| On December 17, the European Data Protection Board (EDPB) published an opinion on the use of personal data in the development and implementation of AI models. It addresses three key questions:When can an AI model be considered anonymous?Can legitimate interest be used as a legal basis for the use of AI?What are the consequences if an AI was developed with unlawfully processed data?The assessment of anonymity is particularly relevant: a model can only be considered anonymous, if the likelihood of direct extraction of personal data and the likelihood of obtaining such personal data from queries is insignificant. The Opinion lists a number of criteria that companies should consider in order to make a valid anonymity assessment. The question of legitimate interest as a legal basis for processing is also central. Here, the Opinion recommends a three-step test and emphasizes that the expectations of the data subjects regarding the data processing play an essential role, whereby both the information provided and the context of the processing are crucial. If an AI model has been developed with unlawfully processed personal data, this can have a significant impact on its use. Careful examination is also advisable for providers of AI models developed by other manufacturers. Only if proper anonymization can be demonstrated is there no longer any need to consider the data used in the development. For companies, this means an increased need to integrate data protection issues into their processes at an early stage and to legally examine the use of internal and external AI solutions. (Dr. Marian Klingebiel, UNVERZAGT Rechtsanwälte) |