Irish Data Protection Commission welcomes EDPB opinion on the use of personal data for the development and deployment of AI models

The Irish Data Protection (DPC) today welcomes the opinion issued by the European Data Protection Board (EDPB) on the use of personal data for the development and deployment of Artificial Intelligence ("AI") models. The opinion was sought by the DPC in September, with a view to gaining European-wide regulatory harmonisation and clarity on a number of key questions in a timely manner. The Article 64(2)¹ GDPR process was quickly triggered by the EDPB, in response to the DPC's request.

The DPC's request focused on four key issues:

(i) Under what circumstances may an AI Model be considered as 'anonymous'?;

(ii) How controllers may demonstrate the appropriateness of legitimate interest as a legal basis for personal data processing to create, update and/or develop an AI Model;

(iii) How controllers may demonstrate the appropriateness of legitimate interest as a legal basis for personal data processing to deploy an AI Model; and

(iv) What are the consequences of an unlawful processing of personal data in the development phase of an AI model on the subsequent processing or operation of the AI model?

This opinion provides guidance on all these issues, which will benefit Supervisory Authorities across the EU/EEA in regulating the responsible development of AI products, by providing a harmonised position for all Supervisory Authorities to take account of, as we continue to regulate in a proactive, effective and consistent manner.

The DPC would like to thank the EDPB Secretariat and our fellow EDPB members for their diligence and commitment throughout this process, a process that is a testament to the ongoing cooperation with our colleagues.

DPC Commissioner (Chairperson) Des Hogan commented:

"As the Lead Supervisory Authority of many of the world's largest tech companies, we have a deep awareness and understanding of the complexities associated with regulating the processing of personal data in an AI context. Equally, we recognise that the core questions concerning compliance with the GDPR in an AI context are EU-wide industry challenges and as such require a harmonised approach at EU level.

In having made this request for an opinion, the DPC triggered a discussion, in which we participated, that led to this agreement at EDPB level, on some of the core issues that arise in the context of processing personal data for the development and deployment of AI models, thereby bringing some much needed clarity to this complex area."

DPC Commissioner Dale Sunderland also stated:

"This opinion will enable proactive, effective and consistent regulation across the EU/EEA, giving greater clarity and guidance to industry, while also promoting responsible innovation. It will also support the DPC's engagement with companies developing new AI models before they launch on the EU market as well as the handling of the many AI related complaints that have been submitted to the DPC"

Further Information

1. Article 64(2) GDPR provides the mechanism by which a supervisory authority such as the DPC can request the EDPB to produce an opinion, setting out its views on any matter of general application or producing effects in more than one Member State.