🎄🎅 Christmas Edition
Welcome to our December edition! NENNA turned 1 in December and we are proud of where we stand today. 2024 was super exciting and 2025 will bring even more for us. Stay tuned.
As the year draws to a close, we would like to take this opportunity to thank you from the bottom of our hearts for your support and trust. ❤️
We wish you and your loved ones a peaceful Christmas filled with joy, warmth and beautiful moments. May the new year bring you health, happiness and success. 🎉🎁✨ See you on the other side!
Our Topics
EDPB: Personal Data in AI
Microsoft Copilot: Analysis
NENNA: "Feature of the Month"
AI Act: AI Literacy from 2 Feb 2025
What else is new
You can sign up for our newsletter here.
Or subscribe to us directly on LinkedIn.
AI Models Contain Personal Data
EDPB publishes opinion on data protection in AI models
The European Data Protection Board (EDPB) has published an opinion emphasizing that AI models trained on personal data are not automatically considered anonymous. Anonymity must be assessed on a case-by-case basis, taking into account the likelihood of direct or indirect traceability.
Details:
Anonymisation of AI models: The EDPB stresses that AI models trained on personal data are not automatically considered anonymous. Anonymity must be assessed on a case-by-case basis, taking into account the likelihood of direct or indirect traceability.
Legitimate interest as a legal basis: The opinion explains that controllers must assess whether the processing of personal data for the development and use of AI models can be based on legitimate interest. This requires a three-step test: identifying the legitimate interest, the necessity of the processing, and balancing it against the rights of the data subjects.
Consequences of unlawful data processing: The EDPB points out that unlawful processing of personal data during the development phase of an AI model can affect the lawfulness of the subsequent use of the model. Therefore, it is crucial to take data protection-compliant measures in the early stages.
Why this is important:
The EDPB's opinion provides clear guidance for companies and organizations that develop or deploy AI technologies. It highlights the importance of data protection at all stages of the AI lifecycle and helps to minimize legal risks as well as strengthen user trust in AI systems.
Data Protection Impact Assessment for Microsoft 365 Copilot
The Data Protection Impact Assessment by SURF identifies risks when using Microsoft 365 Copilot, including a lack of transparency, international data transfers, and limited control options for institutions. The report proposes technical measures to ensure data protection compliance.
Details:
Data processing: Microsoft 365 Copilot processes user inputs as well as contextual data from Microsoft Graph to provide AI-powered features. However, there is a lack of sufficient transparency regarding which specific data is processed and how it is used or stored.
Data transfers: The use of Microsoft 365 Copilot carries potential risks when transferring personal data to third countries such as the US. These data transfers conflict with the GDPR unless adequate safeguards, such as Standard Contractual Clauses or additional safeguards, are implemented.
Control options: Educational institutions have limited options to control the use and processing of data by Copilot. Features such as local data processing, granular privacy settings, or comprehensive encryption are not sufficiently integrated, making secure deployment difficult.
Why this is important:
Technical safeguards such as encryption, local data processing, and clear data control are crucial to protect sensitive data and ensure GDPR compliance.
NENNA - "Feature of the Month"
Protecting sensitive data during document upload
Protecting documents is one of the most frequently used use cases for NENNA Shield in 2024. With this solution, we cover several use cases in the daily use of AI. It helps management to work with contracts while still avoiding financial and reputational risks. It supports the legal department in complying with statutory requirements and reduces liability risks. We also protect the HR department, which can carry out the anonymisation of employee documents.
Masking sensitive data in PDF and Word documents protects confidential information and minimizes the risk of data breaches across various departments within a company while saving time and increasing efficiency.
Mandatory AI Literacy from February 2025
From 2 February 2025, the European AI Act obliges companies to ensure that their employees have sufficient AI literacy. This applies to all providers and operators of AI systems, including the use of tools like ChatGPT or Microsoft Copilot.
Details:
Carrying out risk analyses: Companies must perform context-based risk analyses for the AI systems in use to identify and minimize potential hazards.
Employee training: Employees must be trained to ensure they can use AI tools competently and in compliance with the law, creating awareness of both opportunities and risks.
Developing and implementing internal AI guidelines: Clear internal guidelines and processes for dealing with AI must be established to define responsibilities and ensure compliance with legal requirements.
Why this is important:
Compliance with the AI literacy obligation is crucial to avoid legal risks and ensure the responsible use of AI systems within the company.
What Else is New
Perplexity: Perplexity AI plans to integrate services like Notion, Google Docs, and Slack alongside web searches from early next year to provide personalized answers from various sources. However, connecting sensitive company data to AI systems carries risks such as data breaches, security vulnerabilities, and a loss of control over data usage. Companies should therefore carefully assess which data they share and ensure that appropriate safeguards are implemented to guarantee the integrity and security of their information.
Meta: The Irish Data Protection Commission has fined Facebook parent company Meta €251 million for a data breach. Unauthorized individuals exploited a vulnerability in video file uploads to access profiles of other Facebook users. Meta notified the authority of this breach in 2018.
Events
We will be at these events in the coming weeks. If you would like to meet us in person, feel free to drop by:
09.01 AI Sports Summit - Wolfsburg
22.01-23.01 Fintechworld - Cologne
19. - 20.03 Transform - Berlin
21. - 23.05 GITEX Europe - Berlin
Read more
All items
