Cybersecurity Policy Report, EU Officials Assess Use of Personal Data for AI Development, (Dec 19, 2024)
The European Data Protection Board (EDPB) yesterday adopted an opinion on the use of personal data for the development and deployment of artificial intelligence models in an effort to seek Europe-wide regulatory harmonization.
The opinion attempts to address “fast-moving technologies that have an important impact on society” and offers the EDPB’s views about (1) when and how AI models can be considered anonymous; (2) whether and how “legitimate interest” can be used as a legal basis for developing or using AI models; and (3) what happens if an AI model is developed using personal data that was processed unlawfully, the EDPB said in a news release.
It seeks to align the development of AI models with the European Union’s General Data Protection Regulation (GDPR), according to EDPB Chair Anu Talus.
“AI technologies may bring many opportunities and benefits to different industries and areas of life. We need to ensure these innovations are done ethically, safely, and in a way that benefits everyone. The EDPB wants to support responsible AI innovation by ensuring personal data are protected and in full respect of the General Data Protection Regulation (GDPR),” Ms. Talus said.
The opinion provides several criteria to help assess whether individuals can expect that their personal data will be used in AI models, including, among others, whether or not the personal data was publicly available, the nature of the relationship between the individual and the controller, and the context in which the personal data was collected. The opinion also includes a non-exhaustive list of mitigating measures that may limit the negative impact of processing individuals’ personal data.
The EDPB also notes that AI models developed with unlawfully processed personal data can have an impact on the lawfulness of their deployment, unless the model has been duly anonymized.
The opinion was adopted at the request of the Irish Data Protection Commission (DPC), which welcomed the EDPB’s views. “The opinion was sought by the DPC in September, with a view to gaining European-wide regulatory harmonisation and clarity on a number of key questions in a timely manner,” the DPC said in a news release.
“As the Lead Supervisory Authority of many of the world’s largest tech companies, we have a deep awareness and understanding of the complexities associated with regulating the processing of personal data in an AI context. Equally, we recognise that the core questions concerning compliance with the GDPR in an AI context are EU-wide industry challenges and as such require a harmonised approach at EU level,” said Des Hogan, the DPC’s chair.
“In having made this request for an opinion, the DPC triggered a discussion, in which we participated, that led to this agreement at EDPB level, on some of the core issues that arise in the context of processing personal data for the development and deployment of AI models, thereby bringing some much needed clarity to this complex area,” Mr. Hogan added.
News: InternationalLegislation GDPR DataPrivacy