The European Data Protection Supervisor (EDPS) has recently issued a comprehensive set of guidelines aimed at ensuring data protection compliance when using generative AI systems within EU institutions, bodies, offices, and agencies (EUIs). These guidelines, issued under the Regulation (EU) 2018/1725, offer practical advice for processing personal data while employing generative AI systems.
Key Highlights:
- Scope and Purpose
- The guidelines focus on practical advice for EUIs on processing personal data using generative AI systems, ensuring compliance with Regulation (EU) 2018/1725.
- They aim to cover as many scenarios as possible without prescribing specific technical measures, emphasizing the general principles of data protection.
- Definition and Applications of Generative AI
- Generative AI is defined as a subset of AI using machine learning models designed to produce a wide variety of outputs, including text, images, and audio.
- These systems rely on foundation models, such as large language models, which are trained on extensive datasets and can be fine-tuned for specific tasks.
- Use of Generative AI by EUIs
- EUIs can develop, deploy, and use generative AI systems for public services, provided they meet all legal requirements, especially data protection.
- The Regulation applies fully to any personal data processing activities, regardless of the technology used, and mandates clear accountability among the actors involved in the AI supply chain.
- Personal Data Processing
- Personal data processing can occur at various stages of the AI lifecycle, including data collection, training, and system interaction.
- EUIs must ensure that personal data processing is lawful, meeting at least one ground for lawfulness as per the Regulation, and ensuring compliance with data minimisation and accuracy principles.
- Role of Data Protection Officers (DPOs)
- DPOs are tasked with advising and assisting in compliance, ensuring the AI systems’ lifecycle processes align with data protection requirements.
- They must provide advice on data protection impact assessments (DPIAs) and ensure that all processes are properly documented and transparent.
- Data Protection Impact Assessments (DPIAs)
- DPIAs are mandatory for processing operations likely to pose high risks to individuals’ rights and freedoms, especially when new technologies are used.
- The assessment should involve regular monitoring and reviews to manage evolving risks throughout the AI system’s lifecycle.
- Ensuring Data Minimisation and Accuracy
- Data minimisation requires that only adequate, relevant, and necessary personal data are processed.
- Data accuracy must be maintained throughout the AI system’s lifecycle, with regular monitoring and validation of data used in training and outputs.
- Transparency and Individual Rights
- EUIs must inform individuals about personal data processing activities, providing comprehensive and up-to-date information.
- The exercise of individual rights, such as access, rectification, and erasure, should be facilitated, ensuring proper management and traceability of data.
- Automated Decision-Making
- The use of generative AI does not automatically imply automated decision-making within the Regulation’s meaning, but safeguards must be ensured for any automated decisions.
- EUIs must guarantee individuals’ rights to human intervention, to express their views, and to contest decisions.
- Addressing Bias and Fair Processing
- Generative AI systems can amplify biases, necessitating oversight and accountability to ensure fair processing and avoid discrimination.
- EUIs should implement measures to detect and mitigate bias, ensuring that AI systems are transparent, explainable, and auditable.
- Data Security
- Generative AI systems pose unique security risks, requiring tailored controls and continuous monitoring to mitigate potential vulnerabilities.
- EUIs should implement robust security measures, regular assessments, and training for staff to address evolving security threats.
Conclusion
These guidelines from the EDPS represent a critical step in ensuring that the deployment of generative AI systems by EUIs aligns with the stringent data protection standards established by Regulation (EU) 2018/1725. By adhering to these orientations, EUIs can leverage the benefits of generative AI while safeguarding individuals’ fundamental rights and freedoms.
For more detailed information, visit the EDPS website: EDPS Generative AI Guidelines.
This summary provides an overview of the key points from the EDPS guidelines on generative AI and personal data protection. As always, our firm remains committed to ensuring compliance with the latest data protection regulations and helping our clients navigate the complexities of integrating new technologies while safeguarding personal data. For any inquiries or further assistance, please feel free to contact us.