GDPR, DPIA, the AI Act and the Algorithm Register for an AI phone line
A Dutch municipality that deploys an AI phone line arranges the GDPR, a DPIA, the EU AI Act and the Algorithm Register. The Municipality of Doesburg uses Iris by OpenIris as its AI phone assistant; OpenIris is a Dutch company and helps with each step. Iris is built for the GDPR, sovereign and independent of US big tech.
Last updated:
Who is responsible for the data?
For GDPR-compliant voice AI in the Netherlands, the municipality is the data controller and decides why and how calls are processed. OpenIris is the processor and only processes data on the municipality's instructions, under a data processing agreement that also lists sub-processors, retention periods and security measures.
Which personal data does Iris process?
Iris processes what the caller says. Names, phone numbers, citizen service numbers and bank account numbers are filtered out of the transcript before it is stored or sent to a language model. Conversations are never used to train models.
Is a DPIA needed?
A DPIA is required when processing is likely to result in a high privacy risk. For new technology that processes calls with residents, one is the obvious step. The municipality decides, advised by its data protection officer. We supply what the DPIA needs: which data Iris processes, where each link runs, in which country and with which sub-processors.
What does the EU AI Act ask?
The AI Act (Regulation (EU) 2024/1689) sets rules by risk level. For an AI phone assistant the transparency duty applies in any case: people must know they are talking to an AI system, and Iris's standard opening says so. Iris answers questions and transfers calls; she makes no decisions about residents. Whether a given use counts as high risk depends on how the municipality deploys Iris, so have your own legal or privacy officer assess it.
Does Iris belong in the Algorithm Register?
In the Dutch government's Algorithm Register (algoritmes.overheid.nl), public organisations show which algorithms and AI systems they use. Whether registration is mandatory for an AI phone line depends on the use and on the rules that apply to the organisation. An entry shows residents what Iris does either way, and we help write it.
What municipalities often ask us.
Who is the data controller for an AI phone line?
The municipality. OpenIris is the processor and only processes data on the municipality's instructions, under a data processing agreement.
Does OpenIris help with the DPIA?
Yes. We supply the information about data, servers, countries and sub-processors. The municipality carries out the DPIA, advised by its data protection officer.
See Iris at work for your municipality?
E-mail us and we schedule a demo. We set Iris up on your own information; no IT project or app is needed.
E-mail info@openiris.nl