Proposed GDPR Changes May Ease AI Data Processing
Proposed changes to the EU's GDPR and AI Act could recognize AI development and operation as legitimate grounds for processing personal data. However, legal analysts expect that requirements for bias detection and risk controls will likely be expanded. The move signals an attempt by regulators to clarify the legal basis for AI data use while simultaneously strengthening safeguards.
- The proposed changes are part of the European Commission's "Digital Omnibus Package," which seeks to clarify how personal data can be processed for AI development across the EU. - A key proposal would recognize AI development and operation as a potential "legitimate interest" under GDPR, which would still be subject to a balancing test and require safeguards like data minimization and a right for users to object. - The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) acknowledge that legitimate interest can be a legal basis for AI training but question if a new, specific article in the GDPR is necessary, as it's already possible under existing rules. - To address bias, the proposals would expand rules allowing the use of sensitive data for bias detection beyond just high-risk AI systems, subject to strict conditions and technical protections. - The AI Act and GDPR have different regulatory approaches—the AI Act is product safety legislation based on risk, while GDPR focuses on fundamental rights, which could lead to conflicting compliance outcomes. - The amendments also propose a new legal ground for processing sensitive data when its removal is not feasible without disproportionate effort, provided strict technical protections are in place. - The AI Act itself requires providers of high-risk AI systems to implement extensive data governance practices, including examining training data for biases and taking measures to mitigate them. - The timeline for some AI Act compliance requirements for high-risk systems, originally set for August 2026, may be extended until as late as December 2027 because the necessary implementation standards are behind schedule.
