After hearing from leading experts on the topic of the Symposium, attendees will be invited to share their own thoughts, in more restricted focus groups on how to define and address the common threads, incongruities and points of juncture of the Data Strategy package. From the DSA to the DMA, DGA, AI Act and the GDPR, what are some of the implementation challenges related to the different elements of the Data Strategy package? How does the Data Strategy package interact with ongoing challenges related to emerging technologies, including, but not limited to, Generative AI? Does the Data Strategy package allow for further protection of fundamental rights in the digital space, including for vulnerable individuals?

Workshop Facilitators: 

• Bárbara Lazarotto & Pablo Trigo Kramczac, VUB & Brussels Privacy Hub 
  • Topic: Should we be able to give consent to ChatGPT?
•  Andreea Şerban, FPF & Vincenzo Tiani, PANETTA 
  • Topic: The Right to Explanation Across GDPR & AI Act
•  Ingrida Milkaité, University of Ghent  
  • Topic: Co-Developing a  Framework for ensuring children’s privacy across the EU Digital Strategy Package

2:00 pm –
2:15 pm CET

Reporting back from Workshops

Join us back in plenary as we share key learnings and take-aways from the Breakout Workshops.

Speakers:

• Workshop Facilitators

2:15 pm –
2:45 pm CET

Activity

Highlighting impactful research and work in the field of data protection and privacy.

2:45 pm –
3:15 pm CET

3:15 pm –
4:00 pm CET

Panel III – Regulatory Perspectives and AI Enforcement – A Case of Double Jeopardy?

The EU Data Strategy Package brings with it a complex enforcement landscape, where several authorities aim to cooperate effectively in order to avoid a case of “double jeopardy.” 

The recently-established AI Office, under the auspices of the European Commission, will play a key role in the implementation of the AI Act, especially with regards to general purpose AI. At the same time, over the past two years, Data Protection Authorities (DPAs) have taken action against deployers of AI systems on the basis of the GDPR, and have included the supervision of AI systems and algorithms in their current and future strategies. 

We are also seeing the appointment of existing, national regulatory bodies as supervision and enforcement authorities to oversee the implementation of different laws within the EU Data Strategy Package. 

As we look towards the immediate and long-term enforcement future, this expert panel will address some central questions: 

• Who are the AI enforcers? 
• How will national and European authorities collaborate with one another on AI enforcement? 
• What are DPAs’ perspectives on AI enforcement?

Moderator

• Bianca-Ioana Marcu, Deputy Director for Global Privacy, Future of Privacy Forum

Speakers

• Sven Stevenson, Director Coordination Supervision on Algorithms, Dutch AP
• Yordanka Ivanova, Legal and Policy Officer, AI Regulation and Compliance team, AI Office
• TBD

4:30 pm –
6:00 pm CET

Bites & Cocktail Reception

Join us for further conversation over drinks and snacks to close the day.