Topic: Communications & Technology, Artificial Intelligence Governance

EDPB Interprets Data Protection Aspects in AI Models

To start new 2025 year, DGKV Data Protection and AI Governance Team (Violetta Kunze, Ralitsa Gougleva and Anita Dangova) highlights the importance of Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models (“Opinion”) of the European Data Protection Board (“EDPB”) released on 17 December 2024.

The EDPB recognizes that the development and deployment of artificial intelligence (“AI”) models (“AI Models”) raise fundamental data protection questions and opines that, provided personal data processing is involved, AI Models shall be GDPR compliant. To this end, in the Opinion, the EDPB provides a framework for a data protection analysis and assessment of AI Models in the specific cases and stages of their development and deployment. Though addressed primarily to data protection supervisory authorities of EU Member States, in respect of certain data protection aspects in AI Models the Opinion provides valuable and helpful guidance to all stakeholders of the AI Act including businesses that operate AI Models or AI systems under the AI Act.

In the Opinion, the EDPB: 

  • discusses anonymity of AI Models from data protection perspective and sets out the applicable criteria that AI Models shall meet to be qualified as anonymous;
  • guides step by step on the applicability and appropriateness of the legitimate interest as a legal basis often relied upon for personal data processing in the context of AI Model development and deployment;
  • examines three scenarios concerning how unlawful personal data processing during the development of AI Models may affect the subsequent use and operation of the AI Models and in this relation, reviews the GDPR responsibilities of different operators in the AI Model lifecycle, and clarifies how these responsibilities vary depending on whether personal data used in the AI Model training is retained in the AI Models, whether a subsequent processing is conducted by the same or a different data controller, and on other factors;
  • delves into specific AI Model use cases, including AI for web scraping, blocking or recommending online content, pre-selection of job applications, and identification of harmful content online; and
  • flags the applicability of GDPR concepts and principles to responsible AI.

The Opinion sets a pivotal milestone in the intersection of privacy and AI governance. It further indicates that in 2025, AI governance and data protection will be among the hot topics of the business.

As heads-up, the EDPB is currently developing guidelines on more specific data protection questions relating AI, such as web scraping.

More news