<\/p>\n\n\n\n
Data protection<\/em><\/p>\n\n\n\n On May 21, 2025, the European Commission presented a proposal to amend Regulation (EU) 2016\/679 (\u201cGDPR<\/strong>\u201d), with the aim of introducing significant changes, particularly to benefit small and medium-sized enterprises and so-called \u201csmall mid-cap<\/em>\u201d companies. The initiative is part of the \u201cOmnibus IV<\/em>\u201d legislative package, launched in February 2025, which seeks to make the European regulatory framework more proportionate and sustainable, while maintaining strong protection of data subjects\u2019 fundamental rights.<\/p>\n\n\n\n Among the key elements of the proposal is the introduction of new definitions in Article 4 of the GDPR, which broaden the eligibility for simplified measures to a wider range of economic operators. In addition to micro, small, and medium-sized enterprises as identified by Recommendation 2003\/361\/EC, the category of small mid-cap<\/em> companies\u2014those with small market capitalizations but exceeding SME thresholds\u2014is also recognized. This move aims to avoid a disproportionate compliance <\/em>burden for growing businesses that exceed SME size thresholds, potentially hindering their development and competitiveness.<\/p>\n\n\n\n One of the most significant changes concerns the rules related to the record of processing activities. The proposal, presented on May 21, 2025, raises the employee threshold for the obligation to maintain such records to 750 employees, except where the processing presents a high risk under Article 35 of the GDPR.<\/p>\n\n\n\n Also noteworthy is the encouragement to develop codes of conduct and certification mechanisms that reflect the specific needs not only of SMEs but also of small mid-caps.<\/em><\/p>\n\n\n\n The hope is that these amendments will help build a more balanced regulatory ecosystem\u2014one that reconciles the protection of data subjects\u2019 rights with the needs for growth and innovation among European businesses.<\/p>\n\n\n\n For a tailored analysis and operational support in aligning with data protection<\/em> regulations, contact the Data & Technology Innovation Team.<\/p>\n\n\n\n Data protection & artificial intelligence<\/em><\/p>\n\n\n\n In May, the Italian Data Protection Authority sanctioned the chatbot<\/em> Replika for serious violations of the GDPR\u2014an event which, beyond the significance of the ruling itself, prompts a broader reflection on the compliance<\/em> of AI-based chatbots<\/em>, which are increasingly used in sensitive and high-risk contexts such as customer service, psychological support, education, and HR.<\/p>\n\n\n\n The use of conversational AI systems raises several critical issues from a data protection perspective. First and foremost, interaction with a chatbot often implicitly involves the collection and analysis of highly personal information\u2014ranging from user preferences and consumption habits to health data or emotional states. It is therefore essential that processing is carried out on a solid legal basis and for well-defined purposes.<\/p>\n\n\n\n Another fundamental aspect is transparency: users must be made aware that they are interacting with an artificial intelligence, and must understand which data is being processed and for what purpose. This is especially important when AI simulates a \u00abhuman\u00bb relationship, as in the case of Replika, generating emotional or personalized responses that may affect the psychological well-being of the user.<\/p>\n\n\n\n The issue becomes even more complex when minors are involved: here too, the Authority\u2019s ruling emphasized the lack of age verification mechanisms, highlighting the need to adopt effective technical solutions to restrict access to inappropriate content.<\/p>\n\n\n\n Lastly, one must consider the often-overlooked issue of automated decision-making. If the chatbot influences behavior or makes decisions in a broad sense (e.g., assigning profiles, suggesting actions, or modifying the user experience), the safeguards outlined in Article 22 of the GDPR apply\u2014requiring specific protections, including human oversight.<\/p>\n\n\n\n The lesson is clear: conversational AI can offer significant opportunities, but only when integrated within a framework of clear, documented accountability<\/em> focused on the rights of data subjects. Superficial compliance<\/em> is no longer sufficient\u2014it\u2019s time to design chatbots responsibly, with a comprehensive vision that balances innovation, ethics, and data protection.<\/p>\n\n\n\n LEXIA\u2019s Data & Technology Innovation team is available to support businesses and developers in risk assessment, privacy-by-design development of AI solutions, and in updating privacy documentation in line with the latest regulatory guidance.<\/p>\n\n\n\n Artificial Intelligence<\/em><\/p>\n\n\n\n The entry into force of Regulation (EU) 2024\/1689 (\u201cAI Act<\/strong>\u201d) marks a turning point in the European regulatory approach to artificial intelligence. Among the provisions of the AI Act already applicable as of 2 February 2025 is Article 4, which introduces a specific AI literacy <\/strong>requirement for providers and deployers<\/em> of AI systems.<\/p>\n\n\n\n The goal is clear: to promote an organizational culture based on awareness, understanding, and accountability in the use of artificial intelligence technologies.<\/p>\n\n\n\n According to the definition set out in Article 3, point 56 of the AI Act, AI literacy goes far beyond mere technical knowledge: it includes the ability to understand the risks, opportunities, ethical impacts, and legal implications of AI systems. Its implementation requires the development of differentiated training programs tailored to business functions, skill levels, and usage contexts.<\/p>\n\n\n\n In this regard, the European Commission provided concrete guidance through its FAQs published on 13 May 2025<\/a>, emphasizing the importance of a modular and proportionate approach.<\/p>\n\n\n\n There is no one-size-fits-all<\/em> model. An organization using high-risk AI systems, for example, must adopt enhanced training programs that include risk analysis, practical simulations, and modules on regulatory profiles. The obligation also extends to third parties\u2014such as consultants, suppliers, and contractors\u2014acting on behalf of the controllers.<\/p>\n\n\n\nAI Chatbots and Privacy Compliance: The Replika Case<\/h2>\n\n\n\n
Artificial Intelligence Literacy: The European Commission\u2019s FAQs for Proper Implementation of the AI Literacy Requirement<\/h2>\n\n\n\n