Privacy and data protection law applied to AI
Privacy law applied to AI long before any AI-specific law. GDPR is the reference point for the exam.
GDPR principles in an AI context
- Lawful basis (Art. 6): needed for training data and for inference on personal data. Legitimate interest is often argued for training; consent is hard at scale.
- Purpose limitation: data collected for one purpose can't freely be reused to train an unrelated model.
- Data minimization: use only the personal data the purpose needs.
- Accuracy: inaccurate training data produces inaccurate outputs about people.
- Storage limitation: retention rules apply to training sets and logs.
- Transparency (Arts. 13–15): people must be told about automated decision-making and given meaningful information about the logic involved.
Article 22: automated decisions
People have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects (credit, hiring, benefits), unless it is necessary for a contract, authorized by law, or based on explicit consent. Even then they get safeguards: human intervention, the right to express their view, and the right to contest.
A human who rubber-stamps every output does not make the decision "not solely automated". Oversight must be meaningful.
Article 35: DPIA
A Data Protection Impact Assessment is required for processing likely to result in high risk. Systematic, extensive profiling with significant effects and new technologies such as AI commonly trigger it. A DPIA and an AI impact assessment are often combined.
Data subject rights and models
Access, rectification and erasure requests can reach training data. Removing one person's data from a trained model ("machine unlearning") is hard, which is a reason to minimize personal data before training. The EDPB's Opinion 28/2024 says a model trained on personal data is only anonymous if personal data can't be extracted or obtained from it with reasonable means.
Beyond GDPR
US state privacy laws (California's CCPA and its automated decision-making rules, and others) add rights to opt out of profiling and to receive notices about automated decision-making technology.
Check your understanding
Which safeguard does GDPR Art. 22 guarantee where solely automated decisions are allowed?
A company wants to train a churn model on customer service recordings collected 'to improve call quality'. Which GDPR principle is MOST at issue?