The impact of the General Data Protection Regulation (GDPR) on artificial intelligence
This study addresses the relationship between the EU General Data Protection Regulation (GDPR) and artificial intelligence, reviewing current AI technologies and their applications to personal data. It analyzes how AI fits into the GDPR conceptual framework, examining tensions with principles like purpose limitation and data minimisation, and explores automated decision-making and risk-based approaches. The study concludes that while AI can be deployed consistently with the GDPR, the regulation's prescriptions need to be expanded and concretised with guidance for controllers.
Summary and content fields are drawn from the document text and are pending editorial review.
Who issued it
Who it governs
Members and staff of the European Parliament, policymakers, data protection authorities, researchers, and data controllers seeking guidance on applying the GDPR to AI technologies.
What the document contains
The study addresses the relationship between the GDPR and artificial intelligence, reviewing basic concepts of AI and machine learning, their application to personal data, and associated risks and opportunities. It analyses how AI fits into the GDPR framework, focusing on traditional data protection principles, legal bases, transparency, data subjects' rights, automated decision-making, privacy by design, and statistical processing.
Binding regulatory amendments to the GDPR text, as the document offers policy options and academic analysis rather than enacting new legislation.
- The GDPR generally provides meaningful indications for data protection in the context of AI applications without requiring major changes.
- Tensions exist between traditional data protection principles like purpose limitation and data minimisation and the full deployment of machine learning and big data.
- The GDPR does not provide sufficient guidance for controllers regarding AI, and its prescriptions need to be expanded and concretised through a multilevel approach.
- Processing of personal data for statistical and scientific research purposes enjoys broader exceptions under the GDPR and offers key avenues for AI development in Europe.
- Automated decision-making and profiling face strict prohibitions under Article 22 GDPR alongside broad exceptions that require robust safeguard measures.
· Introduction · AI and personal data · AI in the GDPR · Policy options: How to reconcile AI-based innovation with individual rights and social values · References
How it scores
Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.
Accountability
3/5Clear responsibility for AI outcomes
It is true that the principles of risk-prevention and accountability potentially direct the processing of personal data toward a 'positive sum ' game
Executive summary
screening score · 2026-10-23
Fairness
3/5Non-discrimination and equitable treatment
However, algorithmic decisions may also be mistaken or discriminatory, reproducing human biases and introducing new ones.
Executive summary
screening score · 2026-10-23
Human Dignity
2/5Respect for the inherent worth of persons
These opportunities are accompanied by serious risks, including unemployment, inequality, discrimination, social exclusion, surveillance, and manipulation.
Executive summary
screening score · 2026-10-23
Privacy
5/5Protection of personal data and private life
This study addresses the relation ship between the General Data Protection Regulation (GDPR) and a rtificial intelligence (AI).
STUDY Panel for the Future of Science and Technology
screening score · 2026-10-23
Transparency
4/5Openness about how AI systems work and are used
The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand
3.2.1. Article 5(1)(a) GDPR: Fairness, transparency
screening score · 2026-10-23
Enforcement
3/5Consequences and compliance mechanisms with real force
The stiff penalties for non-compliance, when combined with the uncertainty on the requirements for compliance, may constitute a novel risk
Executive summary
screening score · 2026-10-23
Impact Assessment
4/5Required assessment of an AI system's risks/impacts before or during use
Article 35 requires that a data protection impact assessment is preventively carried out relatively to processing that is likely to result in a high risk
3.7.5. Article 35 and 36 GDPR
screening score · 2026-10-23