The Council of Europe delivered a key-note speech and actively participated at the 24th meeting of the Central and Eastern European Data Protection Authorities (CEEDPA) held on 25-26 September in Zadar, Croatia, hosted by the Croatian data protection supervisory authority ─ AZOP, under the auspices of the Croatian Parliament. The main topics of the meeting were data protection, AI and health data which were discussed notably by data protection authorities from across Europe, as well as representatives of the European Data Protection Supervisor (EDPS), the European Data Protection Board (EDPB).
On behalf of the Council of Europe, Ms Ana TOKHADZE highlighted in her keynote address the opportunities created by AI alongside with the emerging risks it may pose to the right to privacy and the protection of personal data, particularly in the healthcare sector. Emphasising that privacy and data protection is a democratic imperative, she underlined the importance of ensuring that technological development remains firmly anchored in human rights, democracy and the rule of law. She also highlighted the significance of the Council of Europe’s legal acquis on digital governance, encompassing, inter alia, the Amending Protocol to the Convention for the Protection of Individuals with regard to the Processing of Personal Data (Convention 108+) and the Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law.
While she also drew attention to the Council of Europe’s standard-setting work in the field by accentuating data protection guidelines for Large Language Models (LLM) and guidelines on neurosciences, as well as AI system risk and impact assessment framework in light of human rights, democracy and the rule of law – HUDERIA, Ms TOKHADZE stressed the importance of the prompt entry into force of both legal instruments. She also acknowledged the contribution of Ms Anamarija MLADINIĆ, a Vice-Chair of the Consultative Committee of Convention 108 and a Head of the Sector for EU, International Cooperation, and Legal Affairs at the Croatian data protection authority, who serves as a rapporteur for the committee concerning the guidelines on data protection in the context of Large Language Models (LLM).
As part of the workshop session on data protection and fundamental rights impact assessment, the Council of Europe’s contribution included a detailed presentation of the HUDERIA Methodology and the COBRA Model. After presenting the HUDERIA Methodology, which sets out a structured approach to assessing the risks and impacts of AI systems, emphasis was placed on the HUDERIA Model: Context-Based Risk Analysis (COBRA), which supports risk-governance efforts by scoping of information about an AI system’s application, development, design and deployment contexts. The presentation demonstrated how HUDERIA combines analysis of the context in which an AI system is developed and deployed with stakeholder engagement, detailed risk and impact assessment, and the identification of appropriate mitigation measures. The intervention also underscored the importance of iteratively reviewing and reassessing identified risks and drawn up mitigation mechanisms, as an integral part of the HUDERIA.
The two-day event concluded with the adoption of the Zadar declaration calling for strengthening regional cooperation on data protection, AI and health data and reaffirming the participating competent authorities’ commitment to closer cooperation to address implications resulted from exponential development of AI and emerging technologies.
