Legitimate interest as a legal basis for processing personal data in connection with the development and deployment of AI models

Although we may not realise it, the principle of AI technology is the processing of large amounts of data. A large part of the processed data is personal data of users. For the handling of personal data in the development of AI models, the rules set out for the processing of personal data under national legislation apply, as well as any obligations set out at EU level.

The processing of personal data is subject to relatively strict legal requirements, the general framework of which is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”). The key principles, on which data protection is based, are lawfulness, transparency, purpose limitation of purpose and data minimisation.

In light of these principles, personal data may only be processed on the basis of one of the six legal grounds set out in the GDPR. These are:

• consent of the data subject,
• the necessity of the processing for the performance of a contract,
• performance of a legal obligation,
• protection of vital interests,
• performance of a task in the public interest or in the exercise of public authority; and
• legitimate interest.

When training AI models, it is therefore essential to ensure that personal data are processed on the basis of a legal ground, which in most cases will be the legitimate interest of the relevant controller or third party. However, legitimate interest can only be used as a reason for processing if other conditions are met.

EDPB Opinion

The issue of data protection in the processing of personal data in AI models was recently addressed by the European Data Protection Board (“EDPB”) at the request of the Irish supervisory authority. In its opinion, the EDBP answered, inter alia, the question “How can controllers demonstrate the appropriateness of a legitimate interest as a legal basis in the stage of development and deployment of AI?”

The EDPB recalled that there is no hierarchy among the legal grounds for processing, i.e. no ground is more important or stronger than another. It is therefore left to the controller to choose the appropriate legal basis for processing for the specific situation. Where the processing is based on a legitimate interest, a three-step test must always be applied in accordance with the GDPR to assess (i) the existence of a legitimate interest of the controller, (ii) the necessity of the processing for the purposes of the interest pursued and (iii) the absence of overriding interests or fundamental rights and freedoms of the data subjects overriding the interests of the controller.

In the context of processing personal data for the purpose of developing AI models, a three-step test might look like this:

1. The existence of a legitimate interest pursued by the controller or a third party

Legitimate interest will be represented, for example, by the development of language models or data analysis algorithms that help improve customer support or automate processes. It may also involve using artificial intelligence to detect cyber threats, personalise content or automate decision-making processes.

2. Necessity of processing for the purposes of the legitimate interest pursued (the necessity test)

In particular, in the case of AI models, it will be necessary to investigate whether an alternative, in the form of anonymised or synthetic data, can be used for the purpose. However, these alternatives may not in all cases fully replace the need for processing of personal data (e.g. for personalisation models). If full anonymisation cannot be achieved, mitigating measures may be used to at least reduce the possibilities of identifying the data subject – for example, pseudonymisation, data minimisation or data aggregation.

3. Interests or fundamental rights and freedoms of data subjects overriding legitimate interests (balancing test)

In particular, the rights of data subjects to privacy and data protection and the legitimate interests of the controller in optimising services and achieving the purpose, for which the AI model was created, will be at odds in the context of the collection and processing of data by AI. As part of the balancing test, it is important to consider whether the interests and rights of the data subjects outweigh the interests of the controller or the third party – if this is the case, legitimate interest cannot be used as a legal ground for processing personal data.

The EDPB Opinion stresses that this part of the three-step test also needs to consider whether the reasonable expectations of data subjects are met, i.e. whether subjects can reasonably expect their personal data to be processed. For these purposes, it is appropriate to take into account whether the data processed were public, the nature of the service used and the context of the data collection. For example, supervisory authorities can be expected to assess whether a data subject uploads to the AI model database a document available from a public register or a link to a public social media profile, or whether it is non-public personal data, for example from a personal document.

Conclusion

The conclusions of the EDPB opinion suggest that the legal basis for the processing of personal data in connection with the development and implementation of AI models may be a legitimate interest, provided that all the conditions for its use are met. The controller must always be able to demonstrate having properly assessed the legitimate interest and the necessity of the processing under the three-step test and that the interests of the data subjects do not outweigh its own interests or those of a third party.