The ICO has issued its fourth call for evidence on generative AI. It focuses on individual rights, in particular in relation to the training and fine-tuning of generative AI.
In the context of generative AI, this means data protection rights apply to any personal data included in:
- the training data;
- data used for fine-tuning, including data from reinforcement learning from human feedback and benchmarking data;
- the outputs of the generative AI model; and
- user queries (eg when a data subject enters personal information via a prompt into the model).
Therefore, across the AI lifecycle organisations must have processes in place (including technical and organisational measures) to enable and record the exercise of people’s rights.
The call does not examine the right to rectification in detail, which was examined in the previous consultation on accuracy. It also does not examine rights related to automated decision-making.
Most current generative AI models are trained on datasets containing personal data or process personal data in the deployment stage to generate outputs. Organisations developing or using these models have a legal duty to enable people to exercise their rights over the personal data involved.
Organisations developing or using generative AI models need to be able to:
- demonstrate they have a clear and effective process for enabling people to exercise their rights over personal data contained in the training, fine-tuning, and output data, but also the model itself.
- show evidence about how they are making sure data subjects have meaningful, concise and easily accessible information about their use of personal data; and
- clearly justify the use of any exemptions and demonstrate the measures taken to safeguard people’s interests, rights and freedoms.
The ICO is calling for evidence on tested, verifiable and effective methods that organisations are developing or using to meet their legal obligations in this area, to support innovation and the protection of personal data in the development and use of generative AI.
The consultation ends on 10 June 2024.
