AI applications in the energy sector: Possible interaction with data protection concerns
Data protection concerns are closely related and should be taken under consideration when dealing with AI systems related to the energy sector where data protection processing takes place, especially through the point of view of GDPR.
More specifically, it is highly likely that smart meter data, consumption data, payment and billing data when related to consumers and are information relating to identified or identifiable natural persons, are categories of personal data that may be collected and processed in energy related AI applications. In such cases, compliance with GDPR and other applicable data protection legislation should be appropriately applied by relevant stakeholders.
As specifically mentioned in recital 10 of the AI Act, AI Act seeks to affect neither the application of existing Union law governing the processing of personal data, nor the obligations of providers and deployers of AI systems in their role as data controllers or processors stemming from Union or national data protection Union where the design, the development or the use of AI systems involves the processing of personal data.
In addition to the above, data subjects continue to enjoy all the rights and guarantees awarded to them by such Union law, including the rights related to solely automated individual decision-making, among which profiling.
As analyzed in literature, some of the important obligations that AI application stakeholders should comply with (depending on their role with regards to personal data processing) refer to the use of the appropriate legal basis (meaning the appropriate choice of the basis available in GDPR or other applicable data protection legislation for the processing to take place) as well as the application of data protection principles such as purpose limitation according to which data should not further processed in a manner that is incompatible with the purpose for which it was initially collected and data minimization, where data processed should be limited to the necessary for the purpose of processing.
It goes without saying, that where personal data processing actually takes place through AI applications, other provisions of GDPR related to automated decision making, data breach notification and Data Protection Impact Assessment and their corresponding obligations can be activated.
As the continuously evolving landscape of the intersection between GDPR and AI application is still under development, so does the analysis, opinion and guidance provided by the competent bodies across the European Union.
An indicative example of such initiatives is the EDPB Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models.
In this opinion, extremely useful insights are shared with regards to conditions under which an AI model can be considered anonymous where through the use of all means reasonably likely to be used by the controller or another person, the likelihood of direct extraction of personal data of those individuals whose data were used for the training of the model as well as the probability of acquiring personal data from the queries, should in both cases be insignificant.
Additionally, EU members national data protection authorities have already started providing recommendations regarding AI, an indicative example of which is the French CNIL’s recommendation for the compliance with GDPR related to AI system development.
As a conclusion, it should be underlined, that data protection should be addressed as a crucial issue with regards to AI applications, in those cases where processing of personal data actually takes place for example where training sets include large volumes of personal data.
In such cases, special consideration should be given so that systems being developed should respect individuals’ right to privacy, in an effort to reconcile both the need for innovation achieved through the development of AI solutions as well as the protection of individual’s rights and freedoms.
The above is provided for informational purposes and do not consist legal advice.