Notes from the IAPP Europe: Children online, future of AI and EU digital laws clarifications

September can be summarized as a month of discussions about children and the digital world. This is not a new topic, since many countries, including some in Europe, have been talking about addressing the effects of social media on kids for months. 

Certain EU member states even took legislative steps to address this on a national level. France was to become the first EU country to ban social media access for minors when its Parliament approved a bill to this effect in July. However, the attempt fell short of success, as the country's constitutional court blocked the law on the ground that it infringes upon freedom of expression. 

A new, updated proposal was submitted mid-September, but there may be no need to continue the battle on a national scale, as this month's advancements bring the discussion to a completely new level — the EU level. 

The European Commission unveiled the EU Kids Act proposal 16 Sept. during the State of the Union speech. Commission President Ursula von der Leyen called the current situation "a great capture of our children." To address it, the EU Kids Act will introduce a gradual and differentiated approach to social media restrictions, based on different age groups. 

Autonomous social media accounts will only be allowed for children ages 15 and older, kids under 13 years old will have a full ban on social media, and the age groups in-between will have access to parent-controlled child-friendly services accounts. Strict safe design as well as age verification will be important tools to ensure the effectiveness of these restrictions. 

The exact scope of the new rules will continue to be shaped throughout the proposal's legislative journey. Hence, France's battle on this topic does not end, it simply moves to a new setting. Now, a consensus will have to be found not only at a national level but also with other EU member states in the setting of the Council of the EU. 

On the day the EU Kids Act proposal published, the European Parliament adopted its own-initiative report asking for a safer online environment for children. Parliament's demands include addressing addictive practices, reducing the collection of minor's data and introducing obligatory ethical standards for AI companions through the proposed EU Kids Act and beyond, for example through establishing an EU code of conduct for influencers. 

September also included lots of talks on artificial intelligence. United Nations High Commissioner for Human Rights Volker Türk warned about the "existential risk to humanity" if AI is left untamed. AI safety researcher Evan Hubinger shared his belief that there is a larger than 10% chance of AI killing "all humans by next decade." 

Many see such strong statements as fearmongering, but at least some of us must have taken a moment to stop and think about AI's risks. It is a topic that is hard to conclude on for most, as it requires a certain level of understanding. What could be taken from these statements is not whether such predictions are real but how important AI literacy is. Not everyone will be able to become an expert on AI, but those working on and with this technology cannot stop learning how to govern it. 

Von der Leyen also highlighted a strong focus on AI during her State of the Union speech, identifying AI as the "second tipping point of our times," the other being climate change. She addressed the growing risks and the need to manage them, but her main point was reassurance that in Europe, AI is able to bring benefits because of the established guardrails and, most importantly, because the focus is on human agency.

The EU's focus on simplification is no news. Recently, the AI Omnibus was finalized and entered into force, introducing important changes to the EU AI Act. It's counterpart, the Digital Omnibus, is still in the making. The Commission's proposal is being shaped and molded by the Irish Presidency of the Council as well as members of Parliament, as they try to reach common positions and advance to the trilogue stage. 

The final outcome of this simplification project remains to be seen, especially when it comes to the various contentious points, such as the interpretation of pseudonymized data and the use of personal data in the context of AI. 

The EU is also planning to ensure simplification through clarification. A European Data Protection Board project will clarify the intersection between the EU General Data Protection Regulation and other EU digital laws through guidelines, some developed together with the Commission. Draft guidance on the Digital Markets Act and the GDPR has already been released, while the intersections between the GDPR and the AI Act are yet to be addressed. 

Last week, the final guidelines were published on the interplay between the Digital Services Act and the GDPR. While they provide some clarity for actors navigating both laws, the question remains whether further clarification will be needed rather soon, as other EU initiatives, such as the EU Kids Act and the upcoming Digital Fairness Act, may result in new points of intersection with both the GDPR and the DSA.

The Commission is also clarifying practicalities around the European Health Data Space. In September, two implementing acts under the EHDS were adopted. One of them, on MyHealth@EU, explains how this digital infrastructure that enables cross border prescriptions and patient information sharing will work in practice. The other implementing act is on minimum metadata elements and their characteristics to be provided by health data holders for dataset descriptions for the secondary use of electronic health data, which aims to make it easier to discover different datasets. 

Simplification efforts continue, with new laws being proposed to fill in gaps, omnibuses being introduced to adjust laws already adopted, guidelines being published to address the points of contention, and further lawmaking and clarification through implementing and delegated acts. 

Navigating all these tools will be the next challenge.