03/06/2026
🧠 As medical AI advances, the boundaries of EU data protection law are being fundamentally re-written. It forces us to confront a critical compliance puzzle: How do we balance the immense promise of secondary health data use with the growing risks of AI-driven re-identification under the GDPR?
⚖️ This was the central question at CPDP 2026, where our team from the Department of Innovation and Digitalisation in Law (University of Vienna) hosted an interactive workshop. Rather than a traditional panel, we put a fictional medical AI dispute on trial to stress-test the legal boundaries of these exact tensions.
🔍 We dove deep into the complex gray areas where law meets tech:
• The practical fallout of the CJEU’s EDPS v SRB judgment on identifiability.
• AI-driven inference risks vs. traditional pseudonymisation.
• Whether synthetic data is truly anonymous by design, or it inherently carries latent inference and linkage risks that trigger GDPR obligations.
• The limits of scientific research exemptions when commercial medical AI is on the line.
💡 The consensus? Traditional de-identification standards are being pushed to their absolute limits by modern AI capabilities.
📝 We have just published a blog post reflecting on the workshop, the fictional case scenario, and the future of medical AI governance. Dive into the full breakdown here: Nearly a Decade After GDPR: Revisiting Re-Identification Risks in Health AI
👥 Workshop facilitators: Selen Yakar, Rodessa Marquez, Ibrahim Sabra, Ksennia Guliaeva, and Alexandra Mǎrginean
Privacy SyntheticData Pseudonymisation MedicalAI DigitalHealth EUlaw
