Legal regulation on the use of artificial intelligence for national security purposes in Europe

This paper analyses the regulation of the use of AI for national security purposes in Europe. After a brief mapping of most relevant uses of AI for national security purposes, applicable legal framework is analysed. Both the EU AI Act and the Council of Europe's AI Convention provide for broad exceptions regarding the use of AI for national security purposes. This covers activities of both public and private entities acting in the national security domain. In such circumstances, personal data protection law is seen as possessing the most direct impact on the use of AI for national security purposes. In this context, the notion of personal data is explained, emphasizing that any information relating to an identified or identifiable person qualifies as personal data under both the GDPR and Convention 108. The processing of this data, which is broadly defined, can be subject to data protection laws even in national security contexts, provided it meets certain criteria. The research shows that while there is a lot of uncertainty when it comes to the application of personal data rules to national security situations, existing case-law indicates that application of those rules is not fully excluded. On the contrary, it is to be expected that at least when private entities are involved in data processing operations, personal data protection law might prove to be very effective. Also, it is to be anticipated that the ECHR will play a major role in ensuring that uses of AI for national security purposes remain in line with requirements of democratic society.