The interface between the world of artificial intelligence (AI) and the handling of personal data is considerable. Systems that learn independently, in particular, usually need to access extensive datasets. These systems are capable of making decisions independently, which, however, increases the risk to the personal rights and freedoms of the data subjects.
With the introduction of the General Data Protection Regulation (GDPR) in the EU, specific regulations have also come into force concerning the use of artificial intelligence. Consequently, the protection of personal data is an essential factor when using AI technologies. This applies entirely independently of the EU Parliament's current plans for AI regulation.
The most important points in brief
- In addition to many advantages, the use of artificial intelligence also harbors risks to the rights of data subjects.
- The scope of application of the GDPR is open as soon as personal data are processed by the AI.
- At best, all relevant personal data should be anonymized.
Data Protection Law Issues Related to Artificial Intelligence
A clear tension is emerging between the application of artificial intelligence and the requirements of data protection. The effectiveness of AI systems depends directly on the quality and scope of the data available. To develop advanced and powerful AI, the processing of large volumes of data is essential. This often involves the inclusion of personal information, the processing of which is regulated according to the strict provisions of the GDPR.
The significance of artificial intelligence and the importance of protecting personal data have increasingly gained attention in the recent past.
In the daily business world, many application scenarios are conceivable where AI-powered systems can be helpful. This includes customer support for automated responses to customer inquiries and providing information about products and services, content and draft generation, and virtual assistants that serve to optimize processes.
AI models undergo intensive training to become ready for deployment, often drawing on freely accessible data found on the internet. The risks should not be underestimated, as these data sources can be flawed or contain discriminatory content, which could potentially be reflected in the outputs produced by the AI. Furthermore, there is a possibility that the results generated by the AI may contain personal data, which is concerning from a data privacy perspective and can lead to legal difficulties for companies that do not comply with all the requirements of the General Data Protection Regulation (GDPR).
Tips for Businesses on Using Artificial Intelligence
For many, the question arises whether a data protection-compliant use of AI is even possible. The integration of Large Language Models (LLMs) like ChatGPT into corporate processes, for example, offers diverse opportunities, but also entails significant data protection obligations. Large Language Models are large generative AI language models that are pre-trained on vast amounts of text data.
To use this technology in compliance with data protection laws, companies should consider a few points.
First and foremost, a company must ensure that data processing by LLMs is lawful. This means that the processing of data has a legal framework, given for example by consents or statutory permissions.
Another essential step is to conclude a data processing agreement with the provider of the LLM. This agreement governs responsibilities regarding data protection in particular and should also include standard contractual clauses, if applicable, when data is transferred to third countries.
Before implementing an LLM, companies should conduct a Data Protection Impact Assessment (DPIA) and a Transfer Impact Assessment (TIA). These assessments serve to evaluate the risks of data processing and document appropriate measures for their minimization.
The use of the service must be made transparent in the company's privacy policy and documented in the record of processing activities to comply with transparency obligations.
Care must be taken not to disclose personal data when using LLMs. Therefore, company internal data must be anonymized before input.
In addition, adequate measures must be taken to ensure the security of data processing. For example, when using ChatGPT, it should be set so that the data cannot be used for training purposes.
This guide aims to help companies use LLMs like ChatGPT in a legally compliant and responsible manner. However, absolute legal certainty cannot be achieved. It is of utmost importance that these steps are implemented carefully to ensure the protection of personal data and to secure compliance with legal data protection requirements.
AI from the perspective of regulators
In the spring of 2023, the Italian Data Protection Authority (GPDP) OpenAI, the company responsible for ChatGPT, temporarily banned the processing of data from Italian citizens. The authority expressed concerns regarding the validity of the legal basis for processing personal data for algorithm training and criticized the incomplete fulfillment of information obligations. The incorrect handling of personal data by ChatGPT was also questioned.
Another problem was the lack of age verification, even though OpenAI's services are only accessible from the age of 13 according to the terms of use, which could lead to potentially age-inappropriate content for younger children.
ChatGPT is once again accessible to the Italian population after OpenAI has met the demands of the Italian Data Protection Authority: OpenAI had to provide a revised privacy policy on its website that informs about data processing and the rights of data subjects.
Likewise, the company may no longer cite contract performance (Art. 6(1)(b) GDPR) as a legal basis, but must instead rely on the consent of the data subjects or their legitimate interests. OpenAI has been ordered to implement procedures for data rectification and erasure, as well as for objecting to their use, for both ChatGPT users and non-users.
To protect minors, OpenAI must first verify the user's age and establish an age verification system by September 2023 that excludes minors under 13 and those between 13 and 18 without parental consent.
In Germany, the German Data Protection Conference (DSK) also established a special AI task force in April 2023, which is to deal with the topic of artificial intelligence.
As an initial measure, the German regulatory authorities established a Questionnaire to gain insights into the origin of the data and the algorithms underlying the automated processing. After the response deadline was already extended once, OpenAI is expected to submit its feedback. Based on this information, the German authorities plan to conduct a data protection analysis of ChatGPT.
Conclusion
It is expected that future legislative changes will occur to keep pace with the advancing integration of artificial intelligence. In political discussions, the focus is often on the dangers of particularly risky applications with far-reaching consequences and the regulation required because of them. However, AI also offers considerable practical advantages, such as the improvement and detection of cybersecurity threats. Furthermore, companies can benefit from increased efficiency in their processes through the use of artificial intelligence. Predicting how AI applications will develop is difficult, as many aspects are still unclear and will likely only be clarified with further technological advancements.
Although artificial intelligence is already used in numerous areas, it remains a field with significant development potential for the coming years, which should be carefully monitored.
Data protection plays a crucial role in the use of AI, and it will continue to be particularly important in the future. It is therefore recommended for companies to address necessary strategies and compliance early on to ensure the conformity of their AI systems, especially with data protection regulations.
„>