CEIAI Governance Database
Back to the database
Record STMT-WA4F8A6Advisory

EDPS Opinion on the European Commission’s White Paper on Artificial Intelligence – A European approach to excellence and trust

Opinion State lawEuropean Unionin force

This EDPS opinion evaluates the European Commission's White Paper on Artificial Intelligence, welcoming its commitment to EU values and fundamental rights while suggesting several improvements. The EDPS recommends that any future regulatory framework for AI should apply to EU institutions as well as Member States, protect societal interests alongside individual rights, adopt a more nuanced risk-based approach, and include clear impact assessments. Additionally, the EDPS supports a moratorium on remote biometric identification in public spaces until appropriate safeguards are established.

Summary and content fields are drawn from the document text and are pending editorial review.

Who issued it

European Data Protection SupervisorRegulator
Lead issuer
Legal forceAdvisory
Under whose authorityState law
Judged fromfull text

Who it governs

RegulatorsNational governmentPublic sector bodiesAI developers and providersResearchers and academics

European policymakers, regulators, and data protection authorities seeking guidance on aligning AI proposals with EU data protection laws and fundamental rights.

Sectors
Cross-sectorPublic administration · public administrations

What the document contains

What's covered

The document covers EDPS recommendations on the European Commission's AI White Paper, including definitions of AI, risk-based approaches, data protection impact assessments, enforcement mechanisms, remote biometric identification, and protections for vulnerable groups.

What's missing

The text does not provide binding legislation itself, nor does it establish final binding enforcement rules or specific technical standards for commercial AI deployment.

Key takeaways
  • Any new AI regulatory framework should apply to both EU Member States and EU institutions, bodies, offices and agencies.
  • The definition of AI needs to be clear and precise to properly frame the scope of future legislation.
  • The risk-based approach should be more robust and nuanced, protecting society and collectives as well as individuals.
  • The EDPS supports a moratorium on the deployment of automated remote biometric recognition in public spaces.
  • Data Protection Impact Assessments (DPIAs) should be a mandatory component for assessing high-risk AI applications.
Principles it states
lawfulness, fairness and transparencypurpose limitationdata minimizationaccuracystorage limitationintegrity and confidentialityaccountability
Outline
· 1. Introduction and Background
· 2. General Objectives and Vision
· 3. Necessity of an Amended Legal Framework
· 4. Assessment of the Future Regulatory Framework for AI
  - 4.1. Precautionary principle and risk-based approach
  - 4.2. Data Protection Impact Assessment
  - 4.3. Accountability and enforcement
  - 4.4. Regulatory requirements
  - 4.5. Controls and governance
· 5. Other Specific Issues
  - 5.1. Remote biometric identification
  - 5.2. Vulnerable groups
  - 5.3. Access to data
· 6. Conclusions
Issued29 June 2020
Length10,865 words · 23 pages
FormatNot recorded
Scoperegional

How it scores

Pending review

Each score is backed by a quote verified against the document text. Editorial review has not yet confirmed them.

Accountability

4/5

Clear responsibility for AI outcomes

The EDPS would like to recall the principle of accountability underpinning the GDPR, according to which it is the data controller who must demonstrate compliance with the GDPR.

4.3. Accountability and enforcement

screening score · 2026-10-23

Fairness

4/5

Non-discrimination and equitable treatment

In the context of vulnerable groups, fairness implies non-discrimination. Willing and unwilling discrimination is an inherent attribute of human decision -making

5.2. Vulnerable groups

screening score · 2026-10-23

Human Dignity

4/5

Respect for the inherent worth of persons

AI systems should be fair and respectful to the human dignity and to the rights and freedoms of the individuals.

5.2. Vulnerable groups

screening score · 2026-10-23

Human Oversight

4/5

Humans remain in control of consequential decisions

The EDPS welcomes the approach of the human oversight requirement, which is in line with the individual empowerment foreseen in the aforementioned ICDPPC Declaration on ethics and data protection in AI

4.4. Regulatory requirements

screening score · 2026-10-23

Privacy

4/5

Protection of personal data and private life

Hence, the aim of the recommendations in this Opi nion is to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data

Executive Summary

screening score · 2026-10-23

Transparency

4/5

Openness about how AI systems work and are used

Transparency is required by Article 5(1)(a) GDPR (lawfulness, fairness and transparency principle) [ Article 4(1)(a) EUDPR ] and Articles 12 to 14 GDPR (transparent information requirements)

3. NECESSITY OF AN AMENDED LEGAL FRAMEWORK

screening score · 2026-10-23

Enforcement

4/5

Consequences and compliance mechanisms with real force

Section 5.F of the White Paper proposes an objective prior conformity assessment mandatory for high -risk AI systems.

4.5. Controls and governance

screening score · 2026-10-23

Impact Assessment

4/5

Required assessment of an AI system's risks/impacts before or during use

The EDPS therefore suggests that a future legal framework should lay down the requirement of an impact assessment for any envisaged deployment of AI systems.

4.2. Data Protection Impact Assessment

screening score · 2026-10-23

Topics

artificial_intelligence data_protection fundamental_rights biometric_identification risk_management