Data is typically added to an AI to explain a problem, situation, or request (“input data”). Some popular AI models refer to input data by the term “prompt” as the user is prompting the AI to initiate an action, or to create additional information. Prompts can take different forms such as text prompts or image
GDPR
Under the GDPR, what lawful purposes can an organization rely upon when processing personal information with an AI (i.e., putting personal information into an AI prompt)?
Data is typically added to an AI to explain a problem, situation, or request (“input data”). Some popular AI models refer to input data by the term “prompt” as the user is prompting the AI to initiate an action, or to create additional information. Prompts can take different forms such as text prompts or image…
If an organization transmits personal information to an AI as part of a ‘prompt’ what requirements does the GDPR impose?
Data is typically added to an AI to explain a problem, situation, or request (“input data”). Some AI providers, particularly those that provide natural language or large language models, refer to “prompts” as a subset of input data that describes the instructions that have been provided to the AI model (i.e., “please summarize the following…
Under the GDPR, are companies that transmit personal information to AIs as part of ‘prompts’ acting as controllers or processors?
Data is typically added to an AI to explain a problem, situation, or request (“input data”). Some AI providers, particularly those that provide natural language or large language models, refer to “prompts” as a subset of input data that describes the instructions that have been provided to the AI model (i.e., “please summarize the following…
Under the GDPR, does a company that uses personal information to train an AI need to allow individuals to request that their information be removed from the training data?
The GDPR allows individuals to request that their information be deleted in the following situations:[1]
- Companies must delete data upon request if the data was processed based solely on consent. The GDPR recognizes that companies may process data based on six alternate lawful grounds.[2] One of these is where a person has given
Under the GDPR, do organizations need to provide correction rights with regard to training data?
The right of correction (sometimes called the “right of rectification”) refers to a person’s ability to request that a company fix any inaccuracies in the personal data it holds about them.[1] Correction is sometimes referred to as an absolute right in the context of the GDPR, because unlike some other rights conferred by the…
Under the GDPR, is an organization required to distribute its privacy notice to every individual whose information is used to train an AI?
Under the GDPR controllers are required to provide information relating to what personal information they process, and how that processing takes place.[1] Data is typically needed to train and fine-tune modern artificial intelligence models. If that training data contains personal information, an organization is required to include a description of that processing in its…
Under the GDPR, what information should an organization that uses personal information to train an AI put in its privacy notice?
Under the GDPR, controllers are required to provide individuals with information relating to what personal information is processed, and how that processing takes place.[1] Some supervisory authorities have specifically taken the position that companies which use personal information to train an artificial intelligence (AI) must draft and publish a privacy notice that provides “data…
Under the GDPR, do organizations that use personal information to train an AI need to minimize the amount of time training data is retained?
The term “data minimization” generally refers to two requirements within the GDPR: (1) a company should only collect personal data that is “necessary” in relation to its purpose, and (2) a company should keep data for “no longer than is necessary for [that] purpose[].”[1] Put differently, a company should only collect what it needs…
Under the GDPR, what information should a company put in its record of processing if it is using personal information to train an AI?
Data is typically needed to train and fine-tune modern artificial intelligence models. AI can use data – including personal information – in order to recognize patterns and predict results.
Companies that utilize personal information to train an AI may either be acting as a controller or a processor depending on the degree of discretion they…