A deep dive into the EDPB’s Opinion on personal data processing in the context of AI models

Table of contents

• What issues did the Opinion address?
• Issue 1: when and how an AI model could be considered anonymous?
• Issue 2: the appropriateness of legitimate interests in the context of the development and deployment of AI models
• Step 1—demonstrating the existence of a legitimate interest by a controller or third party
• Step 2—evaluating the necessity of the processing to pursue the interest
• Step 3—balancing test
• Issue 3: the impact of unlawful data processing in an AI model’s development on the subsequent deploying/operating of the model
• What are the main practical takeaways?
• How might this Opinion impact on the adoption of AI going forward?

Article summary

EU law analysis: On 17 December 2024, the European Data Protection Board (EDPB) adopted Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models (the Opinion). In this News Analysis Alex Jameson of Bird & Bird considers the background to the Opinion and the key takeaways.