Safeguarding Health Data in High-Risk AI Systems : A legal analysis of the regulatory interplay between the GDPR and the AIA in Healthcare

The thesis examines data protection rules in regards to patients’ health data when AI systems have been deployed in healthcare. The thesis primarily studies the correlation and intersectionality between the General Data Protection Regulation (GDPR) and the AI Act (AIA). The research topic focuses on the processing of health data by AI systems used for medical purposes in the healthcare industry, including for measures like diagnostics, preventative medicine and disease detection. The thesis examines AI systems that are classified as high-risk according to Article 6 of the AIA. Health data is considered special category data according to Article 9 of the GDPR and thus holds stricter regulations protecting data than ”regular” personal data. The purpose of the thesis is to look at how the GDPR and AIA enforce safeguards to protect fundamental human rights as well as how the regulations apply in practice. As the future in healthcare is facing further automation, the governance in the GDPR and the AIA become crucial to ensure compliance, lawful and fair processing of health data and safe AI deployment. The thesis evaluates the regulations both separately and their intersectionality and acknowledges overlaps and gaps in the regulations, specifically by looking at areas of potential risks like bias, opaque AI systems, data minimisation and human oversight. The thesis applies a legal dogmatic method in order to interpret the legal frameworks necessary in order to examine the purpose of the research. The methodology includes application of EU legislation, Court of Justice of the European Union case law and legal research. The thesis argues that data protection should continue to enjoy high protection in terms of AI deployment in healthcare, and that things like transparency, consent and data minimisation are at times at conflict with the nature of AI. At the same time, the approach is not hostile to further automation, on the contrary, the thesis is a tool for safe deployment of AI systems. The conclusion addresses the challenges that pose risk for non-compliance or failure to sufficiently satisfy the strict regulations in the GDPR and the AIA.