The European Data Protection Board (EDPB) responded to a request from the Irish Data Protection Authority regarding the use of personal data in developing AI models. The EDPB clarified that for an AI model to be considered truly anonymous, the likelihood of identifying individuals through the data must be insignificant. It also established a framework for determining when a company may have a legitimate interest in processing personal data for AI development, without obtaining explicit consent. The EDPB emphasized the importance of transparency and ensuring that individuals are informed about how their data is being collected and used. Ultimately, national data protection authorities are responsible for assessing whether GDPR has been violated in the processing of personal data for AI development.
The ruling was welcomed by the Computer & Communications Industry Association (CCIA), representing major tech companies, as it allows AI models to be trained using personal data. Access to quality data is essential to ensure the accuracy of AI output and mitigate biases. However, digital rights advocates raised concerns about the anonymity of AI models and the broad discretion given to national authorities, which could lead to inconsistent enforcement. Harmonization is seen as crucial to ensuring the effective protection of fundamental rights under the GDPR. More legal clarity is called for to avoid future uncertainties in the use of personal data for AI development.
The EDPB is expected to issue further guidelines on emerging issues in AI development, such as web scraping, which involves extracting data from websites to train AI models. These guidelines will be crucial as AI development relies heavily on vast amounts of data. It is important to address concerns around data protection and privacy in the development and deployment of AI models to ensure that fundamental rights are upheld universally. The EDPB’s clarification on the legitimate interest in processing personal data for AI development sets out a three-stage test for assessing the proper use of personal data. The opinion stresses transparency and informs individuals about how their data is collected and used in AI development.
There is a need for ongoing dialogue and cooperation between stakeholders, including tech companies, civil society, and data protection authorities, to ensure that AI development respects privacy and fundamental rights. The EDPB’s opinion provides guidance on how companies can develop and deploy AI models while complying with EU data protection laws. It is important to strike a balance between innovation and data protection to foster the responsible use of AI technologies. Further guidelines from the EDPB on web scraping and other emerging issues will help address challenges and ensure that AI development aligns with data protection principles and safeguards. Collaboration and coordination among stakeholders will be essential to address concerns and ensure that AI technologies benefit society while respecting individual privacy rights.
