Opinion
Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models
At the request of the Irish supervisor, the EDPB answers four questions on data protection law and AI models. A model trained on personal data is not automatically anonymous: supervisors test case-by-case whether direct or probabilistic extraction and obtaining personal data via prompts are negligible. The Opinion elaborates the three-step test for legitimate interest for the development and deployment phases, including reasonable expectations in web scraping and mitigating measures, and describes three scenarios in which unlawful processing during development carries through into subsequent use. Adopted 17 December 2024, published 18 December 2024.
What this means for you
Every Dutch organisation that trains, fine-tunes or purchases an AI model must be able to demonstrate with this Opinion on what data protection law basis that happens and whether the model may be regarded as anonymous.