Upon a request from the Irish Data Protection Commission, the European Data Protection Board (“EDPB”) has published its opinion (“Opinion”) on compliance with personal data protection legislation in artificial intelligence model training. In the Opinion, the EDPB discusses (i) when and how an AI model can be considered as “anonymous”; (ii) how controllers can demonstrate the appropriateness of legitimate interest as a legal basis in the development and deployment phases; and (iii) how unlawful processing of personal data during the development phase of an AI model will affect the subsequent processing and operation of the AI model.

The EDPB states that anonymity should be assessed on a case-by-case basis. In order to ensure anonymity, the Opinion raises the bar by imposing the condition that it is impossible to obtain personal data through attacks on the artificial intelligence model or interaction with the model and by using all the means reasonably likely to be used. The Opinion also states that the legitimate interest condition can be used as a legal basis by applying the three-step test and that the necessity of personal data to develop an artificial intelligence model can also be considered as a legitimate interest.

The Opinion discusses the unlawful processing of personal data in artificial intelligence models under three scenarios. Firstly, personal data has been unlawfully processed by the same data controller in model development and deployment. In this case, an assessment should be conducted on a case-by-case basis. Secondly, personal data is retained in the model and is processed by another controller in the context of deployment of the model. In this case, it will be taken into consideration whether the controller deploying the model has fulfilled its obligation to assess whether the personal data has been processed in accordance with the law in the development phase of the model. Finally, a controller unlawfully processed personal data to develop the AI model, then ensured that it is anonymized. In this case, the process of the deployment of the model is considered to be lawful, provided that unlawfulness of the data processing does not subsequently affect the distribution of the model.

Although the Opinion is of great importance as an assessment on the data protection of personal data in the process of developing artificial intelligence, it is foreseen that it will be subject to criticism in the light of problems in practice, as it leaves too many uncertain areas and does not follow the Hamburg thesis which was expected to resolve various problems in a practical way.

Should you have any inquiries, please do not hesitate to contact us.