IA: Legitimate Interest as a Valid Legal Basis

IA: Legitimate Interest as a Valid Legal Basis

On October 9th, the European Data Protection Board (EDPB) published guidelines analyzing the criteria that any data controller must follow when relying on their legitimate interest, as defined by Article 6.1.f) of the GDPR, to carry out personal data processing.

Legitimate interest in artificial intelligence

Regarding its specific application in the field of Artificial Intelligence systems, the European Data Protection Board (EDPB) subsequently approved an opinion on the use of personal data for the development and implementation of AI models. This opinion was requested by the Irish Data Protection Authority (DPA), which, among other things, asked the EDPB to rule on the suitability of legitimate interest as a legal basis for the processing of personal data in the context of the development and deployment of AI models.

This opinion examines:

1. When and how AI models can be considered anonymous.
2. Whether (and how) legitimate interest can be used as a legal basis for developing or using AI models.
3. What happens if an AI model is developed using illegally processed personal data.

With respect to legitimate interest, the opinion offers general considerations that DPAs should take into account when assessing whether legitimate interest is an adequate legal basis for the processing of personal data for the development and implementation of AI models.

The EDPB recalls that the GDPR does not establish any hierarchy between the different legal bases established in Article 6 (1) of the GDPR. It also notes that Article 5 of the GDPR establishes the principles relating to the processing of personal data. The EDPB highlights those that are significant for this opinion and should at least be taken into account by the supervisory authorities when evaluating specific AI models.

It also specifies that, in order to determine whether a particular processing of personal data can be based on Article 6(1)(f) of the GDPR, supervisory authorities must verify that data controllers have carefully assessed and documented whether the following three cumulative conditions are met:

1. The pursuit of a legitimate interest by the controller or a third party.
2. The processing is necessary for the purposes of the legitimate interests pursued (necessity test).
3. The data subject’s interests or fundamental rights and freedoms are not overridden by the legitimate interest (balancing test).

Furthermore, and precisely regarding the balancing test, it is noted that the processing of personal data that takes place during the development and implementation of AI models can affect data subjects in different ways, which can be positive or negative. For example, if a processing activity entails benefits for the data subject, these can be taken into account in the balancing test.

Although the existence of such benefits may lead to the conclusion, by a supervisory authority, that the interests, rights and fundamental freedoms of data subjects do not override the interests of the controller or a third party, such a conclusion can only be the result of a case-by-case analysis that takes into account all appropriate factors. The impact of the processing on data subjects may be influenced by:

1. The nature of the data processed by the models.
2. The context of the processing.
3. The further consequences that the processing may have.

In relation to the development phase of AI models, several measures can be adopted to mitigate the risks posed by the processing of both own and third-party data (including to mitigate the risks related to scraping practices of websites). On the basis of the above, the EDPB offers some examples of measures that can be applied to mitigate the risks detected in the balancing test. Supervisory authorities should take these measures into account when evaluating specific AI models on a case-by-case basis.