Policymakers should consider how data protection law in Europe can be adapted to better support AI development in light of a new opinion issued by the European Data Protection Board (EDPB), experts have said.
Part of the opinion addressed whether data “‘absorbed’ in the parameters of the model” constitutes ‘personal data’ – a question central to whether the processing of that data is subject to the GDPR’s strict rules. The EDPB said it often will be.
“Even when an AI model has not been intentionally designed to produce information relating to an identified or identifiable natural person from the training data, information from the training dataset, including personal data, may still remain ‘absorbed’ in the parameters of the model, namely represented through mathematical objects,” the EDPB said. “They may differ from the original training data points, but may still retain the original information of those data, which may ultimately be extractable or otherwise obtained, directly or indirectly, from the model.”
“Whenever information relating to identified or identifiable individuals whose personal data was used to train the model may be obtained from an AI model with means reasonably likely to be used, it may be concluded that such a model is not anonymous,” it said.
The EDPB went on to outline what AI developers would need to do to demonstrate that their models are anonymous – and therefore outside of the GDPR’s scope.
In this regard, it said both the likelihood of data about a person used in the training of the model being extracted from the model and the likelihood of obtaining the data from running queries through that model, would need to be “insignificant for any data subject”. Likelihood must be determined “using reasonable means”.
The EDPB added that “a thorough evaluation of the likelihood of identification” is very likely to be needed before a conclusion on the anonymous nature of AI models can be reached. That evaluation, it said, should factor in, on an objective basis, “all the means reasonably likely to be used” by the controller or another person to identify individuals, and further consider any unintended use, reuse or disclosure of the model.
Andreas Carney
Partner
The conclusions the EDPB has reached risk adding to concerns AI developers have expressed recently about the European approach to data protection compliance potentially hampering AI innovation
Rauer said: “It is important to understand that AI systems generally do not rely on the raw training data being stored in the system itself. This is also true for personal data. The information AI systems build on – notably gen-AI – is stored in the form of meta data from which the answer to a prompted query is generated anew. The output might qualify as personal data, but it does not come ‘from the shelf’ but is rather generated by the algorithm.”
“The mere fact that an AI system is involved in processing personal data does not change the overall principles of data privacy. As underlined by the EDPB, the same underlying principles must be applied. What might change is the level of risk, and the difficulty in being transparent about the processing. AI is about learning and the exchange of data to allow for a learning curve, thus things get more complex,” he said.
Carney said: “The reasons for the EDPB’s opinion are understandable – it is applying established principles of data protection law to new technology. This is not surprising, but the conclusions it has reached risk adding to concerns AI developers have expressed recently about the European approach to data protection compliance potentially hampering AI innovation.”
“A more adaptable approach – one that evolves as understanding of the way AI works improves – would be welcome. Developments in AI are moving fast so this would need to happen quite quickly. Without it, there is a risk that investment in AI in Europe will reduce and the associated benefits of the technology – such as its potential to boost productivity and deliver improved health and social outcomes – will not be felt by businesses and people in Europe to the extent that they could be,” he said.
