The European Commission is close to presenting an amendment to the GDPR that would codify “legitimate interest” as the legal basis for training AI systems with personal data. The proposal is currently being discussed between the relevant commission departments and, if confirmed, would be part of a set of targeted amendments expected on Nov. 19.
The European Commission is in advanced talks to formally propose recognizing “legitimate interest” as the suitable legal basis for training AI technologies with personal data under the General Data Protection Regulation, MLex has learned.
Artificial intelligence is a data-processing technology that requires vast datasets for development. General-purpose AI models, the sophisticated technology behind chatbots such as OpenAI’s ChatGPT and Google’s Gemini, are trained on trillions of data points harvested from the open internet, inevitably including personal data.
In the EU, AI developers have largely relied on legitimate interest as the legal basis for processing personal data to train AI systems under the bloc’s privacy law. Under the GDPR, data processing must have one of six legal basis to be considered legal.
Last December, the European Data Protection Board, the body gathering EU data protection authorities, issued an opinion acknowledging legitimate interest as a possible basis for developing and deploying AI models.
However, the opinion included caveats and left key questions unresolved, including how to test whether personal data is needed for this purpose and whether a company’s aims outweigh users’ rights. This uncertainty has led to differing interpretations among national regulators, creating significant legal risk for the sector. Some regulators have openly questioned whether there is a legal basis under GDPR for AI model training, MLex understands.
To address these concerns, and under pressure from industry and EU governments, the commission’s digital policy department, DG CNECT, has proposed amendments to the GDPR that would recognize legitimate interest as the appropriate legal basis for developing AI technologies, MLex has learned.
If confirmed, the measure will be part of the “digital omnibus,” a set of targeted updates to EU digital laws that the commission plans to unveil on Nov. 19.
DG CNECT is leading the work on the omnibus, but the GDPR falls under the justice and consumer protection department, DG JUST. The proposal has been sent to interservice consultation, the process in which all commission departments are consulted. It typically takes two weeks but can be shortened in urgent cases.
Codifying legitimate interest as the appropriate legal basis for AI technologies has already been on the table in several technical meetings between the two commission departments, but more formal discussions are now ongoing since the proposal needs to be endorsed by DG JUST to go ahead, MLex has learned.
At the same time, using legitimate interest for AI training would not resolve all challenges for developers, as this legal basis cannot cover special categories of data, such as racial origin or religious beliefs, which are often captured in mass data harvesting.
One possible workaround would be to treat such sensitive information as a negligible residual category within much larger datasets. Other GDPR-related ideas under discussion for the omnibus include narrowing individuals’ right to ask how their personal data is being used, MLex understands.
Source: MLex / EDPB
Write a comment