CPDP.ai 2024 - Lessons from the GDPR Red Lines or Red Tape

Lessons from the GDPR: Red Lines or Red Tape?
The question arises, as to whether the numer- ous procedural rules of the GDPR, the Digital Services Act and the AI Act are tailor-made for large (US) companies, while they are perceived as a bureaucratic burden by smaller companies and NGOs which struggle to achieve compliance with the GDPR. Meanwhile “internet giants” have coped better with the new rules than expected as they have the necessary resources when it comes to compliance. At the same time, these regulations avoid prohibitions and “”red lines””, and the legislator avoids making the corresponding (difficult) decisions. By relying on procedural rules rather than clear red lines, legislators are avoiding value decisions. Do future legislators need to be more courageous? Or would it lead to over-regulation if governments did not only set rules for digital business models but declare business models as simply illegal.
• GDPR Procedural Rules as bureaucratic burdens?
• What does the AI Act entail in this respect?
• What does the market development since 2018 teach us?
• Do we need exemptions for SMEs, and if so, which ones?
Organised by Privacy in Germany (PinG) (DE)
Moderator Niko Härting, HÄRTING Rechtsanwälte, HWR Berlin, German Bar Association (DE)
Speakers Christopher Millard, Queen Mary Uni- versity of London (UK); Markus Wünschelbaum, Hamburg Data Protection Authority - HmbBfDI (DE); Leonardo Cervera Navas, EDPS (EU); Itxaso Domínguez, EDRi (BE)