DATA PROTECTION | The EDPB on personal data processing in AI models

On 17 December 2024, the European Data Protection Board (EDPB) adopted Opinion No. 28/2024 (the Opinion), which addresses some data protection issues in the context of AI models. The Opinion focuses on three main topics: the criteria for considering an AI model to be anonymous and therefore not subject to the GDPR, the conditions under which legitimate interest is a valid legal basis for data processing in the development and deployment of AI, and the consequences of the unlawful processing of personal data. The EDPB advises that local data protection authorities (DPAs) should assess the anonymity of AI models on a case-by-case basis, emphasising the need for a thorough assessment of the likelihood of personal data extraction and inference. In order to determine whether the processing of personal data can be based on legitimate interest, DPAs must verify that data controllers have applied and documented the “three-step test” set out in Guidelines No. 1/2024. This test requires an assessment of (a) the pursuit of a legitimate interest by the controller or a third party; (b) the necessity of the processing for the pursuit of that interest; and (c) that the legitimate interest is not overridden by the rights and freedoms of data subjects. In cases of unlawful processing, the EDPB emphasises that DPAs have the discretion to assess infringements and impose fines based on the specific circumstances of each case, and provides illustrative case scenarios as examples.

Newsletter n. 103 – January 2025