Mr. Ronan Lupton:

I will pick up on one aspect of the Act, Article 29, and an amendment that was submitted, No. 5a. It states: "Prior to putting into service or use a high-risk AI system at the workplace, deployers shall consult workers representatives with a view to reaching an agreement in accordance with Directive 2002/14/EC and inform the affected employees that they will be subject to the system." The directive establishes a general framework setting out the minimum requirements for the right to information and the consultation of employees in undertakings or establishments within the Community. The Commission's work programme from 2021 refers to the recitals as well.

On the issue of processing employee information, let me revert to the data-protection or GDPR style of offence. The AI Act states the information is high-risk information, as is biometric data that is processed. With modern technology, there can be biometric data processed. Photographs, for example, are biometric data. To take the very simplest of examples, an employee badge is a form of biometric data that is processed. An employer, data controller or deployer, or whatever the person deploying or putting an AI system into an employment situation is called, will have to comply with data protection impact assessments under the regime. Records of what is processed must be maintained and employees will have to be told what the position is. Bearing in mind the union and non-union positions, the Act does, in fact, have employee information set out as high-risk data.

I take the point that Dr. Bambrick made in that she is right about self-certification, but, again, it is a question of what flushes that out. That is where there is a problem. It might be that the trilogue needs to examine that further. I am concerned that there could be a delay in the trilogue. Members will have seen this regarding the EU privacy regulation. It has taken years to get it to where it needs to be. We are still waiting for it. Ultimately, modernisation of that area is a problem.

Workers' rights case law in this area is well developed. It usually concerns CCTV cameras. A case that springs to mind is that of Copland in the UK, where somebody was placed under surveillance but not told about it. It was a European Court of Human Rights case. Cases like that have arisen from time to time. The Attorney General recently said the right to privacy is an under-ventilated right in the courts. That is all fine but we have privacy and data protection. Those are two separate rights under the charter but also under the Irish constitutional order. If we are taking our data protection rights seriously, the job of the Data Protection Commission suddenly becomes extremely large. It is a matter of whether it has enough resources or funding – I guess these are the same – to do what is required in an AI environment, be it this year or in five years.

What would the forum look like? There are many well-known academic AI experts in Ireland. Having these individuals at the table, in addition to legal, regulatory, governmental and tech industry experts, employees and union representatives, should occur. The work of the Internet Advisory Board, done years ago, was all fine, but if in dealing with these issues there is no will to determine where we should go as a State and if we cannot help Ireland Inc. to succeed or be more profitable and competitive while protecting the citizen and employee, we are at nothing.

There is a tie-down. Even though it may not be as fit for purpose as we would like it in regard to the categorisation of employee data as high risk and what happens on those systems, biometric and employee data go hand in glove insofar as they can. Throughout the AI Act, there are plenty of references to the numbered GDPR. It is something I am less concerned about but we will need to square that circle regarding what will flush out the issue of when things go wrong and how we get to that point.