From Pseudonymisation to Synthesis: A Debate on Evaluating Privacy-Preserving Technologies and Re-identification Risks in Medical AI under the GDPR

  • Workshop
  • Music Room
  • Friday 22.05 — 10:30 - 11:45

Organising Institution

ID Law, University of Vienna

Austria

The Department of Innovation and Digitalisation in Law, established in 2017 at the Faculty of Law of the University of Vienna, serves as a bridge between legal scholarship and the evolving digital and socio-technological landscape. It examines the legal challenges arising in a rapidly advancing media, information, and innovation society, with a focus on areas such as information technology law, intellectual property, data protection, and copyright. A central pillar of the Department’s work is the study of e-commerce and consumer protection law, approached from both European and comparative perspectives, alongside research into legal technology and innovation within the legal profession and justice systems. The Department also engages extensively with the regulation of emerging technologies, including artificial intelligence, the Internet of Things, autonomous vehicles, drones, robotics, and developments in the life sciences. Recognising the complexity of these issues, the Department adopts a strongly interdisciplinary approach, contributing to and leading numerous multidisciplinary, third-party-funded projects. Its research often intersects with fields such as healthcare, artificial intelligence, robotics, life sciences, and criminal justice, aiming to develop informed and forward-looking responses to the legal, ethical, and societal implications of technological change.
Marking almost a decade of GDPR, the workshop will follow a debate format, examining re-identification risks in pseudonymised and synthetic health data following EUCJ EDPS v. SRB decision. Drawing on the PHASE IV AI and COMMUTE projects, which focus on Medical AI privacy risks, participants will debate the regulatory status of using health datasets of COVID-19 cohorts for AI training to assess Alzheimer’s risk. Putting a health-tech firm against patient advocates, the trial scrutinises whether secondary data use or its synthetic derivatives circumvents GDPR obligations. Divided into counsel arguments, expert interventions, and judgment, the workshop will explore two issues: 1) Does the secondary use of pseudonymised longitudinal datasets for AI training without consent violate GDPR under the SRB "reasonably likely" test? 2) Does synthetic data generated from these datasets fall entirely outside GDPR scope, or do inherent linkage potentials retain a nexus to original subjects that necessitates ongoing protection?

Host

Ibrahim Sabra

Department of Innovation and Digitalisation in Law, University of Vienna - Austria

Ibrahim is a legal researcher at the University of Vienna’s Department of Innovation and Digitalisation in Law, specialising in AI governance, privacy, and platform regulation. He focuses on the practical application of EU digital law, including compliance and fundamental rights assessments under the GDPR, DSA, and AI Act. He also engages in policy and consultancy work on internet freedom, digital rights, and responsible AI governance.

Host

Alexandra Maria Mărginean

Department of Innovation and Digitalisation in Law, University of Vienna - Austria

Alexandra is a university assistant (prae doc) at the Institute for Innovation and Digitalisation in Law, where she works on EU and third-party funded projects in the field of AI in health research. She completed her legal education in the Netherlands, earning an LL.B. in European Law from Maastricht University and an LL.M. in Law and Technology in Europe from Utrecht University. Alexandra is interested in the intersection between law and technology, focusing on intellectual property, data protection, and digital platform regulation.

Host

Kseniia Guliaeva

Department of Innovation and Digitalisation in Law, University of Vienna - Austria

Kseniia is a legal expert and researcher at the University of Vienna's Department of Innovation and Digitalisation in Law, specialising in privacy and data protection, AI governance, and human rights. Her work combines legal and ethical compliance across EU-funded AI research projects with in-depth research on the fundamental rights implications of emerging technologies. With a background at the European Court of Human Rights and experience spanning academia and the private sector, she also takes on consultancy work on questions of AI regulation, privacy, and responsible technology governance.

Host

Rodessa May Marquez

Department of Innovation and Digitalisation in Law, University of Vienna - Austria

Rodessa works as a Research Associate at the Department of Innovation and Digitalisation in Law at the Faculty of Law at the University of Vienna and is currently involved in EU and third party-funded projects, with a focus on the ethical aspects of AI in the digital health domain. She has obtained her Erasmus Mundus Joint Masters Degree in Digital Communications Leadership, specializing in Digital Policy and Innovation in Europe from Universität Salzburg and Vrije Universiteit Brussel. She is a doctoral student at the Department of Science and Technology Studies at the Faculty of Social Sciences at the University of Vienna.

Host

Selen Yakar

ID Law, University of Vienna - Austria

Selen Yakar is a project assistant (prae doc) at the Department of Innovation and Digitalisation in Law and a doctoral student at the University of Bonn. She studied law in Cologne and Istanbul and developed an interest in legal policy issues such as gender equality during her studies. She focuses on the detection and prevention of gender discrimination through algorithmic systems in her phd and is co-author of the handbook ‘Gender-neutral AI’ together with Professor Dr. Susanne Lilian Gössl, LL.M., University Bonn.