AI in health only with data protection. New recommendations from the Personal Data Protection Office (UODO)

• The Personal Data Protection Office (UODO) recognizes privacy protection as a primary principle when implementing AI, including in healthcare.
• Demands sector-specific legal regulations for systems analyzing medical, biometric and genetic data
• Indicates the need for compliance with GDPR, AI Act and Convention 108+ when processing data
• Emphasizes that a general approach to risk assessment is insufficient

Mirosław Wróblewski, President of the Personal Data Protection Office, presented the Ministry of Digital Affairs with comments on the draft "Artificial Intelligence Development Policy in Poland until 2030," developed through an internal expert debate. In its conclusions, the Office strongly emphasizes the need to consider privacy and personal data protection in all aspects of AI development, recognizing this as a horizontal principle for every sector of the AI Policy, including health, infrastructure, education, public administration, innovation, and open data.

In particular, the President of the Personal Data Protection Office (UODO) points to the crucial need to review and establish a solid legal foundation for implementing artificial intelligence in public services, with particular emphasis on healthcare and justice. This is related to the processing of particularly sensitive data categories, such as biometric, health, genetic, and criminal record data. According to the UODO, a general, horizontal approach to assessing personal data security is insufficient, and the proper setting of data protection standards requires consideration of the sectoral context.

The need for specific solutions

The Personal Data Protection Office (UODO) calls for the AI Policy to include specific solutions for creating a legal framework consistent with the EU regulatory system, both horizontally and sectorally. It also requests that the document be supplemented with mandatory compliance with the GDPR, the AI Act, and the 108+ Convention. It is also crucial to adopt a balanced regulatory framework that legalizes the activities of public authorities using AI solutions and to clarify the role of the President of the UODO as an independent authority protecting the right to privacy.

From the perspective of transparency and responsible management, the initiative to create a uniform, publicly accessible list of AI systems used in public administration is important. Such a register should include not only the system's main features but also its purpose, actions taken, and their effects. The Personal Data Protection Office (UODO) also emphasizes the need to expand educational and competency-building activities for citizens. Before enacting regulations governing the operation of AI systems, a fundamental rights impact assessment is essential.

Copyrighted material - reprint rules are specified in the regulations .