“Systems based on our data”. The number of complaints about new technologies is growing and will not stop
The number of complaints about the use of new technologies and the associated risks to user privacy is growing. As Mirosław Wróblewski, president of the Personal Data Protection Office, points out, these matters are becoming more and more complex and evade legal provisions, both national and EU. An example would be the abuse of deepfakes. Therefore, according to the expert, regulations are needed to effectively combat this phenomenon.
– An increase in complaints related to the use of new technologies is expected. We see this now. Moreover, we receive more and more complex complaints regarding the use of new technologies that are not even fully recognized, e.g. biometrics, encryption, and other security measures related to the protection of personal data. There are more and more such challenges – says Mirosław Wróblewski to the Newseria agency. – Technical knowledge and strengthening of the resources of the Personal Data Protection Office are needed, because these challenges are no longer only legal, but also technical, technological and ethical.
One of the areas that requires more attention in the context of threats to the protection of personal data and image are deepfakes. According to the President of the Personal Data Protection Office, today neither Polish nor EU law provides the tools to combat this phenomenon and protect against the consequences of abuse.
– This is proven by one of the cases in which I intervened. The idea was to use the image of a student to create the image of a naked person and distribute it at school and among friends – reminds Mirosław Wróblewski.
At the beginning of June 2025, the President of the Personal Data Protection Office notified the police about the possibility of committing a crime. He emphasized that the friends' behavior not only drastically violated the 15-year-old's privacy, but also threatened to violate her basic life interests in the future. There is a high probability of its identification. However, the police refused to initiate proceedings, which was later approved by the prosecutor's office. It was found, among other things, that the photo was not obtained from a protected data set and its processing did not constitute the processing of personal data. The President of the Personal Data Protection Office intervened in this matter with the Prosecutor General and finally in January this year. the prosecutor's office informed about reopening the case.
– This is a very unfair matter for this girl. Theoretical considerations that there are provisions that allow for the prosecution of such unworthy behavior prove that such solutions are needed. In Italy and France, solutions have been adopted that aim to more effectively protect our image and fight against technologies that, when used inappropriately, can harm people. Such legal solutions are also needed in Poland, emphasizes Mirosław Wróblewski.
Italy has introduced a law that defines the crime of illegally disseminating counterfeit or modified digital content generated using artificial intelligence.. They also determined civil and criminal liability for these abuses. According to the Personal Data Protection Office, an opportunity to change the situation in Poland is to resume work on regulations to implement the EU Digital Services Act (DSA), after the president's recent veto. The idea is to implement solutions that will systemically regulate issues related to counteracting and protecting citizens against the negative effects of this technology – both at the administrative, penal, fiscal, criminal and judicial levels.
The European Commission's response and the Grok issue
– Artificial Intelligence Act in Art. 50 requires labeling of images or materials, synthetic content produced using artificial intelligence algorithms. But this is not enough, because, firstly, this provision does not fully apply to every situation, and secondly, people's ideas for using technology escape these definitions or these solutions are too ineffective – says the President of the Personal Data Protection Office. – A discussion has begun at the European Union level on the need for solutions to combat negative behaviors related to the use of deepfakes or the phenomenon of deep porn. Although we know that there are also other regulations that can be used for this purpose: the European Commission has initiated proceedings against Grok for using applications of this type. We will see whether they will bring the expected result.
European Commission on January 26 this year. initiated new proceedings against platform This includes the dissemination of manipulated sexual images, including those that may depict child abuse.
According to WeProtect's “Global Threat Assessment 2025” report and data from CyberTipline, a centralized system for reporting cases of child abuse on the Internet, this phenomenon is dangerously increasing. Between 2023 and 2024, the system saw an increase of 1,325%. the number of reports related to generative artificial intelligence. However, there are many more threats and they are multidimensional.
– A very significant threat from artificial intelligence is that many of the systems have been trained based on the analysis of data that we have previously entered into the Internet.. We did not expect that they would be used for purposes other than those for which we included them. Therefore, we need to make sure that these systems do not disclose our data, that the risk of sharing them is negligible, and that system providers do everything to ensure that our privacy is protected. This is the purpose of the opinion of the European Personal Data Protection Board developed with the participation of the Office for Personal Data Protection – says Mirosław Wróblewski.
Use of personal data by AI
This is the EDPB opinion on the use of personal data for the development and implementation of artificial intelligence models, which was adopted in December 2024. It contains a set of criteria that help data protection authorities assess whether individuals can reasonably expect a particular use of their personal data. The speech includes: whether the data was publicly available, what the relationship was with the controller, what the nature of the service was and the context in which the personal data was collected. The criteria also include the source from which the data was collected and whether individuals are aware of the availability of their personal data online.
– There are also other threats to which the Personal Data Protection Office will respond. For example, those related to discrimination, i.e. the processing of personal data in a way that violates privacy. These are also the dangers of hallucinations. We know that artificial intelligence systems often process personal data and provide results in a way that misleads, manipulates or disinforms people – explains the President of the Office of Personal Data Protection.
According to the study published by the Personal Data Protection Office (UODO), “Strategic Report – Research on the needs of organizations in the use of artificial intelligence and personal data protection”, 41 percent of almost 500 organizations, the development of AI does not involve the processing of personal data or they are unable to assess this issue. The level of awareness on this topic varies greatly depending on the size and type of organization. The largest gaps occur in entities that traditionally process large amounts of personal data: local governments, universities and educational centers, health, culture, as well as in smaller entrepreneurs.. Many entrepreneurs declare they are familiar with GDPR obligations, but actual compliance with the regulations is difficult to achieve, and concerns about data security are one of the main reasons for not implementing AI.
