AI Governance and Data Protection: Insights from Michaël Van den Poel at the EDHEC Augmented Law Institute

Could you tell us about your role and the context in which you operate at the EDHEC Augmented Law Institute?

As a Research Engineer at the EDHEC Augmented Law Institute, I collaborate on the Interdisciplinary Project on Privacy (IPoP). This project is supported by a consortium that includes French universities, INRIA, and the CNIL.

Can you explain more about the Interdisciplinary Project on Privacy (IPoP) that you are working on?

IPoP gathers a broad team of researchers from different disciplines, with the goal of merging technical knowledge about privacy, such as anonymization and differential privacy, with legal, social, and ethical scholarship. Within the project, I am part of Work Package 7 on Legal, societal and ethical issues. Within the broaders goals of IPoP, focusing on the interdisciplinary challenges facing privacy and data protection, my research is focussed on the impact that AI has on the concept of sensitive data protection. By combining research from different disciplines, the project contributes to a broader understanding of data protection and privacy for legislators, regulators and companies processing personal data.

You recently attended the CPDP.ai Conference in Brussels which has been held for a 17^th time. How do you think the field has evolved since the conference started?

Whilst the conference was renamed this year, adding .ai, its existence is emblematic of the maturity of the data protection field. Together with the CPDP conference, the field of data protection has seen an incredible transformation from a niche subject to an established field of legal study. The amount and quality of doctrine, guidance, DPA decisions and Court of Justice jurisprudence has seen exponential increases, with data protection professionals now well-trained, established within their organizations and able to rely on extensive libraries of knowledge, both academic and practical in nature. The field is thus able to branch out, and face the new challenges coming with AI governance.

You mentioned that data protection professionals are often the first responders to AI-related issues. What are some specific challenges they face in this role?

The main challenge for those trained in data protection will be to stay up to date with the rapid pace of AI developments while ensuring compliance with existing data protection regulations. AI systems often involve complex data processing activities that can pose significant privacy risks. Data protection professionals need to understand these technical aspects to effectively address issues such as data minimization, fairness, and transparency. Additionally, there's the challenge of balancing innovation with regulatory compliance, ensuring that AI advancements do not compromise individuals' privacy rights.

How do you see the relationship between data protection and AI governance evolving in the future?

Now that the revolutionary stage of data protection is over, professionals might see opportunities in jumping ship to AI governance. Such a jump would, as noted in the concluding speech by the EDPS, be shortsighted. Being a fundamental right in an era characterized by technology, data protection is here to stay, as ‘Data protection and privacy will not merge, nor will disperse into Artificial Intelligence’. Instead, I believe that data protection should be wielded as a tool for ensuring AI complies with our human values. This requires applying data protection principles in full to all AI systems processing personal data, and broadening our understanding on how AI challenges principles such as fairness and data minimization.

Given the fast-paced nature of technological advancements in AI, how can data protection professionals keep up?

Continuous learning and upskilling by legal professionals will have to be combined with increased interdisciplinary collaboration. Legal professionals need to engage with technologists and other experts to gain a deeper understanding of the technologies they are regulating. Specific certified training programs like those offered by the EDHEC Augmented Law Institute within the Augmented Lawyer Academy are designed to help legal professionals upskill in both technical and governance issues. By staying informed and adaptable, legal professionals can better navigate the complexities of the digital age.

Finally, what advice would you give to new professionals entering the field of data protection and AI governance?

My advice would be to embrace interdisciplinary learning in order to get a holistic view on data protection and AI governance. Professionals active in both fields can not afford to solely focus on technology or regulation, and neither on solely data protection or solely AI governance. Building a strong foundation in both legal and technical knowledge is crucial, as is keeping up to date with the latest evolutions in AI governance and data protection. Whilst challenging, in particular for those just entering the field, the velocity of current evolutions allows those eager to learn the opportunity to gain the edge and truly have an impact on the future of the intersection between technology and regulation.