WORKSHOP A:

Adapting a Data Protection Compliance Framework to Address AI Risks

James Clark

Partner, DLA Piper

Laura Dobson

Senior Associate, DLA Piper

As the pace of AI adoption continues to intensify, privacy professionals are grappling with the question of how to build an effective framework to assess and mitigate the data protection risks associated with the use of AI systems. Fortunately, there is a close relationship between existing principles of data protection law and the principles that are fast becoming accepted as the recognised standards for ensuring the safe and ethical use of AI technologies. Consequently, data protection teams are well-placed to help their organisations address the opportunities and challenges of AI. This Workshop:
 

• Considers what AI actually is and why data protection law is relevant to the development and use of AI systems
• Looks at the relationship between the data protection principles and ‘AI safety’ principles
• Considers in detail the automated decision making framework under the GDPR and why this is central to the relationship between data protection law and AI
• Looks at how DPIAs and other privacy assessments can be re-engineered to address AI-specific risks
• Examines supply chain issues associated with data processors that provide AI enabled data processing services
• Examines how data protection authorities are regulating the use of AI

WORKSHOP B:

Subject Access Requests: How to Decide What To Disclose

Claire Hall

Legal Director, VWV 

Responding to subject access requests is a key part of a data protection professional's job. As SARs are often made in the context of disputes and complaints, deciding exactly what to disclose can involve weighing up various competing factors. Disclosing too much and too little both carry risks.  This practical workshop includes:

• How to decide when to disclose information about other people
• How to choose between redacting non-disclosable information or extracting disclosable information
• Applying the frequently used exemptions, such as confidential references, management planning and forecasting, legal professional privilege and negotiations
• The rules around specific types of data
• What the requester is entitled to in addition to a copy of their personal data

WORKSHOP C:

NextGen Privacy Governance                           

Peter Given

Partner, DAC Beachcroft 

The world is changing at a phenomenal pace, fueled in part by advances in technology, digital transformation and increasingly data-hungry businesses. In parallel, across the globe we are seeing the rapid expansion of privacy laws, together with the evolution of existing privacy legislation and the growth of non-privacy laws that either affect privacy governance or form part of its remit. The privacy governance function must evolve if it is to survive these changes and deliver on its purpose. Using case studies, this Workshop:

• Unpacks the challenges facing today’s privacy governance function
• Identifies how best to solve for those challenges
• Considers how to evolve the privacy governance function so that it is fit for the future
• Considers the role of technology and privacy governance metrics in the function of the future

 WORKSHOP D:

Use of AI and Other Technologies in the Workplace

Andrew Kimble

Partner, Womble Bond Dickinson

Katie Simmonds

Managing Associate, Womble Bond Dickinson

The use of new technologies is both inevitable and valuable in order to save time and improve efficiency. However, organisations must deploy new technologies, including AI, both fairly and lawfully. This Workshop considers:

• The challenges of ensuring compliance with data protection laws when using AI and other new technologies in the workplace at all stages of the employment lifecycle, including recruitment
• The competing interests of an employer's legitimate interest to ensure productivity and an employee's right to privacy
• What employers can lawfully monitor and what they cannot, and the practical challenge this presents when employers can utilise increasing opportunities for monitoring the workforce
• The future regulatory landscape for AI in the UK and EU and the practical steps that HR teams should take now

WORKSHOP E:

CCTV / Facial Recognition

Liz Fitzsimons

Partner, Eversheds Sutherland 

The lawful use of CCTV and facial recognition systems has long been a challenge to organisations, as the nature of the data each captures can be particularly high risk and intrusive. Development and adoption of increasingly complex and advanced video surveillance systems, including those making use of AI-based technologies, carry greater risks of more intrusive surveillance. Recognition of the changes in risk profile are evidenced by enhanced regulatory scrutiny and activity, especially where large volumes of data are obtained and combined. These concerns have resulted in new regulatory guidance and decisions, which organisations must ensure they understand. This workshop provides practical advice on the key issues, including:

• Considering the particular risks related to video surveillance systems
• Understanding additional concerns arising from adoption of facial recognition technologies, AI type technology and ‘big data’ use within such systems
• Understanding the legal issues and challenges that apply to running these systems, including where data being processed is of a higher risk
• Considering practical steps to be taken when implementing or managing such video surveillance systems

WORKSHOP F:

Picking the Right Lawful Basis for your Processing Activity

Olivia Whitcroft

Solicitor, OBEP

How do you know which lawful basis to use for a particular processing activity? Of the six options, consent is first on the list, but is often not the best one, particularly as the data subject could say no! The other bases require a test of necessity, which can be challenging to apply in practice. This practical Workshop looks at:

• What are the six lawful bases, and in what circumstances you can consider using each one
• When consent should (or should not) be used, and how to obtain a valid consent
• What "necessary" means
• How to carry out a legitimate interests assessment