EU’s AI Act versus GDPR – are there overlaps and contradictions?

March 9, 2025 Åge BA Leave a comment

Post updated 31.03.2025

In our previous post on the AI Act, we concluded with a remark concerning the AI Act and the GDPR (General Data Protection Regulation): Are the two regulations aligned, or are there contradictions?

In this post we want to explore this question.

NOTE: When speaking about personal data and data subjects in the following, it is in the context of the GDPR. In addition, our concerns about AI and GDPR are mainly directed at general-purpose AI systems (GPAI-systems) where large amounts of (scraped) data is used to train the GPAI-model on which the GPAI-system is built. (See box F below for exact definitions.)

The scope of the AI Act is comprehensive – it applies to any actor and user of AI systems within the jurisdiction of the European Union law, regardless of the actor’s country of residence.

As the GDPR, the AI Act is a regulation, contrary to a directive, which means that EU member countries have to implement it in their own legislation with only minor adaptive changes. The AI Act has EEA (European Economic Area) relevance as well, which means that the AI Act has to be implemented in Norwegian legislation – as the GDPR was.

Intersection between AI and Privacy regulation [Source]

The diagram shown illustrates the situation: There are some obvious overlaps because AI systems may process personal data, and so GDPR principles apply.

On that basis, we could say “end of story” and “case closed”. However, there are some differences and potential conflicts, making it worthwhile to spend some time on the issue.

It is beyond the scope of this blog post to cover all aspects of the issue at hand, so let’s discuss the fundamentals, with what’s most relevant to Runbox in mind.

(more…)

Continue Reading →

The Power of Big Tech

February 18, 2025 Andersen

The influence of big tech companies on our lives is undeniable. With limited oversight and a focus on maximizing profits, these corporations have become increasingly powerful. They rely on unrestricted access to our personal data to maximize profits, which puts them at odds with any form of regulation. They actively seek to shape policies that protect their lucrative revenue streams, and resist regulatory measures that could limit their power.

Without accountability, big tech companies put profits ahead of our privacy. They leave us vulnerable to misinformation and bias, and contribute to the shaping and manipulation of public opinion. As the digital world continues to develop, we’re likely to see more attempts to deregulate to protect their bottom lines.

(more…)

Continue Reading →

Your Data, Your Rights: A Guide to GDPR

January 28, 2025 Andersen Leave a comment

Introduced by the European Union (EU) in May 2018, the General Data Protection Regulation (GDPR) is a landmark piece of legislation that empowers individuals with unprecedented control over their personal information. This law has set a new global standard for data privacy, ensuring that companies are transparent about how they collect, use, and share your data. In this blog post, we’ll explore the key aspects of GDPR and explain why it’s important for Runbox and our customers.

(more…)

Continue Reading →

The FTC’s Report on Big Tech’s Personal Data Overreach: What You Need to Know

November 20, 2024 Andersen Leave a comment

The Federal Trade Commission (FTC) has released a report exposing how Big Tech companies are overstepping privacy boundaries in their quest for user data. The report reveals the massive amount of personal information these companies collect, store, and profit from. Often, this is done without clear user consent or transparency. As concerns over data privacy grow, the report highlights the urgent need for stronger regulation and more responsible data practices.

In this blog post, we’ll break down the key findings of the FTC’s report and discuss how this overreach affects your privacy, along with what actions you can take to protect your data.

Key Findings of the FTC’s Report on Big Tech’s Data Practices

The FTC’s report, titled “A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services” offers an in-depth look at how major technology companies, including Facebook (Meta), Google, Amazon, and others, are handling your personal data. Below are some of the major findings:

(more…)

Continue Reading →

EU’s AI Act: What it is all about

November 7, 2024 Åge BA Leave a comment

From the perspective of the general public and society as a whole, so-called Artificial Intelligence (AI) was largely invisible until OpenAI removed the veil over GPT-3.5/ChatGPT in 2022.

Since then, the interest and use of AI, and General Purpose AI (GPAI), has exploded. AI implementations are creeping in everywhere, to great benefit in many respects. However, the warning signs are many — manipulated images, fabricated conversations, falsified news stories, and fake video-presented events can lead to unforeseeable negative consequences, for instance in influencing democratic elections.

This is also the case when AI is used to make decisions, since we know that there is always a risk of “AI hallucinations” where AI software produces incorrect or misleading information.

This simplified outline can serve as background for the EU’s AI Act, whose purpose is to put a societal control over the use and influence of AI/GPAI in particular, and the big tech companies in general.

So let’s dig into the matter, with the aim to describe what EU AI Act is, and to clarify its consequences, if any, for Runbox.

(more…)

Continue Reading →