From Pseudonymisation to Synthesis: A Debate on Evaluating Privacy-Preserving Technologies and Re-identification Risks in Medical AI under the GDPR

  • Workshop
  • Music Room
  • Friday 22.05 — 10:30 - 11:45

Organising Institution

ID Law, University of Vienna

Austria

The Department of Innovation and Digitalisation in Law, established in 2017 at the Faculty of Law of the University of Vienna, serves as a bridge between legal scholarship and the evolving digital and socio-technological landscape. It examines the legal challenges arising in a rapidly advancing media, information, and innovation society, with a focus on areas such as information technology law, intellectual property, data protection, and copyright. A central pillar of the Department’s work is the study of e-commerce and consumer protection law, approached from both European and comparative perspectives, alongside research into legal technology and innovation within the legal profession and justice systems. The Department also engages extensively with the regulation of emerging technologies, including artificial intelligence, the Internet of Things, autonomous vehicles, drones, robotics, and developments in the life sciences. Recognising the complexity of these issues, the Department adopts a strongly interdisciplinary approach, contributing to and leading numerous multidisciplinary, third-party-funded projects. Its research often intersects with fields such as healthcare, artificial intelligence, robotics, life sciences, and criminal justice, aiming to develop informed and forward-looking responses to the legal, ethical, and societal implications of technological change.
Marking almost a decade of GDPR, the workshop will follow a debate format, examining re-identification risks in pseudonymised and synthetic health data following EUCJ EDPS v. SRB decision. Drawing on the PHASE IV AI and COMMUTE projects, which focus on Medical AI privacy risks, participants will debate the regulatory status of using health datasets of COVID-19 cohorts for AI training to assess Alzheimer’s risk. Putting a health-tech firm against patient advocates, the trial scrutinises whether secondary data use or its synthetic derivatives circumvents GDPR obligations. Divided into counsel arguments, expert interventions, and judgment, the workshop will explore two issues: 1) Does the secondary use of pseudonymised longitudinal datasets for AI training without consent violate GDPR under the SRB "reasonably likely" test? 2) Does synthetic data generated from these datasets fall entirely outside GDPR scope, or do inherent linkage potentials retain a nexus to original subjects that necessitates ongoing protection?

Host

Ibrahim Sabra

Department of Innovation and Digitalisation in Law, University of Vienna - Austria