AI Dominates Data Protection Congress 2023 as EU Data Laws Take Center Stage
Last week, the IAPP’s Data Protection Congress 2023 in Brussels became the center of attention for over 3,000 attendees. Similar to a music festival, the event offered a range of sessions, socializing opportunities, and a lack of sleep. However, the main theme that couldn’t be ignored was the dominance of artificial intelligence (AI). While generative technology sparked continuous interest, the focus of many sessions revolved around AI governance and its practical implementation. Attendees were discussing the need to move beyond buzzwords like ethics, innovation, and harm, and instead focus on developing and using AI in an ethical, safe, and secure manner. This sentiment aligns with the growing concern among businesses about the legal, regulatory, and policy issues surrounding AI. In 2024, many organizations will be dedicating their efforts to establishing frameworks, policies, and procedures to ensure ethical AI usage.
Though AI stole the spotlight, it shouldn’t overshadow the significant impact that a series of EU data-related laws will have on businesses in 2024 and beyond. Some of these laws have already taken effect, such as the Data Governance Act, while others will come into play within the next 18 months, including the Digital Operational Resilience Act, NIS2 Directive, and Data Act. Despite not grabbing front-page headlines, the combined effect of these laws will be far-reaching. Notably, many of these laws place ultimate responsibility and liability on the board and c-suite for driving risk, security, and compliance standards within their organizations. Merely including a compliance program overview in board papers will no longer suffice. The next year should be dedicated to educating and engaging senior management on the necessary steps to achieve compliance. In some cases, civil and criminal liability, along with the possibility of banning orders for board members, serve as further motivation for executives to prioritize these issues.
Reflecting on the event, some of the most interesting discussions and insights came from informal settings away from the main stages. This further emphasizes the importance of exploring diverse perspectives and ideas. It is crucial not to overlook the wealth of knowledge shared at DPC23 beyond the headline acts. The event provided a platform for companies at various stages of preparation for the introduction of these data-related laws to exchange experiences and perspectives.
As the focus on AI governance continues, organizations must also dedicate their attention to understanding and complying with forthcoming EU data laws. Both aspects are vital in ensuring ethical and secure handling of data. By actively addressing these developments, businesses can stay ahead of regulatory and legal changes, mitigating risks and demonstrating their commitment to responsible data practices. Only with concerted efforts can organizations navigate the complex landscape of AI and data protection, ensuring compliance and building trust with their stakeholders.
