Summary of the Opinion of the European Data Protection Supervisor on the Recommendation for a Council Decision authorising the opening of negotiations on behalf of the European Union for a Council of Europe convention on artificial intelligence, human rights, democracy and the rule of law

(2022/C 458/04)

(The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)

On 18 August 2022, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations on behalf of the European Union for a Council of Europe convention on artificial intelligence (AI), human rights, democracy and the rule of law (‘the convention’), pursuant to Article 218 TFEU.

Having regard to the ‘trans-border’ nature of artificial intelligence, the EDPS welcomes the general objective, pursued by the Council of Europe, of elaborating the first legally binding international instrument on artificial intelligence, based on the Council of Europe’s standards on human rights, democracy and the rule of law. Accordingly, the EDPS supports the opening of negotiations on behalf of the Union for the convention, and welcomes the Union’s role in promoting trustworthy AI that is consistent with the Union’s values.

The EDPS takes note of the fact that the subject matter of the convention would be regulated in the EU by the proposed AI Act, and acknowledges the Commission’s aim to ensure that the convention is compatible with the proposed AI Act, taking into account future developments in the legislative process. However, the EDPS considers that the convention represents an important opportunity to complement the proposed AI Act by strengthening the protection of fundamental rights of all persons affected by AI systems and therefore advocates that the convention provides clear and strong safeguards for the persons affected by the use of AI systems.

In the light of the above, the EDPS makes four main recommendations on the negotiating directives:

— the general objectives for the negotiation of the convention should give more prominence to the safeguards and rights to be provided to the individuals - and groups of individuals - subject to AI systems, in line with the primary focus and objectives of the Council of Europe;

— an explicit reference to compliance of the convention with the existing EU legal framework on data protection should be included in a specific directive;

— in line with the risk-based approach, the objective of imposing a prohibition on AI systems posing unacceptable risks should be introduced;

— the convention should promote the adoption of a data protection by design and by default approach at every step of AI systems’ life-cycle.

Additionally, the Opinion offers further recommendations on inclusion in the convention of minimum procedural safeguards, as well as minimum requirements for transparency, explainability and auditability, compliance and control mechanisms, on cross-border cooperation between competent authorities to be designated by the parties to the convention for the supervision of the safeguards and rights to be provided in accordance with the convention.

1. INTRODUCTION

1. On 18 August 2022, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations on behalf of the European Union for a Council of Europe convention on artificial intelligence (AI), human rights, democracy and the rule of law ( 1 ) , pursuant to Article 218 TFEU (‘the Recommendation’).

2. The objective of the Recommendation is to authorise the opening of negotiations on behalf of the Union for a future Council of Europe convention on AI, human rights, democracy and the rule of law (‘the convention’), to adopt negotiating directives and to nominate the Commission as the Union negotiator ( 2 )

3. In the explanatory memorandum ( 3 ) , the Commission stresses that negotiations for the convention relate to matters falling under the exclusive Union competence, also due to the significant overlap between the ‘zero draft’ of the convention circulated by the Committee on Artificial Intelligence (CAI) of the Council of Europe, on the one hand, and of the Commission proposal for a regulation on AI (‘the proposed AI Act’) ( 4 ) , on the other hand, in terms of their scope and content ( 5 )

4. The explanatory memorandum ( 6 ) to the Recommendation highlights that the ‘zero draft’ proposes to include the following provisions: — purpose and scope of the (framework) convention; — definitions for an AI system, lifecycle, provider, user and ‘AI subject’; — certain fundamental principles, including procedural safeguards and rights for AI subjects that would apply to all AI systems, irrespective of their level of risk; — additional measures for the public sector as well as AI systems posing ‘unacceptable’ and ‘significant’ levels of risk identified on the basis of a risk and impact assessment methodology (to be set out later in an annex to the convention); — follow-up and cooperation mechanism between the parties; — final provisions, including a possibility for EU Member States to apply EU law in their mutual relations for matters covered by the convention and a possibility for the Union to accede to the convention.

5. The Recommendation, under recitals (6) and (7), highlights that the conclusion of the convention may affect existing and foreseeable Union rules. To protect the integrity of Union law and ensure consistency between the rules of international law and Union law, the Commission should be authorised to negotiate the convention on behalf of the Union.

6. The present Opinion of the EDPS is issued in response to a consultation by the Commission of 18 August 2022, pursuant to Article 42(1) of EUDPR ( 7 ) . The EDPS welcomes the reference to this consultation in recital 8 of the Recommendation.

8. CONCLUSIONS

49. In light of the above, the EDPS makes the following recommendations: (1) to give more prominence to the objective of ‘ensuring a high level of protection of human rights and preservation of European values’, in line with the nature and mandate of the Council of Europe. (2) to delete the word ‘including’ after ‘the EU single market law and other areas of law’ in directives (5) and (11), to better reflect interplay between general principles and fundamental rights, on the one hand, and secondary law (EU single market law and other areas of law), on the other hand. (3) to add a specific directive recalling the necessity to strike the right balance between the public interest and the interests of the persons subject to AI systems, to ensure full compliance with the rights to privacy and to the protection of personal data, as well as with other fundamental rights at stake, notably the right to presumption of innocence and to a fair trial, the right to good administration and the principle of non-discrimination. (4) to specify in a directive that the convention should provide certain minimum procedural safeguards and rights for the persons affected by the use of the AI systems. (5) to specify in a directive that the convention should provide for minimum requirements on transparency, explainability and auditability of AI systems. (6) to include in directive (14) the specification that societal/group risks posed by AI systems must also be assessed and mitigated. (7) to specify in the negotiating directives that certain AI systems, posing unacceptable risks, should be prohibited, as well as to provide an indicative list of such AI systems. (8) to include a negotiating directive according to which the convention should promote the adoption of a data protection by design and by default approach at every step of AI systems’ lifecycle. (9) to specify the content of directive (17) as follows: — an ex ante third-party conformity assessment must be carried out for high-risk AI; — the high-risk AI systems should be subject to a new conformity assessment procedure whenever a significant change occurs; — specify the object and the legal effect of certifications; — specify that technical standards, on the one hand, can have a positive impact on harmonization of products and services; on the other hand, their role is to provide technical specifications of rules already established by law. (10) to include a directive according to which the convention should provide that competent supervisory authorities must be granted adequate investigatory and enforcement powers. (11) to add a negotiating directive aiming at ensuring that the convention facilitates and encourages cross-border cooperation between competent authorities.

Brussels, 13 October 2022. Wojciech Rafał WIEWIÓROWSKI

(1) COM(2022) 414 final.

(2) COM(2022) 414 final, p. 3.

(3) COM(2022) 414 final, p. 5.

(4) Proposal for a Regulation laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) and amending certain Union legislative acts, COM(2021) 206 final.

(5) See also recital (5) of the Recommendation.

(6) COM(2022) 414 final, pp. 2 and 3.

(7) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).