EDPB publishes Opinion on processing personal data for AI purposes

18/12/2024 | EDPB

The European Data Protection Board (EDPB) has adopted an Article 64(2) Opinion under the EU General Data Protection Regulation (GDPR) concerning the use of personal data for the development and deployment of AI models. The Opinion, which follows a request from the Irish Data Protection Commission (DPC), addresses three key areas: 

  • When and how AI models can be considered anonymous;
  • Whether legitimate interest can be used as a valid legal basis for developing or using AI models;
  • What happens when an AI model is developed using personal data that was processed unlawfully?

The Opinion also considers the use of first and third-party data.

Anonymity

The Opinion clarifies that data protection authorities (DPAs) should assess whether an AI model is anonymous on a case-by-case basis. To be deemed anonymous, AI models should be very unlikely to:

  • Directly or indirectly identify any individuals whose data was used to create the mode;
  • To extract personal data from the model through input queries. 

A list of example methods to demonstrate anonymity is included

Legitimate interest

The Opinion clarifies general considerations that DPAs should consider when assessing whether legitimate interest is an appropriate legal basis for processing personal data for AI-related purposes.

To assist DPAs in making their assessments and to help organisations conduct Legitimate Interest Assessments (LIAs), the EDPB provides examples of where such use cases can benefit individuals and several criteria to assess where individuals may reasonably expect certain uses of their personal data. These criteria include: 

  • Whether the personal data is publicly available; 
  • The relationship between the individual and organisation;
  • The nature of the service;
  • The original purpose for collecting the personal data;
  • Where the data was collected;
  • Potential further uses of the AI model;
  • Whether individuals know that their personal data is online.

In addition, the Opinion provides a series of mitigating measures organisations could adopt to limit any negative impacts identified in the LIA. These measures include technical solutions and ways to increase transparency or individuals' ability to exercise their rights.

Unlawfully processed personal data

The EDPB Opinion clarifies that DPAs may determine that an AI model was unlawfully deployed if it was developed using personal data without an appropriate lawful basis except where the model has been fully anonymised. 

In a statement, the DPC welcomes the opinion. DPC Commissioner and Chair Des Hogan commented: "We have a deep awareness and understanding of the complexities associated with regulating the processing of personal data in an AI context. Equally, we recognise that the core questions concerning compliance with the GDPR in an AI context are EU-wide industry challenges and as such require a harmonised approach at EU level." 

In addition, DPC Commissioner Dale Sunderland said: "This opinion will enable proactive, effective and consistent regulation across the EU/EEA, giving greater clarity and guidance to industry, while also promoting responsible innovation."

Additional legal analysis from Pinsent Masons and IAPP. 

In a separate post, Privacy International published its views and an assessment of how AI models have been trained for AI-related purposes. PI concludes that without an adequate legal basis, AI models are unable to uphold individuals' rights under the GDPR and should not be permitted just for the sake of innovation.

Read Full Story
Artificial intelligence, AI training data

What is this page?

You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.

The Privacy Newsfeed monitors over 300 global publications, of which more than 5,750 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.

Freevacy has been shortlisted in the Best Educator category.
The PICCASO Privacy Awards recognise the people making an outstanding contribution to this dynamic and fast-growing sector.