Abstract Recent advances in Artificial Intelligence (AI) reveal a mismatch between the EU’s individual-centric data protection shell and automated systems’ ability to affect entire groups of people, sealed within that shell. AI routinely processes data about groups, while the GDPR still allocates rights and remedies to identifiable individuals. This design produces a structural collective redress gap where injunctions may be obtained without individual mandates (GDPR Art. 80(2), RAD Art. 8), but compensation remains tied to identifiability. Here, I show how the GDPR’s model (consent, data subjects’ rights, Art. 80) fits in and why it fails against AI’s capacity to de-anonymise and infer traits about persons whose data were never collected or volunteered. I then examine the AI Act 2024/1689. Although it repeatedly refers to “groups of persons,” trilogue negotiations removed the Parliament’s key collective remedy tools, leaving only ex‑ante risk and transparency duties. The example of online behavioural advertising or affinity profiling illustrates how AI‑designed groups fall outside the scope of meaningful GDPR or AI Act remedies. I argue for a right to group protection and propose four main revisions: a definition of groups, a mechanism for a group complaint and redress, group-level impact assessment requirements and group data protection by design.
Liubomir Nikiforov (Fri,) studied this question.