Dear ISACA Chicago Members and Community,
The SheLeadsTech EXPERTISE program is designed to help women enhance their knowledge in areas covered by the ISACA Curriculum.
_______________________________________
⏰ Time: 11:00 AM – 12:00 PM CST
💻 Where: Virtual via Zoom
_______________________________________
AI is addressed by the EU through the AI Act, NIS2 Directive, Cyber Resilience Act, Digital Services Act, E-Privacy Directive, and the GDPR. However, the role of GDPR in governing AI remains unclear.
This presentation outlines the ten key challenges posed by EU data protection requirements for AI and their implications for AI use and development.
There is a clear appetite among EU regulators to establish AI-specific rules. This was highlighted in June 2023 when the G-7 data protection authorities jointly emphasized the need for regulatory collaboration.
The EU is addressing AI through multiple frameworks:
-
AI Act
-
Network and Information Security Directive (NIS2)
-
Cyber Resilience Act (cybersecurity standards for high-risk AI tools)
-
Digital Services Act (applicable to certain organizations in the safety space)
-
E-Privacy Directive
-
GDPR
Despite this, it remains difficult to determine exactly how AI products fit into existing privacy frameworks.
This presentation explores the ten key challenges of aligning AI with EU data protection laws:
-
Records of Processing Activities – Updates required for new sources of data.
-
Data Protection Impact Assessments (DPIAs) – Mandatory where high risks to data subjects exist; new agreements may also be required.
-
Right to Be Informed – Difficult to uphold if much information is unknown at the time of collection or when data is used for training.
-
Right to Object to Processing – May be too complex to effectively monitor or enforce.
-
Training Data – Ongoing concerns, e.g., Italian DPA questioning ChatGPT’s legal basis for training data processing.
-
Inferred Data – Users may struggle to exercise Subject Access Requests (SARs) for information they are unaware has been inferred.
-
Legal Basis for Processing – Several legal cases are already challenging the legitimacy of processing inferred data.
-
Automated Profiling & Decision-Making – Exercising the right to object may become overly complex.
-
Organizational & Technical Safeguards – Enhanced requirements expected to mitigate AI-related risks.
-
Controller vs. Processor Roles – Increasing complexity in defining responsibilities across AI value chains.
Dr. Valerie Lyons is an internationally recognized expert in AI governance, cybersecurity, and data protection. As COO of BH Consulting, she advises global organizations on compliance, risk, and digital trust. She is the author of The Privacy Leader Compass, acclaimed by Professor Daniel Solove as a major contribution to privacy literature, and her PhD research pioneered the concept of privacy as organizational practice.
Valerie serves on the Advisory Board of CeADAR, Ireland’s National Centre for AI, and is a member of both Cyber Ireland and the European Data Protection Board. A sought-after speaker, she was the first woman in Ireland to speak at RSA Conference and has since been selected to present their three times. Recognized among the Top 100 Women in Cybersecurity in Europe, she is widely respected for her thought leadership on embedding ethics, governance, and human dignity into digital infrastructures.
_______________________________________
Note: ISACA Members are requested to register with the same email ID as that in your ISACA profile for direct CPE uploads.
**Click on the buttons below to register and for more information about the SLT Program.
We look forward to your participation in the SLT virtual event!
_________________________________________