WEBVTT
00:00:00.160 --> 00:00:07.360
Hello everyone, I'm Giulio Coraggio, the location head of the Italian Intellectual Property and Technology Department at the Law Firm DLA Parter.
00:00:07.599 --> 00:00:09.279
And I'm Antonio Ravenna, a journalist.
00:00:09.439 --> 00:00:19.039
Today we're gonna talk about the new guidelines by the European Data Protection Board on Anonymization that have a massive impact on artificial intelligence.
00:00:19.199 --> 00:00:22.079
And we're gonna make it during the time of a coffee break.
00:00:26.640 --> 00:00:33.359
So, Julio, on July 7, 2026, the ADPB adopted the draft guidance on anonymization.
00:00:33.520 --> 00:00:36.320
It's the first real update since 2014.
00:00:36.479 --> 00:00:37.840
So, what's actually new?
00:00:38.079 --> 00:00:44.479
It was um an update that was highly expected because um technology has changed.
00:00:44.640 --> 00:01:00.159
It is true that what was personal data over 10 years ago is um still personal data, but wasn't personal data at that time, maybe is personal data now because of uh the technology that is uh more powerful.
00:01:00.399 --> 00:01:05.280
At the same time, the case law has uh substantially evolved.
00:01:05.519 --> 00:01:29.280
The milestone that is more relevant for these guidelines is uh not only the development of artificial intelligence, but the what was normally called as the Deloitte uh decision of the European Court of Justice that introduced a concept of um subjective assessment of what is personal data.
00:01:29.439 --> 00:01:32.480
And so, Julio, what is the subjective analysis of personal data?
00:01:32.719 --> 00:01:45.439
Well, so far the position of European data protection authorities was um you need to make sure that uh directly or indirectly, no one can link that information to an individual.
00:01:45.680 --> 00:01:57.519
When uh we were referring to no one, was really no one, no one in the world that was definitely too broad, there was a concept of uh reasonableness, but it was very blurred.
00:01:57.680 --> 00:02:08.400
For a company like Google, some could argue basically any information is personal data because of the massive amount of data that they uh have about us.
00:02:08.800 --> 00:02:33.439
Uh but after the Deloitte decision of the European Court of Justice, it was validated that you need to have a look at uh the position of the entity processing that data, not the rest of the world, and whether that entity has reasonably in its hands the information able to link the information received to the relevant individual.
00:02:33.680 --> 00:02:41.199
If that information cannot be linked, then we're not processing personal data anymore.
00:02:41.360 --> 00:02:46.319
Obviously, that needs to be reassessed with the evolution of the technology.
00:02:46.560 --> 00:02:51.280
It's um a burden of proof that is on the entity processing data.
00:02:51.520 --> 00:03:06.800
But this is really important because um until now, basically you had to look at the perspective of whoever could have in its hands that information, which definitely was too broad to be assessed.
00:03:07.039 --> 00:03:12.159
And the ADPB relies on three criteria singling out, linkability, and inference.
00:03:12.240 --> 00:03:18.159
Uh, which of these is the hardest for AI systems to satisfy and why does AI change the equation here?
00:03:18.400 --> 00:03:30.159
Well, the inference is the most tricky element because um directly or indirectly, I don't have to be able to link that information to the relevant um individual.
00:03:30.319 --> 00:03:38.960
We know that uh artificial intelligence is so powerful because it can process a massive amount of personal data.
00:03:39.199 --> 00:03:54.319
But then uh if uh, for example, we refer to the identification code of a client of a bank, that information is in the ends of the bank, but for the rest of the world, it's not the information of an individual.
00:03:54.560 --> 00:03:57.840
Or uh uh same thing for the IBAN number.
00:03:58.080 --> 00:04:10.400
That information is for my bank, linked to my bank account, but probably the rest of the world doesn't know much uh about that number is not able to link that to an individual.
00:04:10.560 --> 00:04:16.399
But this has massive um implications, for instance, when it comes to medical trials.
00:04:16.560 --> 00:04:33.920
In that case, patients are identified through an identification code that uh is unique, that's true, but the uh table able to link that patient to the relevant um code is just in the hands of the hospital.
00:04:34.079 --> 00:04:46.720
Then you need to understand whether through the other information in the hands of the third party the inference is still possible, it's uh still possible to link that information to the relevant individual.
00:04:46.879 --> 00:05:05.519
But you know, uh while in the past uh the test was quite uh simple, straightforward, if add a code that directly and indirectly potentially could have been linked to an individual, then that information was a personal data, now it's uh a completely different perspective.
00:05:05.759 --> 00:05:10.079
The ADPB also says that anonymization isn't a one-time check.
00:05:10.240 --> 00:05:15.199
It has to be reassessed periodically as ray-identification techniques improve.
00:05:15.279 --> 00:05:21.439
Um, what should companies building or deploying AI systems actually change starting now?
00:05:21.759 --> 00:05:24.000
Antonio, this is the trickiest element.
00:05:24.079 --> 00:05:28.319
It is true that uh technology evolves, especially in the last years.
00:05:28.399 --> 00:05:33.920
Uh, we have had a look how AI systems have been quickly evolving.
00:05:34.079 --> 00:05:40.480
We're doing now something that uh was uh totally uh unforeseeable two years ago.
00:05:40.720 --> 00:06:05.759
Having uh your database is information that now is not personal data and might become personal data makes uh the burden for companies processing that information very hard to manage because um then I should run a sort of audit on that uh information periodically, and uh, what is the time span that uh is relevant?
00:06:05.920 --> 00:06:14.720
It might be a year, but it really depends because in a year at the age of AI the perspective could be completely changed.
00:06:14.879 --> 00:06:20.240
So definitely companies need to put in place a procedure to reassess anonymization.
00:06:20.480 --> 00:06:28.879
How long the assessment has to be performed should be analyzed periodically based on the evolution of the technologies.
00:06:29.120 --> 00:06:33.199
The public consultation stays open until October 30, 2026.
00:06:33.519 --> 00:06:39.600
If an organization has time for just one concrete action before then, what should it be?
00:06:39.920 --> 00:06:53.839
What I do believe is more relevant is to have uh the concept of anonymization more precise, more straightforward, because I need to be certain that I'm not processing personal data.
00:06:54.000 --> 00:07:10.639
It is true that um rules around privacy are principle-based, so there will be uh no case where there is a situation of black or white, but companies in order to run the business need rules that are more precise.
00:07:10.800 --> 00:07:27.600
So there should be a sort of shift from a purely principle based methodology to something that uh companies can more easily implement in their operations so that once the test is completed, then they can move forward more easily.
00:07:27.839 --> 00:07:28.399
Thank you, Julia.
00:07:28.639 --> 00:07:29.199
Thank you very much.
00:07:29.439 --> 00:07:30.160
Thank you, Antonio.
00:07:30.399 --> 00:07:30.800
Arrived
00:00:00.160 --> 00:00:07.360
Hello everyone, I'm Giulio Coraggio, the location head of the Italian Intellectual Property and Technology Department at the Law Firm DLA Parter.
00:00:07.599 --> 00:00:09.279
And I'm Antonio Ravenna, a journalist.
00:00:09.439 --> 00:00:19.039
Today we're gonna talk about the new guidelines by the European Data Protection Board on Anonymization that have a massive impact on artificial intelligence.
00:00:19.199 --> 00:00:22.079
And we're gonna make it during the time of a coffee break.
00:00:26.640 --> 00:00:33.359
So, Julio, on July 7, 2026, the ADPB adopted the draft guidance on anonymization.
00:00:33.520 --> 00:00:36.320
It's the first real update since 2014.
00:00:36.479 --> 00:00:37.840
So, what's actually new?
00:00:38.079 --> 00:00:44.479
It was um an update that was highly expected because um technology has changed.
00:00:44.640 --> 00:01:00.159
It is true that what was personal data over 10 years ago is um still personal data, but wasn't personal data at that time, maybe is personal data now because of uh the technology that is uh more powerful.
00:01:00.399 --> 00:01:05.280
At the same time, the case law has uh substantially evolved.
00:01:05.519 --> 00:01:29.280
The milestone that is more relevant for these guidelines is uh not only the development of artificial intelligence, but the what was normally called as the Deloitte uh decision of the European Court of Justice that introduced a concept of um subjective assessment of what is personal data.
00:01:29.439 --> 00:01:32.480
And so, Julio, what is the subjective analysis of personal data?
00:01:32.719 --> 00:01:45.439
Well, so far the position of European data protection authorities was um you need to make sure that uh directly or indirectly, no one can link that information to an individual.
00:01:45.680 --> 00:01:57.519
When uh we were referring to no one, was really no one, no one in the world that was definitely too broad, there was a concept of uh reasonableness, but it was very blurred.
00:01:57.680 --> 00:02:08.400
For a company like Google, some could argue basically any information is personal data because of the massive amount of data that they uh have about us.
00:02:08.800 --> 00:02:33.439
Uh but after the Deloitte decision of the European Court of Justice, it was validated that you need to have a look at uh the position of the entity processing that data, not the rest of the world, and whether that entity has reasonably in its hands the information able to link the information received to the relevant individual.
00:02:33.680 --> 00:02:41.199
If that information cannot be linked, then we're not processing personal data anymore.
00:02:41.360 --> 00:02:46.319
Obviously, that needs to be reassessed with the evolution of the technology.
00:02:46.560 --> 00:02:51.280
It's um a burden of proof that is on the entity processing data.
00:02:51.520 --> 00:03:06.800
But this is really important because um until now, basically you had to look at the perspective of whoever could have in its hands that information, which definitely was too broad to be assessed.
00:03:07.039 --> 00:03:12.159
And the ADPB relies on three criteria singling out, linkability, and inference.
00:03:12.240 --> 00:03:18.159
Uh, which of these is the hardest for AI systems to satisfy and why does AI change the equation here?
00:03:18.400 --> 00:03:30.159
Well, the inference is the most tricky element because um directly or indirectly, I don't have to be able to link that information to the relevant um individual.
00:03:30.319 --> 00:03:38.960
We know that uh artificial intelligence is so powerful because it can process a massive amount of personal data.
00:03:39.199 --> 00:03:54.319
But then uh if uh, for example, we refer to the identification code of a client of a bank, that information is in the ends of the bank, but for the rest of the world, it's not the information of an individual.
00:03:54.560 --> 00:03:57.840
Or uh uh same thing for the IBAN number.
00:03:58.080 --> 00:04:10.400
That information is for my bank, linked to my bank account, but probably the rest of the world doesn't know much uh about that number is not able to link that to an individual.
00:04:10.560 --> 00:04:16.399
But this has massive um implications, for instance, when it comes to medical trials.
00:04:16.560 --> 00:04:33.920
In that case, patients are identified through an identification code that uh is unique, that's true, but the uh table able to link that patient to the relevant um code is just in the hands of the hospital.
00:04:34.079 --> 00:04:46.720
Then you need to understand whether through the other information in the hands of the third party the inference is still possible, it's uh still possible to link that information to the relevant individual.
00:04:46.879 --> 00:05:05.519
But you know, uh while in the past uh the test was quite uh simple, straightforward, if add a code that directly and indirectly potentially could have been linked to an individual, then that information was a personal data, now it's uh a completely different perspective.
00:05:05.759 --> 00:05:10.079
The ADPB also says that anonymization isn't a one-time check.
00:05:10.240 --> 00:05:15.199
It has to be reassessed periodically as ray-identification techniques improve.
00:05:15.279 --> 00:05:21.439
Um, what should companies building or deploying AI systems actually change starting now?
00:05:21.759 --> 00:05:24.000
Antonio, this is the trickiest element.
00:05:24.079 --> 00:05:28.319
It is true that uh technology evolves, especially in the last years.
00:05:28.399 --> 00:05:33.920
Uh, we have had a look how AI systems have been quickly evolving.
00:05:34.079 --> 00:05:40.480
We're doing now something that uh was uh totally uh unforeseeable two years ago.
00:05:40.720 --> 00:06:05.759
Having uh your database is information that now is not personal data and might become personal data makes uh the burden for companies processing that information very hard to manage because um then I should run a sort of audit on that uh information periodically, and uh, what is the time span that uh is relevant?
00:06:05.920 --> 00:06:14.720
It might be a year, but it really depends because in a year at the age of AI the perspective could be completely changed.
00:06:14.879 --> 00:06:20.240
So definitely companies need to put in place a procedure to reassess anonymization.
00:06:20.480 --> 00:06:28.879
How long the assessment has to be performed should be analyzed periodically based on the evolution of the technologies.
00:06:29.120 --> 00:06:33.199
The public consultation stays open until October 30, 2026.
00:06:33.519 --> 00:06:39.600
If an organization has time for just one concrete action before then, what should it be?
00:06:39.920 --> 00:06:53.839
What I do believe is more relevant is to have uh the concept of anonymization more precise, more straightforward, because I need to be certain that I'm not processing personal data.
00:06:54.000 --> 00:07:10.639
It is true that um rules around privacy are principle-based, so there will be uh no case where there is a situation of black or white, but companies in order to run the business need rules that are more precise.
00:07:10.800 --> 00:07:27.600
So there should be a sort of shift from a purely principle based methodology to something that uh companies can more easily implement in their operations so that once the test is completed, then they can move forward more easily.
00:07:27.839 --> 00:07:28.399
Thank you, Julia.
00:07:28.639 --> 00:07:29.199
Thank you very much.
00:07:29.439 --> 00:07:30.160
Thank you, Antonio.
00:07:30.399 --> 00:07:30.800
Arrived
