Huge AI Legal News! The European Data Protection Board (EDPB) has issued its long-awaited Opinion on AI and data protection, a critical document addressing some of the most pressing legal questions within Artificial Intelligence.
This comprehensive opinion delves into key areas such as:
- When and how AI models can be considered anonymous.
- The use of legitimate interest as a legal basis for AI development and deployment.
- The consequences of using unlawfully processed personal data in AI systems.
Additionally, it explores the nuances of using both first-party and third-party data in AI models. Here’s what you need to know about the EDPB’s findings and their implications for AI developers, businesses and regulators.
1. Can AI Models Truly Be Anonymous?
The EDPB Opinion tackles a crucial question: Can AI models trained on personal data ever be fully considered anonymous? The answer is far from straightforward.
The EDPB underscores that merely claiming an AI model does not process personal data is not enough. Supervisory authorities (SAs) are required to rigorously evaluate such claims, focusing on whether:
- Personal data has been effectively anonymised.
- Risks of re-identification or membership inference attacks have been sufficiently mitigated.
For AI developers, this translates to a need for robust evidence and safeguards. The opinion emphasises implementing technical and organizational measures to substantiate claims of anonymity and ensure compliance.
2. Legitimate Interest as a Legal Basis for AI
Legitimate interest under Article 6(1)(f) GDPR is a popular legal basis, but the EDPB’s opinion makes it clear that it’s not a free pass for AI development. To rely on legitimate interest, three cumulative conditions must be met:
- Pursuing a legitimate interest.
- Demonstrating that processing is necessary to achieve that interest.
- Ensuring the processing does not override the fundamental rights and freedoms of data subjects.
The opinion calls for additional safeguards when third-party data is used, especially since there’s no direct relationship with the data subjects. These safeguards include:
- Enhanced transparency measures.
- Opt-out mechanisms.
- Comprehensive risk assessments.
Notably, the EDPB stresses the importance of considering AI-specific risks, such as:
- Discriminatory outcomes.
- Regurgitation of personal data by generative AI.
- Societal risks like deepfakes or misinformation campaigns.
Developers can mitigate these risks with measures like pseudonymisation, output filters and transparency initiatives, such as publishing model cards or annual reports.
3. Consequences of Using Unlawfully Processed Data
A significant portion of the opinion is devoted to the repercussions of developing AI models with unlawfully processed personal data. The EDPB makes it clear that such practices will not be tolerated. Supervisory authorities are empowered to impose corrective actions, including:
- Deleting unlawfully processed data.
- Retraining AI models.
- Requiring the destruction of the entire model in severe cases.
For AI developers and businesses, this serves as a stark reminder that compliance failures in the development phase can have cascading legal and operational consequences.
Why This Matters for Developers
The EDPB’s Opinion is a wake-up call for AI developers, emphasizing that non-compliance in the early stages can compromise the entire system later on. Key takeaways include:
- Claims of Anonymity: Must be backed by rigorous evidence and safeguards.
- Legitimate Interest: Requires careful balancing tests and additional safeguards.
- Unlawful Data Use: Can lead to severe penalties, including the destruction of AI models.
By proactively addressing these issues, developers can not only avoid legal pitfalls but also contribute to building more transparent, ethical and trustworthy AI systems.
The EDPB Opinion is a pivotal document that sets the tone for the future of AI regulation in Europe. For developers, regulators, and businesses, the message is clear: compliance and accountability must be at the core of AI development.
The full publication is available at https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf
Book an AI Presentation today
AI Ireland offers tailored presentations catering to your industry’s needs, providing invaluable insights into the transformative power of AI technologies. Stay ahead of the curve and equip your organisation with the knowledge it needs to confidently embrace the future.
Don’t miss the opportunity to enlighten your team and stakeholders. Book a presentation today and explore how innovation is positively impacting your industry.
Discover more from AI Ireland
Subscribe to get the latest posts sent to your email.
