Introduction to AI and GDPR
The French data protection authority, Conseil National de l’Informatique et des Libertés (CNIL), has published two new practical fact sheets designed to help actors developing AI systems comply with the General Data Protection Regulation (GDPR). These fact sheets focus on the use of legitimate interest as a legal basis for the development of AI systems and the collection of data through web scraping.
Background
The CNIL shares its recommendations on the use of legitimate interest as a legal basis for the development of AI systems. The fact sheets follow a public consultation and are part of a set of 10 practical AI fact sheets available on the CNIL website. They present solutions and methods illustrated by concrete examples to support stakeholders in understanding and implementing the recommendations.
Key Recommendations
The CNIL stresses that if the development of AI systems does not process personal data, the GDPR is not applicable. It also points out that other legal bases can be used to develop AI systems. The two new fact sheets provide an overview of the recommendations set out by the CNIL.
Sheet 8: Using the Legal Basis of Legitimate Interest to Develop an AI System
Legitimate interest can often serve as an appropriate legal basis for the development of AI systems by private entities. The CNIL points out that public entities should use this legal basis only when the AI system is developed for activities that are not strictly necessary to perform its specific missions. The use of legitimate interest as a legal basis for the development of AI systems requires compliance with three conditions:
- The interest pursued must be legitimate: Legitimacy can be understood broadly, subject to compliance with three cumulative criteria: the interest is manifestly lawful, determined clearly and precisely, and real and present for the organisation.
- Processing must be necessary: It implies that the data controller must ensure that no less intrusive means are available and that the processing is necessary to pursue the legitimate interest.
- The processing must not disproportionately affect the rights and freedoms of individuals: This condition requires the data controller to balance the rights and freedoms of the subjects, the benefits, and the impacts on individuals.
Sheet 8 Bis – Measures to be Taken When Collecting Data Through Web Scraping
Web scraping data accessible online is not prohibited, but additional measures must be taken and analysed individually, depending on the context. Web scraping is lawful only if a valid legal basis can be relied upon and certain conditions are met. The CNIL lists the measures that data controllers must implement when conducting web scraping, including:
- Clearly defining collection criteria
- Exclusion of certain categories of data from collection
- Exclusion of irrelevant data immediately after collection or as soon as it is identified as such
- Exclusion of websites that explicitly object to the web scraping of their content
Conclusion
The CNIL’s new fact sheets provide valuable guidance for actors developing AI systems to comply with the GDPR. By following the recommendations outlined in the fact sheets, data controllers can ensure that they are using legitimate interest as a legal basis for the development of AI systems and collecting data through web scraping in a lawful and transparent manner.
FAQs
Q: What is the purpose of the CNIL’s fact sheets?
A: The purpose of the CNIL’s fact sheets is to provide guidance for actors developing AI systems to comply with the GDPR.
Q: What are the three conditions for using legitimate interest as a legal basis for the development of AI systems?
A: The three conditions are: the interest pursued must be legitimate, processing must be necessary, and the processing must not disproportionately affect the rights and freedoms of individuals.
Q: What measures must data controllers implement when conducting web scraping?
A: Data controllers must implement measures such as clearly defining collection criteria, excluding certain categories of data from collection, and excluding irrelevant data immediately after collection or as soon as it is identified as such.
Q: Where can I find more information on the CNIL’s fact sheets?
A: You can find more information on the CNIL’s fact sheets on their website.
