While we spend all day with the word “AI” in our faces, there are applications and services in Europe that the Union has slammed the door on. However, a proposal to reform the GDPR (General Data Protection Regulation) would allow these companies to train and operate models with personal data without seeking permission from each individual.
For this, they will be able to invoke a ‘superpower’ called “legitimate interest” and, although some Big Tech must be rubbing their hands already, the proposal is not yet law. Let’s see what this is about.
In short. On 21 October, a committee called CORPER, which brings together ambassadors from member states, agreed on the position of the European Council on the position with which the European Parliament will negotiate the Digital Omnibus (a simplification package for digital standards). The Council published a 179-page document in which it sets out changes to this European data protection regulation, the e-Privacy Directive that governs cookies, the Data Regulation and the NIS2 Cyber Security Directive.
One of the objectives of these changes (as stated in the document and as we read in the IAPP) is to streamline the training of artificial intelligence models, allowing companies to use personal data based on a legitimate interest because AI has become not only a technical issue, but also a geopolitical issue in which the European Union cannot be left behind.
What the law says so far. The GDPR does not explicitly mention AI, but in its current version it provides legal grounds for processing personal data without consent, including “legitimate interests” reiterated in the Council document. A company can use data if it has a legitimate interest and the individual’s rights do not override it. It forces a case-by-case weight, and that weight is a point of friction between AI companies and privacy advocates.
Personal data is information about an identified or identifiable individual and GDPR prohibits the processing of sensitive data (health, ethnic origin or similar) with certain exceptions. Anyone can object to processing based on legitimate interests, and there are cases such as the re-use of user data for scientific research that is already considered compatible with the main purpose of protecting the user’s rights. In this case, measures must be put in place so that these rights are not violated.
What do you want to happen?. If the Council’s text goes ahead, a company will be able to develop and operate AI models with personal data based on its legitimate interests or without the consent of third parties. It needs to be clarified that GDPR today does not require consent if there is a legitimate interest. The novelty is that it will be clearly written for AI (new article 88 bis) and the limit is cut. On page 145, the Council went beyond the safeguards that the Commission had added: the right of unconditional opposition and clear exceptions for minors and laws requiring consent.
“These measures will reduce compliance costs and boost competition and innovation” – Thomas Byrne, Ireland’s Minister of State for European Affairs and Defense
Furthermore, a new exception will allow incidental and residual processing of previously disclosed sensitive data during system development and technical operations if the company does not wish to collect it. If this data slips through without the company intending to collect it, it must be avoided, deleted as soon as it is detected, and protected. It does not cover data that users provide directly, such as what they type into a chatbot, or intentional use, such as voice or images.
The Council intends to facilitate scientific research, including by private organizations for commercial purposes, as long as it is autonomous and independent and the company justifies in each case that it is so and its results are verifiable and transparent. And it proposes that pseudonymized data, in which the individual’s identity has been separated, will be excluded from the personal data of third parties who receive them if they cannot identify anyone. If you can, they are still subject to GDPR.
What’s coming now?. While we’ve already seen some messages on Twitter suggesting that this is a change in the law, a European move or EU regulators have approved changes to the GDPR, it’s still a proposal and there’s still a way to go and negotiations.
In fact, everything remains to be defined, since the Council, the European Commission and the European Parliament (which does not yet have a position) have to discuss any of these proposed changes and there is not much time. EC has asked to close all pending buses before the end of this year, and there are not many left.
Of course, we should not confuse this proposed reform with the AI Act, the European AI law, because it goes the other way.
Picture | Council of Europe
In Xataka | The Spanish government reverses course: It softens data center regulations so as not to scare off AI companies
