Personal Data Protection Office of Poland

07/17/2024 | Press release | Archived content

What should be taken into account when implementing the Artificial Intelligence Act

The implementation of the provisions of the Artificial Intelligence Act (AI Act) into the Polish legal order is connected with the introduction into the national law system of a number of solutions affecting fundamental rights - the processing of personal data, as well as the privacy of individuals. Therefore, Mirosław Wróblewski, President of the Personal Data Protection Office (UODO), sees the need to address comments on this matter.

As noted by the President of the Personal Data Protection Office (UODO), one of the fundamental issues of systemic consistency of the regulation implementing the application of the AI Act is to ensure the compliance of the created law with the standards being in force in Poland protecting personal data and privacy. This involves respecting the provisions of the Constitution of the Republic of Poland (in particular Article 51 - the right to protection of personal data and Article 47 - the right to privacy) as well as the General Regulation on the protection of personal data (GDPR) and the so-called Police Directive (DODO). Therefore, it is crucial for the adopted solutions implementing the AI Act that the Polish legislator takes into account in this process the provisions stemming from the aforementioned legal acts, which require parallel application.

This is because the matter regulated by the AI Act involves the creation, development and use of artificial intelligence systems that process personal data, including special categories of data, on a massive scale.

It will also be necessary to review the provisions already in force in the national legal order based on an analysis of the interplay between the above-mentioned legal acts.

The Personal Data Protection Office pledges expert support if legislative work is undertaken on draft acts, especially those that would constitute sources of generally applicable law and would need to be assessed for compliance with the General Data Protection Regulation.