The European Data Protection Board (EDPB) has adopted an opinion about using personal data when developing and deploying AI models. The opinion looks at:
- when and how AI models can be considered anonymous;
- whether and how legitimate interest can be used as a legal basis for developing or using AI models; and
- what happens if an AI model is developed using personal data that was processed unlawfully.
It also considers the use of first and third party data.
The Irish Data Protection Commission requested the opinion with a view to seeking Europe-wide regulatory harmonisation.
Anonymity
The opinion says that whether an AI model is anonymous should be assessed on a case by case basis by the data protection regulators. For a model to be anonymous, it should be very unlikely:
- to directly or indirectly identify individuals whose data was used to create the model, and
- to extract personal data from the model through queries.
The opinion provides a non-prescriptive and non-exhaustive list of methods to demonstrate anonymity.
Legitimate interest
The opinion provides general considerations that regulators should take into account when they assess if legitimate interest is an appropriate legal basis for processing personal data for developing and deploying AI models.
A three-step test helps assess the use of legitimate interest as a legal basis. The EDPB gives the examples of a conversational agent to assist users, and using AI to improve cybersecurity. These services can be beneficial for individuals and can rely on legitimate interest as a legal basis, but only if the processing is shown to be strictly necessary and the balancing of rights is respected.
The opinion also includes several criteria to help regulators assess if individuals may reasonably expect certain uses of their personal data. These criteria include:
- whether or not the personal data was publicly available;
- the nature of the relationship between the individual and the controller;
- the nature of the service;
- the context in which the personal data was collected;
- the source from which the data was collected;
- the potential further uses of the model; and
- whether individuals are aware that their personal data is online.
If the balancing test shows that the processing should not take place because of the negative impact on individuals, mitigating measures may limit this negative impact. The opinion includes a non-exhaustive list of examples of such mitigating measures, which can be technical in nature, or make it easier for individuals to exercise their rights or increase transparency.
Unlawful processing
Finally, when an AI model was developed with unlawfully processed personal data, this could have an impact on the lawfulness of its deployment, unless the model has been duly anonymised.
Considering the scope of the request from the Irish DPC, the vast diversity of AI models and their rapid evolution, the opinion aims to give guidance on various elements that can be used for conducting a case by case analysis.
The EDPB is currently developing guidelines covering more specific questions, such as web scraping.
