Datasets processed through AI systems (also “AI Data Lakes”) are becoming increasingly popular, with an exponential increase in potential “use cases.”

You will find here below the main legal issues to consider:

1. Privacy (and GDPR) – This is obviously at the top of the list. Even when the database does not include personal data, AI systems may progressively infer (or re-identify) personal data, which will then have to be processed adequately in accordance with all applicable data protection regulations. As for the Italian (and other) jurisdiction(s), GDPR principles will have to be taken into account, including purpose limitation, fairness and transparency, as well as privacy by default and privacy by design. This implies, among other things, completing a prior Data Protection Impact Assessment (DPIA) and setting up a data governance system, also including, for instance, adequate privacy notices that inform about the consequences of the data processing. Data transfer regulations will have to be taken into account carefully, also considering that in certain cloud scenarios it may not always be possible to determine exactly where the data resides in a given moment in time. Anonymization and simultaneous aggregation solutions will remain the risk-free option, but they should be reviewed from time to time taking into account the technology evolutions that may allow re-identifications.
2. Antitrust – Big data economy has already been addressed by the Italian Antitrust Authority, and useful guidelines can be inferred already. That said, to avoid risks, a system to tag competition sensitive data should be set up, also providing for escalation procedures for certain use cases / data processes, particularly, but not limited to, when pricing and competitors data are handled. Data usage will have to be assessed carefully, also where data is used to reconsider the pricing/conditions applied by the suppliers; under Italian law, certain provisions on economic dependence may be triggered.
3. Product safety – Data sets may include, among other things, production and performance data, with potential implications on product safety risks. When processing such data, product safety laws (and related notification obligations) will have to be addressed carefully. For instance, in Italy—in addition to the relevant tort law responsibility—with regard to consumer products, the Italian Consumer Code provides for an obligation to inform the competent authorities even when there is just a suspicion of risk to the health and safety of individuals.
4. Insider law – In Italy investors must be protected by the misuse of inside information, in line with the relevant European regulations on market abuse. It should therefore be carefully assessed when data might qualify as inside or sensitive information, avoiding that any such information is included in the dataset or, where not possible, considering how to comply with the relevant disclosure obligations (including contingency plans, for instance, also providing for the data analysts to be included in the insider list.)
5. Intellectual Property – Adequate measures must be set up to ensure secrecy and ownership of the database. Among other things, it should be noted that under Italian Copyright Law, databases are protected by copyright and by the so-called sui generis right (such right preventing the extraction of a substantial part of the database.) A database is generally protected when it expresses a “creative ability,” being understood that the copyright protection for a database does not extend to its content. If data does not fall under copyright or sui generis protection, as is often the case for AI powered dynamic databases, contractual provisions may also help to prevent the use (or abuse) by third parties. 

We hope the above will help your company to navigate safely through the (AI data) lake. Other issues will have to be taken into account, including, dual use and cybersecurity implications, insurance coverage and so forth, in addition to contractual frameworks with technology and data providers. When setting up an AI powered database, a case-by-case review is in any event advisable, also taking into account, among other things, the specific purposes and “use cases.”

Please let us know if you have any further queries regarding the management of a data lake. Contact our Dentons Italy TMT Team at tmtbites.italy@dentons.com and do not forget to sign up to our TMT Bites Newsletter!