European Union: Issued EDPB Statement 3/2024 on data protection authorities’ role in the Artificial Intelligence Act framework

On 16 July 2024, the European Data Protection Board (EDPB) released Statement 3/2024 regarding the role of data protection authorities within the framework of the Artificial Intelligence Act (AI Act). The EDPB emphasised the strong connections between the AI Act and the Union's data protection legislation, asserting that Union data protection laws fully apply to the processing of personal data throughout the AI systems' lifecycle. In its statement, the EDPB highlighted the need for effective supervision and coordination by the Member States when designating competent authorities for areas closely related to personal data protection. The EDPB issued several recommendations, for example, that national data protection authorities (DPAs) be designated by the Member States as market surveillance authorities (MSAs) for high-risk AI systems, as outlined in Article 74(8) of the AI Act. Additionally, the EDPB suggested that Member States consider appointing DPAs as MSAs for other high-risk AI systems listed in Annex III, particularly in sectors likely to affect individuals' rights and freedoms regarding personal data processing, unless mandatory appointments are required by the AI Act. The EDPB also stressed the importance of robust cooperation between MSAs and other entities overseeing AI systems, including DPAs. It called for clear procedures to be established for this cooperation in accordance with Article 74(10) of the AI Act.