EDPB Adopts Opinion on Personal Data Use for AI Model Development
On December 18, 2024, the European Data Protection Board (EDPB) issued an opinion regarding the use of personal data in the development and deployment of artificial intelligence (AI) models. This opinion addresses key questions, including how AI models can be classified as anonymous, the applicability of legitimate interest as a legal basis for processing personal data, and the implications of developing AI models with unlawfully processed data. The opinion was requested by the Irish Data Protection Authority (DPA) to promote regulatory consistency across Europe. To gather insights, the EDPB held a stakeholders’ event and engaged with the EU AI Office.
The EDPB emphasizes that the assessment of anonymity for AI models must be conducted on a case-by-case basis by the DPAs. For an AI model to be deemed anonymous, it should be highly improbable that it can directly or indirectly identify individuals whose data contributed to its creation. Additionally, the model should not allow for the extraction of personal data through queries. To aid in this assessment, the opinion provides a non-prescriptive list of methods to demonstrate anonymity.
Regarding the use of legitimate interest, the EDPB outlines considerations that DPAs should evaluate when determining if this legal basis is appropriate for processing personal data in AI development. A three-step test is recommended to assess whether legitimate interest applies. Examples provided include conversational agents and AI applications for enhancing cybersecurity. These services may benefit users but must demonstrate strict necessity and respect for individual rights.
The opinion also discusses the consequences of developing AI models using unlawfully processed personal data, which could affect the legality of their deployment unless the data has been effectively anonymized. The EDPB aims to provide guidance for a case-by-case analysis, considering the diverse and rapidly evolving nature of AI models. Further guidelines addressing specific issues, such as web scraping, are also in development.
