Legitimate Interest and Processing Personal Data in an AI Model

29/01/2025 - The rapid rise of Artificial Intelligence (AI) presents unprecedented opportunities for organisations. Consider advanced customer interactions, refined fraud detection, and the optimization of business processes. However, the use of AI also raises significant (ethical) questions, especially when personal data is processed. A critical question is: can your organisation process personal data when developing or using an AI model? In this blog, we delve deeper into this issue. 

The General Data Protection Regulation (GDPR) outlines principles that every processing of personal data must comply with, including data processing during the development and deployment of an AI model. One of these principles is that any processing of personal data must be based on a legal basis from Article 6 GDPR. 

Although consent is often used as a legal basis, it is not always practical. In the context of an AI model, it is often challenging to identify every individual whose data is processed and to obtain their consent. Legitimate interest is therefore the most applicable legal basis in such cases. In a recent opinion, the European Data Protection Board (EDPB) indicated that the legal basis of legitimate interest may be used by organisations under certain conditions when developing or deploying an AI model. This opinion builds upon the previously published EDPB Guidelines 1/2024 for processing personal data based on Article 6(1)(f) GDPR. 

Legitimate Interest: A Refresher 

To rely on legitimate interest as a legal basis, an organisation must meet the following three cumulative conditions (the "three-step test"): 

1. The organisation has an actual legitimate interest.
2. The processing of personal data is necessary for the legitimate interest.
3. The interests of the data subjects do not outweigh those of the organisation (balancing of interests). 

An organisation must carefully and thoroughly document in writing, prior to processing, that all three cumulative conditions are met. 

In its opinion, the EDPB provides several examples of legitimate interests in the context of AI models. Developing a chatbot to serve website users, a system to detect fraudulent content or behaviour, or improving the detection of security threats are considered legitimate interests.  

Balancing Interests: What Factors Should You Consider? 

The three-step test can be complex, particularly the balancing of interests. For this reason, we’ll explore this step in more detail. In its opinion, the EDPB outlines several factors that play a role in balancing interests in the context of AI models. An AI model can have both negative and positive effects on these factors: 

• The interests of the data subjects. This includes the right to control one's own personal data or financial interests.
• The rights and freedoms of the data subjects. These include the right to data protection, but also freedom of expression or the freedom to access information.
• The impact of processing on data subjects. This is determined, among other things, by the risks posed to data subjects by the development or deployment of the AI model.
• The reasonable expectations of data subjects. Data subjects should reasonably expect the processing of their personal data.  

The relationship between the controller (the organisation developing or using the AI model) and the data subjects affects these factors. This relationship is partly determined by the origin of the personal data, whether it is collected directly from the data subject or obtained from another source, such as purchased data or information scraped from the internet. 

If it is found that the interests and rights of the data subjects likely outweigh those of the controller, the controller can implement additional mitigating measures. These measures limit the (negative) impact of the AI model. Such measures go beyond the GDPR requirements and depend on the specific circumstances of the case. The EDPB mentions several examples: 

• Technical measures: Anonymize or pseudonymize personal data as much as possible. Exclude specific websites during scraping and ensure sensitive or special categories of personal data are not collected. 
• Strengthening data subject rights: Provide an opt-out system for processing personal data, allow individuals to delete their data from the AI model even if not required under the right to erasure (Article 17 GDPR), and offer data subjects the ability to object to processing in the case of scraping.
• Increasing transparency: Provide more information to data subjects and communicate through various (media) channels. This transparency goes beyond the requirements of Articles 13 and 14 of the GDPR. Simply mentioning the use of an AI model in a privacy statement is insufficient. 

Example: Developing a Chatbot 

An organisation wants to develop a chatbot to better serve their website users. The organisation develops the chatbot using scraping. This could involve craping the entire internet or a select number of specific websites. It poses significant challenges if the organisation chooses to scrape the entire internet. This involves processing personal data on a large scale and without differentiation. Moreover, it is virtually impossible to inform all data subjects about the use of their personal data. In such cases, very stringent additional measures are necessary. An alternative approach is to copy only a limited number of websites, such as the organisation’s own websites or an internal environment like the intranet. This approach makes it easier to inform data subjects and offer them the opportunity to object to the processing of their personal data. 

Conclusion 

Legitimate interest can serve as a legal basis for processing personal data when developing or deploying an AI model, but it requires careful consideration in advance. Failing to properly apply the three-step test may lead to the unlawful collection of personal data. This can result in reputational damage and possibly a fine from the supervisory authority. Do you need assistance with performing the three-step test? Feel free to contact Considerati.