EDPB Releases Guidelines on AI Privacy Compliance

Brussels: The European Data Protection Board (EDPB) has issued its long-anticipated opinion on the use of personal data in the development of artificial intelligence models, providing detailed guidance on compliance with European privacy regulations. The opinion, requested by the Irish Data Protection Authority (DPA) and developed in consultation with the European AI Office, addresses critical issues surrounding anonymity, legitimate interest, and the reasonable expectations of individuals regarding data use.

According to Ansa News Agency, the EDPB’s opinion first examines the concept of anonymity in AI models. It clarifies that a model is considered anonymous if it is highly unlikely that individuals whose data were used to develop the model can be identified, either directly or indirectly, through queries. This distinction is crucial for developers seeking to ensure their AI models comply with privacy standards.

The opinion also explores the concept of legitimate interest as a legal basis for processing personal data in AI development. The EDPB outlines a three-step test to evaluate whether legitimate interest is an appropriate justification. This includes considerations on the necessity of data processing and the balance of rights between individuals and data controllers. Examples provided in the opinion include the use of conversational agents and AI for cybersecurity improvements, which can rely on legitimate interest if strict necessity and rights balancing are demonstrated.

The EDPB further offers criteria for assessing whether individuals can reasonably expect certain uses of their personal data. These criteria include the public availability of data, the relationship between the individual and the data controller, and the context of data collection. The opinion emphasizes that any AI model developed with unlawfully processed data could face legitimacy issues unless adequate anonymization measures have been taken.