Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models

What it covers

This Opinion, adopted under Article 64(2) GDPR at the request of the Irish supervisory authority, addresses when an AI model can be considered anonymous, how controllers can demonstrate the appropriateness of legitimate interest as a legal basis in the development and deployment phases of AI models, and the consequences of unlawful processing during development for subsequent processing or operation of the model.

Why it matters

It is the EDPB's central statement of general application on data protection aspects of AI model development and deployment, guiding how supervisory authorities assess anonymity claims and legitimate interest reliance for AI systems.

Refer to it when

• assessing whether an AI model qualifies as anonymous
• relying on legitimate interest to train or deploy an AI model
• evaluating risks arising from web scraping for AI training data
• determining the effect of unlawful data collection on a subsequently deployed AI model

Questions this document addresses

• When can an AI model be considered anonymous under the GDPR?
• How is the three-step legitimate interest test applied to AI model development and deployment?
• What mitigating measures can address risks in AI model development, including web scraping?
• What are the consequences of unlawful processing in the development phase for later use of the AI model?

Topics

• Artificial intelligence
• Lawful basis
• Supervisory authorities
• Enforcement