The EDPB and EDPS 'slam' AI Act reforms under the Digital Omnibus

Along with plans to "simplify" the GDPR, there's an AI Digital Omnibus that proposes amendments to the AI Act. In a new Joint Opinion, the EDPB and EDPS say they support the objective to simplify the law, but they don't seem to like any of the Commission's ideas.For example, they don't like the Commission's proposal to allow bias detection processing for all AI systems (Article 4a).Under the AI Act as it stands, providers of high-risk systems can process special category data if "strictly necessary" to detect and correct bias. This is a narrow exception; perhaps better characterised as a clarification on how the GDPR’s general prohibition under Article 9 works in this context.The Digital Omnibus proposal wants to broaden this to allow providers and deployers of all AI systems (not just high-risk) to process special category data for bias detection.The EDPB and EDPS are, predictably, skeptical. They point out that while bias is a problem, opening the floodgates to process sensitive data for every chatbot and image generator on the market might not be a great idea.—The Board and the Supervisor also strongly oppose removing the registration obligation for Article 6(3) exemptions.Article 6(3) of the AI Act provides a derogation that lets a provider say, "Yes, my system is listed in Annex III as high-risk, but I’ve done an assessment and it doesn't actually pose a significant risk, so I’m exempt from the high-risk rules."Originally, you had to register that assessment in the EU database. It was a way of letting the public and regulators know you were exempting yourself.The Digital Omnibus proposal wants to scrap that registration requirement to "reduce administrative burden."The EDPB and EDPS argue that if a provider exempts themselves, they must at least tell the regulator and the public. Removing this requirement would allegedly create a "black box" where providers grade their own homework with no oversight unless they are investigated later.—I outline a few other specific objections in this episode, but more broadly, there might be a bit of a turf war emerging here.The DPAs obviously want to defend their exclusive competence to enforce the GDPR, which is relevant insofar as it interacts with the AI Act. The Commission wants to extend the remit of the AI Office, and the EDPB and EDPS don't like it.Add to this the fact that Data Protection Authorities are also emerging as Market Surveillance Authorities—the key enforcers under the AI Act—and the dynamics could get even more complicated.Things getting more complicated is all part of the simplification process, I'm sure.