Why is it necessary to carry out a prior Impact Assessment if we process data with Artificial Intelligence? The costs are derisory considering how they secure our business.
European regulators are opening sanctioning procedures and provisional limitation of data processing in EU countries to ChatGPT, for lack of information to users and lack of legal standing and remedies (resolution of the Italian regulator on 30 March 2023). In the same vein, on 28 March 2023, the sanction of €125,000 was published against CITYSCOOT in terms of data protection, in particular geolocation and profiling (which could have been avoided, as described below with an Impact Assessment and creative legal solutions).
In July 2022 UBEEQO was also fined €175,000 for geolocation by another car rental competitor.
The French regulator (the CNIL) coordinated this case against CITYSCOOT with the Italian regulator and also with the Spanish regulator (our AEPD – Agencia Española de Protección de Datos), as it did previously in the UBEEQO case with the Spanish, Belgian, Danish, Italian and German regulator. In this way, a single fine is centralised with groups of companies operating in different territories of the European Union.
The fine was imposed in proportion to CITYSCOOT’s turnover last year, the number of users (almost 250,000) and the number of subcontractors (15) accessing geolocation and profiling/segmentation data of customers, in particular 3 of them without the most basic, as well as the use of cookies without consent, but also considering a cooperation of CITYSCOOT to promptly remedy the infringements. If the volume of sales had been higher and if CITYSCOOT had not cooperated with the regulator, the amount of the fine would have been higher. This is without prejudice to the negative publicity that the news has brought against CITYSCOOT, as OpenAI is now experiencing in relation to its ChatGPT.
Don’t let it happen: Impact Assessment
Having said the above, we at ACROSS LEGAL are at your disposal to carry out a prior Impact Assessment, which we always suggest to all our clients who use technological means, with geolocation and profiling of a substantial client base and with a view to the development of Artificial Intelligence solutions, especially with highly protected data and in considerable numbers, precisely to make it possible to do almost all of this, of course, within the law.
In fact, the Spanish regulator (the AEPD) was favourable with the localisation of the fleet of the vehicles of a City Council, as you can read here in what can result in creative legal solutions: https://www.aepd.es/es/documento/e-00868-2018.pdf
The Impact Assessment results in legal solutions so that, precisely, you can do almost everything that, in the referenced case, was sanctioned by a lack of Impact Assessment giving the green light to the business and not having the corresponding legal texts, both in contracts and legal notices, via the corresponding non-pre-ticked boxes and/or pop-up windows of your portal and App. With all this well implemented, regulators would not have questioned so many things or opened the corresponding sanctioning procedures to teach the market what is wrong.
The costs of carrying out this impact assessment and drafting the corresponding texts to legally validate the above are really low compared to the benefits for the business that can be realised with the corresponding legal backing.
CITYSCOOT, as well as other start-ups, belatedly realised the importance of dedicating a minimum of time to go deeper into drafting the corresponding legal texts in the contracts, its portal and its App, and to carry out a previous Impact Assessment that would have opened their eyes to the corresponding corrective measures until becoming a residual risk, saving them from such a fine and from negative publicity before consumers.
By Manuel Martínez Ribas, Partner specialising in Digital Law.
