The EDPB Opinion on training AI models using personal data and recent Garante fine – lawful deployment of LLMs

Published on January 4th, 2025

Introduction

Artificial intelligence (AI) continues to transform industries, offering immense opportunities for innovation. However, the ethical and lawful use of personal data for training AI models has become a critical concern. The European Data Protection Board (EDPB) recently issued an opinion highlighting the legal boundaries for training AI with personal data. Additionally, a notable fine imposed by the Italian Data Protection Authority (Garante) has sparked discussions on compliance requirements for deploying large language models (LLMs). This article explores these developments and their implications for organizations utilizing AI technologies.

The EDPB’s Opinion on Using Personal Data for AI Training

The EDPB emphasizes that processing personal data for AI model training must adhere to the principles of the General Data Protection Regulation (GDPR). Key considerations include:

1. Lawful Basis for Processing: Organizations must identify a valid legal basis, such as consent or legitimate interest, for using personal data in AI training.
2. Purpose Limitation: Personal data should only be processed for specific and explicitly stated purposes. Training AI for general use may violate this principle.
3. Data Minimization: Only the data strictly necessary for training should be used, reducing risks of excessive or irrelevant processing.

These principles guide organizations in ensuring their AI development practices align with GDPR requirements.

The Garante Fine: A Warning to Non-Compliant AI Deployments

The Italian Garante imposed a significant fine on a company for failing to comply with data protection laws in deploying its AI system. This case underlines critical compliance failures, including:

• Transparency Issues: Lack of clear communication about how personal data was used for training.
• User Rights Violations: Inadequate mechanisms for data subjects to access, rectify, or delete their data.
• Security Lapses: Insufficient safeguards to protect data against unauthorized access or misuse.

This enforcement action highlights the regulatory risks associated with non-compliance and the importance of robust data protection practices.

Key Considerations for Lawful LLM Deployment

To deploy LLMs lawfully while maintaining user trust, organizations should consider the following:

1. Implement Privacy by Design: Integrate data protection measures at every stage of AI development.
2. Conduct Data Protection Impact Assessments (DPIAs): Identify potential risks and take corrective actions before deployment.
3. Ensure Transparency: Clearly communicate data usage policies to users and provide tools for exercising their rights.
4. Monitor Compliance: Regularly review AI practices to ensure alignment with evolving legal standards.

Adopting these measures can help mitigate regulatory risks and foster ethical AI practices.

Conclusion

The EDPB opinion and the Garante fine serve as critical reminders of the legal and ethical challenges in AI model training. Organizations must navigate complex data protection laws while leveraging AI technologies responsibly. By adhering to GDPR principles and implementing strong compliance measures, businesses can lawfully deploy LLMs and build trust with their users, paving the way for sustainable AI innovation.