New EDPB Opinion on Personal Data Protection in AI
Several days ago, the European Data Protection Board (EDPB) adopted an opinion addressing key data protection concerns arising from the use of artificial intelligence (AI) models. The opinion focuses on how GDPR principles apply to AI, including the anonymization of data within AI models, the legal basis for processing personal data during AI development and deployment, and the consequences of unlawful data processing in AI systems.
From a practical perspective, the EDPB believes that legitimate interest may serve as a legal basis for processing using an AI model .
Legitimate Interest as a Legal Basis
Relying on legitimate interest as a legal basis processing gives companies greater flexibility. In particular, it enables them to rely on their own assessments of risk and necessity rather than seeking user content. The EDPB is saying that AI does not inherently mandate consent and that legitimate interest may be relied on as a legal basis.
The EDPB provides a detailed framework for assessing whether legitimate interest can serve as a legal basis for data processing in the context of AI.
First, the interest pursued must comply with legal standards and demonstrate tangible benefits, such as improving AI-based fraud detection, enhancing conversational agents that assist users, or improving threat detection in an information system.
Second, the processing must be strictly necessary to achieve the stated purpose. Controllers should also consider data subjects’ reasonable expectations regarding the use of their personal data, which may be influenced by the complexity and explainability of the AI system. In this context, controllers are encouraged to implement anonymization and other privacy-preserving practices.
Finally, a balancing test should be completed to ensure that the rights and freedoms of data subjects do not override the interest prusued. In this context, companies may consider how the processing benefits data subjects, as well as the potential risks to private life, data privacy, freedom of expression, non-discrimination, work, mental health, and more.
The analysis should also consider mitigating measures. For AI applications, these may include anonymization, transparency measures, and ways to facilitate data subject rights, such as deletion, opt-out, additional requests to examine data memorization by the model, and a “holding period” before training. Companies should also consider the context of data collection, including whether data was scraped from public sources, and additional strategies such as excluding data sources or avoiding the collection of certain categories of data.
Such an analysis can support a range of business applications of AI, giving companies greater flexibility in their use of AI. However, companies remain responsible for protecting user rights.
Anonymization of AI Models
In its opinion, the EDPB emphasizes that AI models trained on personal data are rarely inherently anonymous and calls for a case-by-case evaluation of the possibility of extracting or inferring personal data.
Some models may always be considered non-anonymous, such as voice modeling tools or models used to provide information about specific individuals, for example in HR contexts. For other models, the possibility of anonymization may depend on their design and use, the nature of the training data, their susceptibility to attack, and other factors. These considerations should be taken into account when evaluating the risk of identification and reviewing the steps implemented by the data controller.
As to the models themselves, the EDPB notes that even if personal data was unlawfully used during training, this may not affect further use of a model that has been anonymized, provided the anonymization process is sufficiently documented.
Organizations deploying AI are advised to:
- Adopt privacy-preserving techniques such as differential privacy or pseudonymization during training to minimize risks of re-identification.
- Thoroughly test and document anonymization measures to demonstrate compliance with GDPR requirements.
Practical Guidance for Businesses Utilizing AI
We recommend that businesses developing or deploying AI systems:
- Identify the processing activities using AI.
- Assess whether the GDPR applies to their AI activity and conduct a data protection impact assessment (DPIA) where required.
- Conduct detailed assessments to verify the legality of data collection for those activities.
- Perform a detailed legitimate interest assessment (LIA) for processing activities based on legitimate interest.
- Ensure that their use of AI facilitates the exercise of data subject rights.
- Maintain relevant documentation to demonstrate compliance.
***
Dr. Avishay Klein is a partner and head of the firm’s Privacy, Cyber and AI Department.
Adv. Masha Yudashkin is an associate in the firm’s Privacy, Cyber and AI Department.
Barnea Lande’s Privacy, Cyber and AI Department will be happy to help you understand the specific risks of implementing artificial intelligence tools, create a compliance program in this area, and map your GDPR responsibilities related to those activities.