The European Data Protection Board (EDPB) issued a new opinion that tackles tough legal questions around using personal data to create and deploy artificial intelligence (AI) models, particularly large language models (LLMs). These models do not fall under current privacy laws. There is an ongoing fight to navigate and apply rules to the advanced technology that demands large volumes of data for training. Therefore, this opinion aims to help oversight bodies with their decision-making. Ireland’s Data Protection Commission (DPC) welcomed the opinion, stating it will support the DPC’s supervision of AI models across the region and help the handling of numerous AI-related complaints submitted to the DPC.
The newly published EDPB opinion isolated some potential ethical questioning of AI models’ legal basis and required assessments to determine whether legitimate interest is an applicable legal basis for processing personal data. It implies that, although development work should consider data minimization and filtering during the data preparation phase, AI developers still have to comply with the GDPR.
For example, the opinion provides that developers of AI models may have to limit collection of personal data in the training phase via specific data minimization and filtering steps, thereby reducing any identifiability risk by selecting data sources for training data and robust methodological choices that might significantly reduce or eliminate the identifiability risk. While the GDPR does bring different rules and data access rights—such as the capacity for users to ask for, amend, or have their data deleted—with large language models demanding vast data for training, the GDPR becomes more complicated.
Thus, the regulatory assessments of AI models’ conformity with GDPR apply to developers’ design and development choices. In assessing the lawfulness, developers have to consider the necessity of the processing achieving the lawful purpose while also being less intrusive to individuals’ rights during the development and deployment phase of AI. The opinion emphasizes that AI model anonymity is not a given, and developers of these technologies may need to tailor mitigation measures specific to their circumstances. These measures may include privacy-preserving techniques, along with technical measures to ensure the level of the tech, and further its intention.