Discussion at the Initial Japan Privacy Symposium: DPAs from the G7 nationsshared their strategies for managing AI and other regulatory focus areas
G7 Data Protection Authorities Focus on AI and Children's Privacy
The G7 Data Protection Authorities (DPAs) have been actively working to champion privacy in the digital age, with key regulatory priorities including generative AI and children's privacy protections. Their latest meeting, held in June 2025 in Canada, emphasized collective action to foster trusted digital environments, addressing global privacy challenges.
The joint G7 DPA statement from June 2025 stresses the need for responsible AI innovation balanced with strong privacy safeguards. This statement highlights concerns about data security, confidentiality, transparency, and explainability in AI systems.
Protecting children’s privacy in the context of generative AI and digital technologies remains a regulatory focus, given their vulnerability and the increasing use of AI-driven platforms affecting children. A significant part of the discussions targeted cooperative enforcement efforts, seeking harmonized approaches across G7 countries to ensure high data protection standards globally.
The G7 DPAs promote “data free flow with trust” principles to enable cross-border data sharing while safeguarding privacy rights. This is vital in AI development and deployment. In parallel, there is recognition of industry demands, with over half of AI R&D teams prioritizing data security and privacy as their top concerns.
The CNIL, France's data protection authority, has taken steps to address these concerns by creating a dedicated department to monitor how AI systems comply with legal obligations stemming from data protection law. The EU's AI Act proposal is under debate, with the EU Member States tasked with designating competent national authorities and the European Parliament hoping to create a supranational collaborative body to play a role in enforcement.
The G7 DPAs' Statement on Generative AI outlines their key concerns, such as the lack of legal authority to process personal data at all stages. The UK's Information Commissioner, John Edwards, stated that commissioners are "keen to ensure" they do not miss the development of generative AI in the same way they missed the moment of building business models underpinning social media and online advertising.
The first Japan Privacy Symposium, hosted by our website and S&K Brussels LPC in Tokyo on June 22, 2023, featured global thought leaders discussing the interaction of data protection and privacy law with AI. Commissioner Shuhei Ohshima (Japan's Personal Information Protection Commission) delivered a keynote address at the Symposium.
In Canada, the regulatory activity for AI is currently assigned to the relevant ministry in the Canadian government. The US FTC has initiated an investigation against OpenAI, and the FTC is committed to enforcing the Children's Online Privacy Protection Act (COPPA) aggressively.
The EDPS has been designated the competent authority to ensure that EU agencies and bodies comply with the EU AI Act. The CNIL is adding another layer to its approach - digital education, with a partnership with the Ministry of Education and a platform to certify digital skills for children.
The G7 DPAs are positioning themselves as global leaders advancing high data protection standards that specifically address the risks posed by generative AI and protect vulnerable populations like children in digital ecosystems. This cooperation aims to balance innovation and privacy, fostering trust while managing emerging risks from AI technologies.
If desired, I can provide more detail on the G7 DPAs’ specific strategies on children’s privacy or generative AI regulation.
- The G7 Data Protection Authorities (DPAs) are focusing on fostering trusted digital environments, emphasizing key areas like AI and children's privacy protections.
- The joint G7 DPA statement from June 2025 underlines the need for responsible AI innovation, paired with strong privacy safeguards to address concerns about data security, confidentiality, transparency, and explainability in AI systems.
- The G7 DPAs promote "data free flow with trust" principles to facilitate cross-border data sharing while safeguarding privacy rights, essential for AI development and deployment.
- Industry demands are recognized, with over half of AI R&D teams prioritizing data security and privacy as their top concern.
- The CNIL, France's data protection authority, has established a dedicated department to monitor AI systems' compliance with legal obligations stemming from data protection law.
- The EU's AI Act proposal is under debate, aiming to create a supranational collaborative body to play a role in ensuring high data protection standards and harmonized approaches across EU Member States.
- The G7 DPAs' Statement on Generative AI outlines concerns about the lack of legal authority to process personal data at all stages, with the UK's Information Commissioner expressing eagerness to avoid missing the development of generative AI, as they did with social media and adtech.
- At the first Japan Privacy Symposium, global leaders discussed the interaction of data protection and privacy law with AI, while the CNIL, in cooperation with the Ministry of Education, is developing a platform to certify digital skills for children.
