AI & GDPR – Responsabilitatea juridică a operatorului nu se deleagă tehnologiei
AI & GDPR – The legal responsibility of the data controller is not delegated to technology

Summary/Abstract: This article analyzes the emerging tension between the expansion of Artificial Intelligence (AI) technologies and the rigid regulatory framework established by Regulation (EU) 2016/679 (GDPR). The central thesis argues that the legal risk in using AI is not purely incidental, strictly related to security breaches, but structural, deriving from the inability of operators to ensure the transparency and explainability of algorithms. The analysis explores the practical difficulties in basing processing on legitimate interest (Art. 6) and the complexity of managing sensitive data (Art. 9) in heterogeneous training sets. It also examines the technical challenges that undermine the exercise of data subjects' rights – access, rectification, and erasure – when the architecture of AI models prevents the traceability of information. The mandatory and substantial nature of the Data Protection Impact Assessment (DPIA) as a control tool is emphasized, arguing that the principle of accountability obliges the controller to maintain real control over the automated decision making process.

• Details
• Contents