The advancement of technologies, particularly artificial intelligence (AI), inevitably affects our daily lives and raises important questions regarding privacy protection. This article explores the key aspects of the relations between artificial intelligence and personal data protection, with a particular focus on the European Regulation on Artificial Intelligence (AI Act) in relation to the General Data Protection Regulation (GDPR), as well as the legislation of Serbia.

The Court of Justice of the European Union (“CJEU”) has recently rendered a significant judgement regarding the interpretation of legitimate interest as a legal basis for personal data processing. Deciding on a case involving the fine imposed by the Dutch data protection authority (“AP”) on the Royal Dutch Tennis Association (“KNLTB”) for sharing its members’ personal data for commercial purposes, the CJEU confirmed that legitimate interest can cover purely commercial interests. This decision is important for both EU member states and Serbia, where there is still no clear practice or opinion from the competent authorities on the lawful application of data processing based on legitimate interest.

The General Secretariat of the Belgian data protection authority has published an informational booklet outlining the relationship between the EU General Data Protection Regulation and the Artificial Intelligence Regulation, which came into force on 1 August 2024. The authority’s aim with the informational booklet is to provide insights into the application of data protection requirements during the development and deployment of artificial intelligence systems. Data protection requirements and legal standards are key to ensure that artificial intelligence systems operate ethically, responsibly and lawfully.

AI is increasingly revolutionizing the way businesses handle recruitment, hiring, management and employee monitoring etc. AI solutions are already adept at personalizing employee experiences, such as benefits and training, streamlining HR processes throughout the employment lifecycle, boosting efficiency and significantly reducing administrative burdens. Additionally, AI provides critical workforce insights, facilitating data-driven decision-making and management. However, these advancements also bring potential risks related to discrimination, protection of privacy, and other fundamental rights that employers must carefully manage.

Alin Nichifor has joined Buju Stanciu & Associates as a Partner.

Drakopoulos has launched a new Data and Digital practice dedicated to “providing comprehensive legal solutions to clients navigating the increasingly complex landscape of data protection, digital transformation, AI, cybersecurity, and emerging technologies.”