GDPR and AI

In depth

The principles

A few principles structure everything else, and they predate AI. Data is collected for a purpose determined in advance, which rules out collecting first and looking for a use afterwards; it rests on a lawful basis; it is limited to what the purpose requires; it is not kept indefinitely; and the data subjects know what is happening. What AI changes is not this list but the place where it bites. A training corpus, a prompt containing a customer file, an index of internal documents, a history of exchanges kept to improve the service: each is a processing operation, with its own purpose and its own retention period.

The two difficulties

Two points concentrate the difficulty. The first is reuse: data collected to perform a contract does not turn by itself into raw material for training, because that is a different purpose, and its compatibility with the first is examined rather than presumed. The second is the exercise of the rights of data subjects, straightforward on a database and much harder when the information has been diluted into the parameters of a model: erasing a record is one operation, unlearning is another. This is one of the reasons why architectures that keep personal data in a separate, consultable set, rather than absorbing it through training, simplify the questions that will have to be dealt with later. The technical choice carries a legal consequence here, and the reverse is true as well.

Automated decision-making

The regime pays particular attention to decisions taken with no human intervention when they produce significant effects on a person: what it seeks to preserve is the possibility of obtaining a review by someone, of expressing a point of view and of contesting. The practical difficulty is not placing a human in the loop, it is giving that person the means to weigh: an approval granted in a few seconds, with no access to the file and no room for manoeuvre, leaves the decision automated in fact, whatever box has been ticked. Two other reflexes head off most of the unpleasant surprises: knowing where the data goes when an external service is involved, since entrusting processing to a processor is planned for and framed, and checking what the provider retains and for what purpose, because retention to improve a service is a purpose distinct from providing the service. Finally, a data protection impact assessment takes on its full meaning here, not as a formality but as the moment when you state what the system can do to someone.