Suchergebnisse

The accelerating development of artificial intelligence (AI) systems has stirred up the public debate around the most effective approaches and instruments to safeguard personal privacy. The unprecedented risks that AI poses to privacy rights require that policymakers and legislators conduct a thorough review of the existing measures and normative frameworks aimed at data protection. Most of them were established before the recent rise of AI and need, therefore, to be partly reconsidered. The rapid expansion and pervasiveness of AI, which is applied to almost every industrial sector with far-reaching social implications, make such a review a daunting challenge.
A far-sighted proactive regulatory approach that takes into consideration possible future developments of AI technologies can be seen as the most appropriate. In practice, however, this approach is hard to pursue due to the extreme difficulty, at least at this stage, in predicting the trajectory of AI systems. In dealing with the impact of AI on data privacy, regulators should therefore apply a great deal of flexibility based on a continuously updated understanding of the ongoing technological dynamics in the AI realm.
The existing consolidated body of human rights principles, of which respect for personal privacy is a key part, remains the essential source of inspiration for any regulatory effort and enforcement action. Preventing technological advancement from compromising privacy rights or eroding long-lasting commitments to protect fundamental rights of citizens should be a top priority for decision-makers. The challenge is how to obey such imperatives while avoiding to stifle innovation that can potentially bring great benefits for citizens' welfare and everyday life.Privacy risks and regulatory challenges
Privacy risks have long been under the limelight especially after the advent of commercial internet that makes ample use of data collection and processing. The rise of AI has greatly deepened concerns about data privacy.
Gargantuan amounts of data are collected and generated by AI systems. To feed and train their datasets, technology platforms aggregate information from a wide spectrum of sources such as traditional and social media, websites, internet navigation and shopping, and smartphone data. As a result, the individuals' control over how their personal data are collected and used is continuously at risk. By scraping personal data to train algorithms, platforms may disclose or memorise information about a person's life without their consent. This may facilitate, for example, phishing attacks, identity theft, or distorted uses of facial recognition, and introduce or reinforce bias in the screening of job candidates, the provision of benefits or loan granting.
Effective protection of personal data in the use and development of AI technologies requires rules and mechanisms that enable users to exercise adequate control on how their data are collected, stored and processed, and bind companies to delete data that can be misused. This is indeed the focus of the regulatory efforts undertaken by countries and international organisations, as will be discussed below.
Regulating AI also requires deeper attention to the whole data ecosystem that feeds AI. The supply chain for the data includes different stages, from data collection to the development of pre-trained models to the refining and optimisation of those models for specific tasks and applications. Understanding how data is handled at each stage of the AI supply chain is crucial to identifying the most appropriate mechanisms to improve AI models, ensure privacy protection and avoid bias. So far, the debate on AI regulation, both in the US and in the EU, has focused on transparency requirements regarding algorithmic systems, with scarce attention being paid to the data lifecycle. Filling this gap may help not only devise better methods and procedures to grant individuals greater control over their personal data but also distribute roles and responsibilities between AI developers and deployers.
An essential first step is removing or obfuscating personally identifiable information from training datasets. Measures of access control are also fundamental to ensure that only authorised personnel can access and process sensitive data. Checks for algorithmic fairness and bias can help prevent AI models from making decisions that unfairly impact particular groups or individuals. Testing for demographic parity, equal opportunity and other fairness metrics is important. Transparency of AI models can facilitate audit decisions on data protection. There is also the need for continuous monitoring of AI models to prevent violation of privacy or unintended use of sensitive data.
Technological innovation can also play a significant role in establishing more secure AI development and deployment practices and implementing effective measures tailored to specific AI systems and processes. Notably, the US government has mandated federal agencies to use privacy-enhancing technologies to protect personal information, acknowledging that they have the potential to ensure more effective handling of sensitive personal data.[1]Regulatory efforts and cooperation initiatives
As the EU and US share fundamental human rights principles, regulatory alignment across the Atlantic on protection of personal privacy in the development and use of AI may seem a realistic prospect. However, Washington and Brussels have adopted considerably different approaches to AI regulation in general, and privacy protection in particular. While the EU's regulatory process has produced several pieces of legislation, the US has so far opted for voluntary guiding principles.
The US government has shied away from imposing federal privacy rules on the handling of AI-driven data. The Executive Order on Safe, Secure and Trustworthy Development and Use of Artificial Intelligence issued by the White House in October 2023 simply calls on Congress to pass bipartisan data privacy legislation, while mandating federal agencies to develop guidelines to evaluate the effectiveness of existing privacy-preserving mechanisms in the AI realm.[2]
By contrast, the EU has enacted an articulated and robust legislative body on data governance and privacy risks associated with AI, including the General Data Protection Regulation (GDPR),[3] the most comprehensive legislative piece on privacy in the world, and the Artificial Intelligence Act (AI Act),[4] enacted in July 2024, which provides a risk-based approach banning the most harmful AI systems. The transatlantic dialogue on AI regulation has developed in various frameworks, notably within the Trade and Technology Council (TTC). The TTC is working on the implementation of a joint roadmap to establish common AI benchmarks and standards based on a large convergence on fundamental principles, including those related to personal privacy.[5]
The G7's major achievement so far has been the approval of Guiding Principles on Artificial Intelligence and a voluntary Code of Conduct for AI developers under the so-called Hiroshima AI process launched by the Japanese Presidency of G7 in 2023.[6] Privacy protection is emphasised as a central principle in both documents. The G7 has focused, in particular, on data privacy in the context of transborder flow of data, a key aspect of data governance that requires, by definition, close international cooperation. The operationalisation of the Data Free Flow with Trust (DFFT) concept, first launched by former Japanese prime minister Shinzo Abe in 2019, which aims to reconcile the promotion of free flow of data across borders with the protection of individual privacy, has become a central subject of dialogue within the G7.[7]
Of paramount importance is also the OECD's research and standard-setting work. The OECD's AI principles, initially adopted in 2019 and updated in May 2024, to which 46 countries have adhered, emphasise international cooperation to promote AI regulation, including in order to preserve personal privacy.[8] The OECD has provided the platform for confronting stakeholders' perspectives on how various jurisdictions have addressed AI's privacy challenges and for promoting a dialogue between the AI and privacy communities. In July 2024, the OECD also started a pilot phase to monitor the application of the G7 Code of Conduct.[9]
All major regulatory initiatives to deal with privacy risks associated with AI have been accompanied by a dialogue with AI actors and stakeholders. Such a dialogue is key to identifying the privacy risks and the possible technical and regulatory measures to address them. In July 2023, seven leading AI companies announced at the White House their adherence to eight voluntary commitments on how to develop AI in a safe and trustworthy way.[10] The document includes the promise to improve the testing and transparency of AI systems and to provide information on emerging risks.[11] Self-regulation processes such as the one promoted through the White House commitments can play a crucial complementary role with respect to the regulatory efforts undertaken by governments and international organisations and significantly contribute to trust building around data handling and flow.A complex and multi-faceted process
Building a safe and trustworthy AI ecosystem where privacy rights are adequately protected is a complex challenge that requires convergent efforts by governments, international organisations and major AI actors. Dialogue with stakeholders of the various industrial sectors has also become of growing importance as the pervasive nature of AI technologies has brought into sharp relief the ever-expanding variety of challenges and opportunities involved.
The growing concerns about the risks arising from AI developments highlight the need for new mechanisms that grant individuals increased control over their personal data and ensure greater transparency and accountability in the handling of data by AI developers and deployers.
A better understanding of the lifecycle of data collected and generated by advanced AI systems can lay the groundwork for the adoption of effective privacy-protection measures and the sharing of roles and responsibilities between AI developers and deployers.
AI advanced technologies can provide valuable instruments to enhance privacy, in particular for the handling of sensitive personal data. AI developers and deployers should make a pro-active and transparent use of available technologies that can contribute to protecting private rights through tailor-made measures.
Convergent efforts across the Atlantic to advance AI regulation remain of paramount importance. Despite their different approaches to regulation, the EU and the US have a deep-rooted attachment to human rights that facilitates cooperation on privacy issues. The Trade and Technology Council provides a valuable platform for developing common solutions at the transatlantic level that may serve as blueprints in wider cooperation frameworks.
The implementation of the G7 Code of Conduct can be another key component of international cooperation to promote innovation while protecting privacy rights through the involvement of private AI actors.
The G7 has also established as a valuable platform to promote the implementation of the DFTT initiative aimed at ensuring the free flow of data across borders through appropriate safeguards for privacy and other public interests. The operationalisation of DFTT can pave the way for greater interoperability of legal frameworks based on privacy-related criteria of trust.Ettore Greco is Executive Vice President of the Istituto Affari Internazionali (IAI) and also Head of the Multilateralism and Global Governance programme of the institute.[1] White House, Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, 30 October 2023, https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence.[2] Ibid.[3] European Council website: The General Data Protection Regulation, https://www.consilium.europa.eu/en/policies/data-protection/data-protection-regulation.[4] European Parliament and Council of the European Union, Regulation (EU) 2024/1689 of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), http://data.europa.eu/eli/reg/2024/1689/oj. See also the website developed by the Future of Life Institute: EU Artificial Intelligence Act, https://artificialintelligenceact.eu.[5] Trade and Technology Council (TTC), TTC Joint Roadmap on Evaluation and Measurement Tools for Trustworthy AI and Risk Management, 1 December 2022, https://digital-strategy.ec.europa.eu/en/node/11380.[6] G7, Hiroshima Process International Code of Conduct for Organizations Developing Advanced AI Systems, 30 October 2023, https://digital-strategy.ec.europa.eu/en/node/12130.[7] G7 Digital and Technology Ministers, G7 Digital and Technology Track – Annex 2: G7 Roadmap for Cooperation on Data Free Flow with Trust, 28 April 2021, https://g7.utoronto.ca/ict/2021-annex_2-roadmap.html; Aidan Arasasingham and Matthew P. Goodman, "Operationalizing Data Free Flow with Trust (DFFT)", in CSIS Briefs, April 2023, https://www.csis.org/node/104969.[8] OECD AI Policy Observatory website: OECD AI Principles, https://oecd.ai/en/ai-principles.[9] OECD, OECD Launches Pilot to Monitor Application of G7 Code of Conduct on Advanced AI Development, 22 July 2024, https://www.oecd.org/en/about/news/press-releases/2024/07/oecd-launches-pilot-to-monitor-application-of-g7-code-of-conduct-on-advanced-ai-development.html.[10] White House, Fact Sheet: Biden-⁠Harris Administration Secures Voluntary Commitments from Leading Artificial Intelligence Companies to Manage the Risks Posed by AI, 21 July 2023, https://www.whitehouse.gov/briefing-room/statements-releases/2023/07/21/fact-sheet-biden-harris-administration-secures-voluntary-commitments-from-leading-artificial-intelligence-companies-to-manage-the-risks-posed-by-ai; Voluntary AI Commitments, September 2023, https://www.whitehouse.gov/wp-content/uploads/2023/09/Voluntary-AI-Commitments-September-2023.pdf.[11] For an assessment of the implementation of the commitments undertaken by the seven companies one year on see Melissa Heikkilä, "AI Companies Promised to Self-Regulate One Year Ago. What's Changed?", in MIT Technology Review, 22 July 2024, https://www.technologyreview.com/2024/07/22/1095193.

Since Open AI launched ChatGPT, its generative artificial intelligence (AI) service, at the end of 2022, a heated debate has developed over the economic and social impact of AI. Growing attention has been paid, in particular, to the implications of the development and use of generative AI for competition policies. Competition authorities have been intensively working to deepen their understanding of the dynamics of the rapidly evolving AI markets and the new challenges that they pose for competition and consumer regulations. They have conducted several stakeholder consultations and promoted research to identify the most relevant market developments that require fresh regulatory efforts or enforcement action through the existing instruments.
It is widely recognised that the transformative power of generative AI can bring unprecedented benefits to citizens and consumers in a wide range of areas, from transportation to health to education. At the same time, it has the potential to bring about dramatic changes in companies' business models and the way in which many markets work. Competition authorities are focusing on the potential risks that such far-reaching transformation entails for competition and consumers. They are intensifying their monitoring of dynamics that may lead to market concentration, anti-competitive behaviour and unfair business practices restricting consumers' choices. The declared aim of competition regulators is to establish governance models that address anticompetitive conduct in the AI realm without stifling innovation: a delicate balancing act, not least because of the extremely rapid advancement of AI technologies.A learning curve
Regulators have made no mystery of their concern that, by not acting early enough, they might fail to prevent the consolidation of monopolies or dominant market positions as happened with the previous technological revolution in the digital economy. A feeling of urgency has taken root. At the same time, the opposite risk cannot be underestimated. Not only do AI markets appear to be at an embryonic stage, but they also are very complex systems cutting across many different economic sectors. Hence the need, openly recognised by competition authorities, to analyse market dynamics more thoroughly to avoid premature regulatory action that hamstrings innovation or quickly becomes obsolete. "We are on a learning curve", Margrethe Vestager, European Commissioner for Competition, candidly acknowledged.[1]Two major concerns
A first major concern relates to control by few market players of inputs that are key to developing foundation models, such as training data, advanced semiconductors, computing power, cloud services and technical expertise. Incumbent AI companies may deny their competitors access to such inputs to entrench their dominant market positions. Concentrated control of critical inputs can also limit customers' choices. A second risk is the use of acquisitions or partnerships by large digital companies to further consolidate their market power. In particular, a growing number of partnerships between big companies and small AI developers have been signed. The attitude of regulators towards these deals has been rather cautious so far. "Actually, these investments are important" – Vestager, for example, declared – "They give access to the necessary components and allow AI systems to be developed. So generally, we consider these deals to be pro-competitive. But they can sometimes create entrenched market positions, especially through exclusivity rights. So we need to keep an eye on them to ensure fair play."[2] More generally, competition authorities have warned against the risk that powerful incumbent companies may prevent, through various anticompetitive practices, smaller AI developers and start-ups from entering the market or reaching end users.Towards more assertive action by regulators?
Government initiatives signalling heightened concerns about competition risks in AI markets have multiplied. In October 2023, US President Joe Biden issued an executive order on "Safe, Secure and Trustworthy Artificial Intelligence" which emphasises the need to promote competition in AI and related technologies, by "addressing risks arising from concentrated control of key inputs, taking steps to stop unlawful collusion and prevent dominant firms from disadvantaging competitors", with the goal, inter alia, of "provid[ing] new opportunities for small businesses and entrepreneurs".[3] No less significant, in a paper on AI foundation models published in April 2024, the UK Competition and Markets Authority (CMA) voiced concerns about the potentially disruptive impact of AI on the economic environment, hinting at the use of its regulatory powers to prevent the consolidation of dominant market positions.[4] The paper marked a significant shift from CMA's previous plan to focus on the introduction of flexible guiding principles. The European Commission has indicated that it will apply EU competition law, including the Digital Markets Act (DMA) that took effect in 2023, also to AI market players.[5] In July 2024, the competition authorities of the EU, the US and the UK published a joint statement on competition in AI in which they underline the "great potential benefits" that AI services can bring to markets but commit, at the same time, to using their powers to safeguard against market practices that could undermine fair competition in the AI sphere.[6]G7 initiatives
In the last few years, the G7 has addressed competition problems in the digital markets in various documents, including with the involvement of competition authorities of the member countries.[7] In April 2023, a contact group was established among the G7 competition authorities and policymakers to facilitate exchange of information and experience on competition issues in digital markets. A subsequent G7 Communiqué (November 2023) emphasised competition risks associated with the rise of AI, including anticompetitive conduct by incumbent tech firms that control key AI inputs and adjacent markets.[8] The Apulia G7 Leaders' Communiqué issued in June 2024 encouraged the competition authorities of G7 countries "to monitor the development of the AI industry, with a view to addressing potential competition issues, and prevent adverse effects at an early stage".[9]
Worth mentioning is also the crucial role played by the Organisation for Economic Cooperation and Development (OECD) in technically supporting the G7 initiatives and providing research-based analysis and advice on how to promote competition in the AI realm.[10] The OECD work is key to advancing convergent governance models for generative AI.Dialogue with stakeholders
In parallel, both governments and competition authorities have intensified dialogue with market players and stakeholders about market dynamics and regulatory problems. Significant initiatives that demonstrate the potential of such dialogue include the July 2023 White House Voluntary AI Commitments,[11] endorsed by many key AI players, which set out ambitious and concrete objectives for managing risks associated with generative AI systems and for building trust with the public, and the G7 International Code of Conduct for Advanced AI Systems[12] which provides a set of voluntary guidelines to be applied by organisations developing the most advanced AI systems. Moreover, through processes like the UK AI Safety Summit, industrial players are collaborating with policymakers to share knowledge and help shape key commitments and principles around responsible AI.Looking ahead
The intensifying dialogue and cooperation between competition authorities across the Atlantic and in the G7 framework to deal with risks stemming from the rise of generative AI is a promising development. A convergence of efforts and policies to safeguard market competition and the interests of consumers can greatly contribute to countering the disruptive effects of rapid technological change and building transparency and trust.
The AI markets are however at an early stage of their development and the future trajectory of AI technologies and their multi-faceted applications remains highly uncertain. This requires a thorough and continuously updated study of market dynamics. While there is a rising feeling that early action by governments and regulators is needed to counter anticompetitive drives, premature interventions run the risk of stifling competition.
Dialogue with market players and stakeholders is of paramount importance to identify the emerging competition risks and evaluate the impact of the existing pro-competition tools or new regulatory measures on the AI realm. The outreach activities undertaken by governments and competition authorities provide a solid basis for further advancements in the dialogue with stakeholders. Voluntary codes of conduct such as the one launched by the Biden administration and the G7 may play a role in promoting responsible behaviour by industrial actors.
In this context, the G7 can provide an essential platform for advancing discussions on the role of competition policy in AI markets to ensure adequate actions to address anticompetitive issues. The G7 has also proved to be a valuable instrument to foster policy convergence among its members on competition rules and more broadly governance models for generative AI.Ettore Greco is Executive Vice President of the Istituto Affari Internazionali (IAI) and also Head of the Multilateralism and Global Governance programme of the institute.[1] European Commission, Speech by EVP Margrethe Vestager at the European Commission Workshop on "Competition in Virtual Worlds and Generative AI", 28 June 2024, https://ec.europa.eu/commission/presscorner/detail/en/speech_24_3550.[2] Ibid.[3] White House, Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence, 30 October 2023, https://www.whitehouse.gov/briefing-room/presidential-actions/2023/10/30/executive-order-on-the-safe-secure-and-trustworthy-development-and-use-of-artificial-intelligence.[4] Competition and Markets Authority, AI Foundation Models: Update Paper, 11 April 2024, https://www.gov.uk/government/publications/ai-foundation-models-update-paper.[5] According to Vestager, "the DMA can also regulate AI even though it is not listed as a core platform service itself. AI is covered where it is embedded in designated core platform services such as search engines, operating systems and social networking services". European Commission, Speech by EVP Margrethe Vestager at the European Commission Workshop on "Competition in Virtual Worlds and Generative AI", cit.[6] European Commission et al., Joint Statement on Competition in Generative AI Foundation Models and AI Products, 23 July 2024, https://competition-policy.ec.europa.eu/node/1301_en.[7] Early documents include the 2019 Common Understanding of G7 Competition Authorities on "Competition and Digital Economy" (https://www.ftc.gov/system/files/attachments/press-releases/ftc-chairman-supports-common-understanding-g7-competition-authorities-competition-digital-economy/g7_common_understanding_7-5-19.pdf) and the 2021 policymakers' G7 Shared Policy Objectives for Competion in Digital Markets (https://www.gov.uk/government/publications/g7-shared-policy-objectives-for-competition-in-digital-markets/g7-shared-policy-objectives-for-competition-in-digital-markets).[8] G7 Competition Authorities and Policymakers' Summit Digital Competition Communiqué, Tokyo, 8 November 2023, https://www.kantei.go.jp/jp/singi/digitalmarket/pdf_e/betten1.pdf.[9] Apulia G7 Leaders' Communiqué, 14 June 2024, https://www.g7italy.it/wp-content/uploads/Apulia-G7-Leaders-Communique.pdf.[10] See, in particular, OECD Competition Division, G7 Inventory of New Rules for Digital Markets, Prepared for the 2023 G7 Joint Competition Policy Makers and Enforcers Summit, November 2023, https://www.oecd.org/content/dam/oecd/en/topics/policy-sub-issues/competition-and-digital-economy/g7-inventory-of-new-rules-for-digital-markets-2023.pdf/_jcr_content/renditions/original./g7-inventory-of-new-rules-for-digital-markets-2023.pdf; Analytical Note on the G7 Inventory of New Rules for Digital Markets, November 2023, https://www.oecd.org/content/dam/oecd/en/topics/policy-sub-issues/competition-and-digital-economy/analytical-note-on-the-G7-inventory-of-new-rules-for-digital-markets-2023.pdf/_jcr_content/renditions/original./analytical-note-on-the-G7-inventory-of-new-rules-for-digital-markets-2023.pdf; Theories of Harm for Digital Mergers. OECD Competition Policy Roundtable Background Note, May 2023, https://www.oecd.org/en/publications/theories-of-harm-for-digital-mergers_0099737e-en.html.[11] White House, Fact Sheet: Biden-⁠Harris Administration Secures Voluntary Commitments from Leading Artificial Intelligence Companies to Manage the Risks Posed by AI, 21 July 2023, https://www.whitehouse.gov/briefing-room/statements-releases/2023/07/21/fact-sheet-biden-harris-administration-secures-voluntary-commitments-from-leading-artificial-intelligence-companies-to-manage-the-risks-posed-by-ai; Voluntary AI Commitments, September 2023, https://www.whitehouse.gov/wp-content/uploads/2023/09/Voluntary-AI-Commitments-September-2023.pdf.[12] G7, Hiroshima Process International Code of Conduct for Organizations Developing Advanced AI Systems, 30 October 2023, https://digital-strategy.ec.europa.eu/en/library/hiroshima-process-international-code-conduct-advanced-ai-systems.

The G7 has become a fixture of international diplomacy. But its exclusivity does not square well with demands for more representative global governance. The group still adds value, but its leaders should double down on efforts to win support for their agenda beyond the West.

In an era of unprecedented technological advancement, digital transformation is revealing its enormous potential, but also presenting new challenges. At its core, it represents a catalyst for innovation, igniting advancements that enhance productivity and propel economic growth. Thus, harnessing its transformative power holds the promise of unlocking new opportunities, solving complex challenges and ultimately shaping a more inclusive and sustainable future for humanity.
However, rapid technological progress has ushered in a new era of interconnectedness and interdependence, where nations are increasingly reliant on digital systems and networks to power their economies and safeguard their national security. In this regard, the intersection of technological advancement and the amplification of geopolitical tensions has brought into sharp focus the myriad threats that countries face in the contemporary landscape. Among others, cyberattacks, in particular, have grown more sophisticated, transcending national borders and necessitating collaboration and partnerships among nations to protect against such threats.
These challenges have prompted all major actors – both public and private – to intensify their efforts to protect their data and digital assets. They are devising and implementing a variety of risk management strategies. The empirical evidence shows that the most effective and resilient cybersecurity policies and approaches are those tailored to specific risks and security requirements. Individual organisations need to adopt the cybersecurity measures most appropriate for the challenges they face, based on a careful risk assessment. This requires the adoption of internationally recognised cybersecurity frameworks and standards that are based upon the principles of risk management and that are relevant across sectors to strengthen consistency and continuity among interconnected sectors and throughout global supply chains.
Cybersecurity threats are transnational by definition and as such they can be countered effectively only through global mechanisms aimed at risk reduction and trust building. A primary objective of multilateral cooperation should be the adoption of interoperable policy frameworks that promote international harmonisation and consistent cybersecurity mechanisms. The G7 can provide a fundamental impulse for this cooperation at the global level by encouraging the development and implementation of risk-based, consensus-driven frameworks, standards and risk management best practices. A commitment to these internationally recognised cyber risk management approaches and frameworks can advance economic security and enhance cyber resilience across the ecosystem.The G7's past initiatives
Recognising the enduring and constantly shifting landscape of cyber threats at a global level, the G7 has tried to adopt measures to confront these challenges head-on, with a particular focus on the financial sector.
In 2015, the G7 Cyber Expert Group (G7 CEG) was established as a multi-year working group responsible for coordinating cybersecurity policy and strategy among G7 member countries. The G7 CEG also serves as a channel for sharing information, establishing a common understanding of the threat landscape, and facilitating incident response by implementing risk mitigation measures. To this end, the G7 CEG organises annual incident response exercises[1] and quadrennial cross-border cyber simulations. It also produces reports on specific cybersecurity issues relevant to the financial sector.[2]
In October 2016, the G7 Fundamental Elements of Cybersecurity for the Financial Sector (G7FE) were published. The objective was to enhance the resilience of the financial system by providing a set of cybersecurity practices and assisting private and public entities in developing and implementing cybersecurity policies and operational frameworks.[3] During Germany's G7 presidency, two additional reports were drawn up by the G7 CEG, setting out fundamental elements for risk management. The G7 Fundamental Elements of Ransomware Resilience for the Financial Sector contain specific recommendations for financial market agents, focusing on how they can address the increasing threat of ransomware attacks (a type of malware that prevents from accessing devices and the data stored on it, usually by encrypting files).[4]
Moreover, the G7 Fundamental Elements for Third Party Cyber Risk Management in the Financial Sector addresses new cybersecurity risks stemming from the increasing use of service providers by financial institutions.[5] Private and public entities in the financial sector have increasingly relied on third-party relationships to support their business operations, resulting in a notable increase in the use of ICT providers in recent years. However, reliance on third parties should be coupled with robust third-party risk management to address ICT supply chain risks to individual firms. Systemic cyber risks to the financial sector may need to be addressed in a more comprehensive, holistic approach involving public and private sector stakeholders from government, supervisors, financial firms and technology companies. During Japan's Presidency in 2023, the Ministerial Declaration of the G7 Digital and Tech Ministers' Meeting, held prior to the Hiroshima Summit, addressed several important digital security issues beyond the financial sector. These included the need for international cooperation to provide secure and resilient digital infrastructure for developing and emerging economies, given their growing dependence on digital technology.
The Institutional Arrangement for Partnership (IAP) was endorsed by G7 governments at G7 Hiroshima 2023. The IAP is an international mechanism for operationalising Data Free Flow with Trust (DFFT) and represents an advancement in cross-border data flow. As today's global digital economy is fuelled by data, integrating both privacy and security measures for personal and sensitive data is paramount to safeguarding them against potential cyberattacks. Failure to do so could render them vulnerable targets for malicious exploitation.
Bringing governments and stakeholders together, IAP aims to ensure "principles-based, solutions-oriented, evidence-based, multistakeholder and cross-sectoral cooperation".[6] The IAP is hosted by OECD and is composed of the Secretariat, located within OECD, and project-based Working Groups, merging together government officials, stakeholders and experts.
Besides G7 initiatives, while comparatively limited in scope compared to them, some actions within the G20 context are also noteworthy. For example, the G20 under India's leadership adopted non-binding High-level Principles aimed at bolstering safety, security, resilience, and trust in the digital economy to support businesses.[7]
The United Nations is another major global player. The UN Security Council convened on 4 April 2024, specifically to address cyber-related issues. Hosted by the Republic of Korea and co-hosted by Japan and the United States, the session delved into the theme of the "Evolving Cyber Threat Landscape and Its Implications for the Maintenance of International Peace and Security".[8] The discussion brought attention to the narrowing gap between low-intensity, financially motivated cybercrimes and disruptive, large-scale cyberattacks, underscoring the urgent need for further proactive measures to address these evolving threats.Looking ahead
There are three areas in which the G7 can do more to address cybersecurity concerns. First, it can step up its support for the ongoing attempts to harmonise cybersecurity strategies between its member states with an eye to wider agreements in more inclusive bodies such as the G20 and the UN. Second, it should endorse efforts to establish common criteria to assess the trustworthiness of digital service providers that facilitate cross-border data flow. Third, in pursuing such goal, it should promote a wider and more systematic involvement of key stakeholders, including major industry actors as well as others that have expertise in cybersecurity, data protection and privacy.
Therefore, the G7 should consider undertaking further initiatives aimed at coming to a common understanding of what constitutes digital trust, with the goal of establishing a multilateral framework based on shared trustworthiness criteria. This framework would serve the purpose of addressing the cybersecurity, privacy and national security concerns while providing governments with a common basis by which to assess the trustworthiness of companies providing digital services and infrastructure such as cloud computing.
To that end, the G7 should call for the Data Free Flow with Trust (DFFT) Experts Group at the Institutional Arrangement for Partnership (IAP) to form a workstream that will focus on the technical work necessary for developing a multilateral framework on trustworthiness. It should call for the creation of an expert working subgroup within the IAP's DFFT expert group with the task of mapping out potential criteria to assess the trustworthiness of digital service providers. The G7 should also set up an ad hoc G7 group at the ministerial level to evaluate those criteria with the view of advancing and adopting a dedicated multilateral framework.
The G7 should also provide a forum for discussing and undertaking initiatives aimed at fostering cooperation among national bodies responsible for developing cybersecurity strategies. All G7 members have set up cybersecurity agencies to address cyber threats. Harmonising their strategies would greatly contribute to address transnational cyberattacks. The G7 should act as a key promoter of closer cooperation between national cybersecurity agencies through such activities as joint assessment of risks associated with the new technologies, sharing of best practices and coordination of standardisation efforts.Ettore Greco is Executive Vice President of the Istituto Affari Internazionali (IAI) and also Head of the Multilateralism and Global Governance programme of the institute. Federica Marconi is Researcher in IAI's Multilateralism and Global Governance programme.[1] European Central Bank, G7 Cyber Expert Group Conducts Cross-Border Coordination Exercise in the Financial Sector, 23 April 2024, https://www.ecb.europa.eu/press/pr/date/2024/html/ecb.pr240423~de1afe7ceb.en.html.[2] US Department of the Treasury website: G7 Cyber Expert Group, https://home.treasury.gov/node/970671.[3] G7 Finance Ministers and Central Bank Governors, G7 Fundamental Elements of Cybersecurity for the Financial Sector, 11 October 2016, https://www.ecb.europa.eu/paym/pol/shared/pdf/G7_Fundamental_Elements_Oct_2016.pdf.[4] German Federal Ministry of Finance, G7 Countries Adopt Reports on Cybersecurity, 13 October 2022, https://www.bundesfinanzministerium.de/Content/EN/Standardartikel/Topics/world/G7-G20/G7-Presidency/g7-reports-on-cybersecurity.html.[5] Ibid.[6] G7, Ministerial Declaration - The G7 Digital and Tech Ministers' Meeting, 30 April 2023, point 13, https://g7g20-documents.org/database/document/2023-g7-japan-ministerial-meetings-ict-ministers-ministers-language-ministerial-declaration-the-g7-digital-and-tech-ministers-meeting; Digital Agency website: Institutional Arrangement for Partnership (IAP), https://www.digital.go.jp/en/dfft-iap-en.[7] G20, G20 New Delhi Leaders' Declaration, 9 September 2023, https://g7g20-documents.org/database/document/2023-g20-india-leaders-leaders-language-g20-new-delhi-leaders-declaration.[8] Allison Pytlak and Shreya Lad, "The UN Security Council Discusses Cyber Threats to International Security", in Stimson Commentaries, 15 April 2024, https://www.stimson.org/?p=92869.

Wahrscheinlich wird Italien künftig von einer ­Mitte-Rechts-Koalition unter Beteiligung von zwei rechtsextremen, antieuropäischen und fremdenfeindlichen Parteien regiert. Nicht nur in der Haushaltspolitik drohen Konflikte mit der EU. Doch kann Italien keines seiner großen Probleme, auch nicht die Flüchtlingsfrage, ohne die Hilfe Europas lösen. (IP)

Résumé L'Italie attend de la future présidence française de l'UE la mise en place des réformes institutionnelles européennes prévues par le traité de Lisbonne. De peur d'être mise à l'écart des débats, elle promeut une plus large consultation européenne, afin d'éviter le leadership de Paris, Londres et Berlin. L'Italie partage le souhait de la France d'avancer sur certains dossiers, comme la PESD, l'environnement et l'immigration, même si elle n'en partage pas toujours les modalités d'actions. Les débats étayeront les divergences, notamment sur le sujet de l'adhésion de la Turquie à l'UE. Néanmoins, un projet fédère les deux pays : l'Union méditerranéenne, qui représente un espace géopolitique au sein duquel les intérêts français et italiens sont convergents.