EDPB Opinion 28/2024, published on December 17, 2024, addresses issues relating to the protection of personal data in the context of Artificial Intelligence (AI) models.
The review focuses on three questions posed by the Irish Data Protection Authority:
- When and how can an AI model be considered “anonymous”?
- How can data controllers demonstrate the adequacy of legitimate interest as a legal basis in the development and deployment phases of AI models?
- What are the consequences of unlawful processing of personal data in the development phase of an AI model on the subsequent processing or operation of the model itself?
The EDPB’s analysis is systematic and normative; although not exhaustive for all possible scenarios, it provides a general framework and interpretative considerations for supervisory authorities. The opinion is based on a wide range of official sources: Regulation (EU) 2016/679 (GDPR) and its recitals, measures of the Article 29 Working Party (WPArt29), EDPB guidelines (in particular those on legitimate interest), and the established case law of the Court of Justice of the European Union (CJEU). Relevant scientific research on attacks on AI models and the AI Act are also mentioned.
