Brazil, French DPAs Show Trend Toward Privacy Pragmatism on AI Model Training
Data protection authorities (DPAs) are increasingly helping mold AI model training rules that also spur innovation, a Future of Privacy Forum (FPF) panel said at a June 27 webinar focused on developments in Brazil and France.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
ANPD, the Brazilian DPA, published a study in November on generative AI (GAI), noted Maria Badillo, FPF policy counsel for global privacy, who added that the report is preliminary, tracks emerging technologies and isn't guidance. The study appears to align with a global trend where DPAs analyze how AI influences data-protection rights, Badillo said. It notes the need to protect individuals as well as keep unnecessary burdens from slowing innovation.
That said, GAI is a challenge to data protection, said Badillo. The ANPD report highlighted three key concerns, she said: GAI relies on massive volumes of data, personal and non-personal, for training; technology could possibly make inferences and create data; and the possibility of creating more advanced AI models raises questions about data processing that's hard to track.
Personal data plays an intrinsic role in GAI, Badillo said. For one thing, AI is often trained on data scraped from different websites. ANPD's study reminds readers that processing personal data obtained from web-scraping must comply with privacy law, she said.
Whether sensitive personal data becomes usable when it's made public by a user is foremost in DPAs' minds, said Gabriela Zanfir-Fortuna, FPF vice president for global privacy. If the data is expressly made public, it can be processed, she argued. However, a definition of "manifestly made public" has been elusive so far, she said.
One perspective on that issue comes from European Court of Justice decisions on internet searches and the right to be forgotten, Zanfir-Fortuna said. For instance, the EU high court distinguished between searching for sensitive data and accidently stumbling on it, which doesn't require a legal basis for processing.
The key takeaway from those cases is that they might help confirm the basis for scraping personal data for AI, said FPF CEO Jules Polonetsky. The alternative would have meant "breaking search," he added.
The court's case law has since been expanded by, for example, French data protection authority CNIL, Zanfir-Fortuna said. In June, it published recommendations on legitimate interest for AI developers and web scrapers.
Economic interest is now recognized as a legitimate basis for processing personal data, said Polonetsky. In addition, CNIL has reinforced the perspective that AI can benefit society, a far more pragmatic approach to data-processing regulations, he said.
CNIL's recommendations specifically recognize that AI's benefits for society play a broader role in the assessment of the legal basis for data processing, said Zanfir-Fortuna. But it still requires a balancing test before using legitimate interest, she said.
The more beneficial the purpose of an AI system is, the more the balance tilts toward using legitimate interest rather than consent, she said. But CNIL doesn't offer an easy out, because its "very thoughtful" guidance also requires balancing the rights of individuals and training AI, Zanfir-Fortuna added.
The ANPD study stressed transparency and necessity in processing personal data for GAI, said Badillo. The regulator left a door open for the legitimate interest legal basis, she said. It stated that commercial interests must be balanced against individuals' reasonable expectations.