In this chapter, the law scholar Christine Wendehorst analyses the different potential risks posed by AI as part of two main categories, safety risks and fundamental rights risks. Based on this, the author considers why AI challenges existing liability regimes. She spells out the main solutions put forward so far and evaluates them. This chapter highlights the fact that liability for fundamental rights risks is largely unchartered while being AI-specific. Such risks are now being addressed at the level of AI safety law, by way of prohibiting certain AI practices and by imposing strict legal requirements concerning data governance, transparency, and human oversight. Wendehorst nevertheless argues that a number of changes have to be made for the emerging AI safety regime to be used as a ‘backbone’ for the future AI liability regime if this is going to help address liability for fundamental rights risks. As a result, she suggests that further negotiations about the AI Act proposed by the European Commission should be closely aligned with the preparatory work on a future AI liability regime.

This volume purports to provide an overview of the national and international measures developed to fight the COVID-19 pandemic in Europe, and aims to serve as a “toolbox” for judges and practitioners. By the time the book goes to print, the coronavirus, we are afraid, has not finished its devastating work. Virus mutations were even threatening that worse is still to come. Vaccination, however, is hopefully showing a way out. Developments such as these make it difficult to predict what the future will bring. We have therefore refrained from presenting the reader with a fully-fledged conclusion. Instead, we intend to offer you some ideas of a methodological nature, as well as some acknowledgements.

As regards the methodology: how did our project come into being? The historical background is to be found in the late 20th century, when several working groups of legal academics from various countries emerged. Commissions, such as Ole Lando’s Commission on European Contract Law, were created and working groups, such as those begun by Christian von Bar, Giuseppe Gandolfiand Reiner Schulze, among others, came up with drafts for a European Civil Code. By the early years of the current millennium, such projects began to run out of steam. The work was done, the money was spent. This did not mean that the members of the various groups lost touch. On occasions such as New Year, or disasters – as perceived by many – such as Brexit, contacts were again taken up, instigated by academics such as Hugh Beale and Matthias Storme. Likewise, early in 2020, when the pandemic started spreading, the group of former Commission members, now at around 100 members, proposed the idea of turning the negative development of the pandemic into something positive. The idea of a special volume was born. Over the past few months, this project has come to fruition. We will now present the way in which we have approached our task.

One of the first questions posed was: what purpose should the volume have? Two options were raised. The majority of the potential authors considered a classical overview of the law the best option.

PREAMBLE

The outbreak of COVID-19 has brought immense suffering and death to a considerable number of people around the world. It has impacted fundamentally the functioning of States, their democratic institutions and legal systems. Therefore, it is understandable that governments have and are continuing to resort to exceptional measures in seeking to get control over the spread of COVID-19. These exceptional measures inevitably restrict the fundamental rights of citizens in ways that can be justified only in these extraordinary circumstances. It is in the greatest interest of society that these measures against COVID-19 are imposed and enforced within the framework of established democratic principles, the international legal order and the rule of law.

Therefore, although the spread of COVID-19 justifies limitations on the functioning of institutions such as Parliaments and courts, these limitations must be subject to democratic control, must not be misused and not applied for purposes other than measures related directly to the COVID-19 crisis.

The measures taken by governments such as mandatory quarantine, the closure of borders, restrictions in mobility, are also having a dramatic impact on business, trade and employment. It is essential that the legal measures taken to address the hardship and other difficulties caused by COVID-19 take into account principles of solidarity and fairness as well as the need for co-ordinated action between States at an international or EU level as appropriate.

In these circumstances, the European Law Institute (ELI), an entirely independent non-profit organisation established to provide practical guidance in relation to European legal development, puts forward a summary of some of the important legal issues that arise in relation to the COVID-19 crisis.

Its summary, made from an independent non-governmental perspective with due consideration of what has been published by other bodies, is set out in 15 principles. These are addressed to all European States (whether or not Member States of the EU), and are intended to guide European States, EU institutions and other bodies with the object of ensuring that everything that is done accords with the rule of law and democratic values.

In the fight against the pandemic the use of so-called COVID-19 apps has triggered a lively debate. This contribution analyses different types of COVID-19 apps and their legal implications, focusing in particular on aspects of data protection law. It demonstrates why – at least with regard to proximity tracing and fully decentralised designs such as the DP-3T design – the public uproar is completely unfounded and irrational, rejecting a measure that is so privacy-friendly that it may not even get into the scope of the GDPR, at the price of forcing public and private parties to use much more intrusive methods of contract tracing. The contribution closes by explaining why, paradoxically, it may precisely be the privacy-friendliness of the app and the voluntariness of its use that makes it rather ineffective as a means to fight the pandemic, which in turn has implications for its assessment, as remaining dangers of “function creep” suddenly seem to prevail.

INTRODUCTION

The COVID-19 pandemic has led to a digital boost for Europe. Almost everything that used to require physical presence is suddenly being done remotely and with digital means, ranging from school teaching to conferences to court trials. It does therefore not come as a surprise that the fight against the pandemic itself is being fought with digital means. Among these digital means, the use of so-called COVID-19 apps – i.e. mobile applications to be used by the broad population – has triggered a lively debate. The debate has not just been lively, but surprisingly emotional. While hardly anyone seems to worry about the many thousands of mobile applications used for collecting our data, accessing our cameras, microphones and messages, and possibly disclosing the most sensitive data or any inferences to unknown third parties, COVID-19 apps caused a public uproar in some places. In Austria, for example, a range of political parties agreed to some overdue and innocuous clarifications in the Epidemic Law only under the condition that the use of contact tracing technologies was explicitly prohibited. For some experts, this does still not go far enough, and they are calling for a new law that forever guarantees absolute voluntariness of contact tracing apps. So are contact tracing apps now the decisive step into George Orwell’s 1984, which data protection lawyers must put a halt to?

THE SETTING: LEGAL LANDSCAPE IN AUSTRIA

THE AUSTRIAN LAW-MAKING PROCESS

Austria is a federal republic with a legislature both at federal level and at the level of the nine states: Vienna, Lower Austria, Upper Austria, Burgenland, Styria, Carinthia, Salzburg, the Tyrol, and Vorarlberg. Legislative competences are shared between the federal and the state level, in accordance with the Austrian Constitution, but state competences are rather limited, with a certain focus on planning and building laws, hunting and fishery laws or nature protection laws. Private law, including consumer contract law, lies within the exclusive competence of the federal legislature (cf. Article 10 of the Bundesverfassungsgesetz), which is also why the implementation of the Consumer Rights Directive (CRD) was a responsibility of the federal parliament, the Nationalrat, which has 183 seats. There is also a second chamber of parliament, the Bundesrat, with 61 members elected by the state parliaments, allowing the states some very limited influence on legislative matters at federal level.

Most Bills are introduced by the federal government and prepared by experts in the relevant federal ministries. In the case of the implementation of CRD, the Ministry of Justice has taken the lead, with strong influence on the part of the Ministry for Labour, Social Matters and Consumer Protection. The drafting was coordinated by Johannes Stabentheiner, who is in charge of private consumer law in the Ministry of Justice, and assisted by a consultative body consisting of observers from other ministries, stakeholder representatives, academics and experts providing technical information on selected issues. While the drafting team started their work well in time and finalised a draft by early 2013, deadlock behind the scenes between strong stakeholder organisations led to significant delays, and it was only when a new Minister of Justice was appointed and Wolfgang Brandstetter took office that the draft was finally released on behalf of the federal government and submitted to the federal legislator. This was well after the official deadline for the implementation of CRD, which had been 13 December 2013, and publication of the Austrian implementing law, the ‘Consumer Rights Directive Implementation Law’ (Verbraucherrechte-Richtlinie- Umsetzungsgesetz, VRUG), did not occur until 26 May 2014. The law entered into force on 13 June 2014, in line with Article 28 CRD, leaving businesses with less than a month to adapt to the new regime.