Publicação
The legal ground of legitimate interest for the processing of personal data in Artificial Intelligence
| Resumo: | Artificial Intelligence technologies bring numerous risks and opportunities, impacting various social spheres. Data privacy, already a central issue before AI, has become even more relevant, in view of the increasing scale of personal data processing and the enormous impact that new technologies have on data subjects. The General Data Protection Regulation (GDPR), in force since 2026, aims to protect fundamental rights related to privacy, but its application in the context of AI faces challenges, requiring more guidance from the authorities. With the implementation of the AI ACT, new requirements are imposed on AI developers, complementing the GDPR in protecting the rights of people affected by these technologies. However, when it comes to data privacy, one of the challenges in the development of AI is a basic assumption of the GDPR: the legal ground for processing personal data. By exclusion, the Legitimate Interest has been commonly understood as the most appropriate legal bases to justify the processing of personal data for the development of AI systems. However, the requirements for the validity of the application of this lawful ground under the GDPR and according to the understanding of data protection authorities and scholars, are challenging to fulfill in the context of AI. The assessment of legitimate interest, in the terms guided by the Art. 29 Working Party and by data protection authorities such as the French CNIL and British ICO, must be stressed in a balancing exercise with the reasonable expectations of data subjects, their fundamental rights, the risks typical of machine learning systems and the methods used to form training databases. Thus, the question of the adequacy of the Legitimate Interest legal ground shall be scrutinized, which will require addressing, in addition to the legitimacy of the controller's interest, the proportionality between the intended benefits that require the processing of personal data and the impacts on the privacy of data subjects. |
|---|---|
| Autores principais: | Thais Candido Stutz Gomes |
| Assunto: | Machine Learning privacy Artificial Intelligence Data Protection Risks Lawful Use Legitimate Interest Assessment Legal Basis Fairness |
| Ano: | 2024 |
| País: | Portugal |
| Tipo de documento: | dissertação de mestrado |
| Tipo de acesso: | acesso restrito |
| Instituição associada: | Universidade Nova de Lisboa |
| Idioma: | inglês |
| Origem: | Repositório Institucional da UNL |
| Resumo: | Artificial Intelligence technologies bring numerous risks and opportunities, impacting various social spheres. Data privacy, already a central issue before AI, has become even more relevant, in view of the increasing scale of personal data processing and the enormous impact that new technologies have on data subjects. The General Data Protection Regulation (GDPR), in force since 2026, aims to protect fundamental rights related to privacy, but its application in the context of AI faces challenges, requiring more guidance from the authorities. With the implementation of the AI ACT, new requirements are imposed on AI developers, complementing the GDPR in protecting the rights of people affected by these technologies. However, when it comes to data privacy, one of the challenges in the development of AI is a basic assumption of the GDPR: the legal ground for processing personal data. By exclusion, the Legitimate Interest has been commonly understood as the most appropriate legal bases to justify the processing of personal data for the development of AI systems. However, the requirements for the validity of the application of this lawful ground under the GDPR and according to the understanding of data protection authorities and scholars, are challenging to fulfill in the context of AI. The assessment of legitimate interest, in the terms guided by the Art. 29 Working Party and by data protection authorities such as the French CNIL and British ICO, must be stressed in a balancing exercise with the reasonable expectations of data subjects, their fundamental rights, the risks typical of machine learning systems and the methods used to form training databases. Thus, the question of the adequacy of the Legitimate Interest legal ground shall be scrutinized, which will require addressing, in addition to the legitimacy of the controller's interest, the proportionality between the intended benefits that require the processing of personal data and the impacts on the privacy of data subjects. |
|---|