Commission Nationale de l’Informatique et des Libertés (CNIL) Publishes New Recommendations for Responsible Innovation in Artificial Intelligence (AI)
Recommendation 1: Informing Individuals
The obligation to inform data subjects stems from the principle of transparent processing (Article 12 of the GDPR) and applies to data collected both directly and indirectly. The data controller may be exempt from this obligation if providing information is not possible in practice or would require a disproportionate effort, or may only be required to provide general information.
The French data protection authority states that it is good practice to allow a reasonable period between collecting the information and training the model when the data collected is of a sensitive nature. This period would make it possible to guarantee the exercise of rights; failing to allocate time for this risks infringing users’ rights.
Regarding the provision of information, it must be concise, transparent, comprehensible, and accessible. The CNIL recommends that information be provided at multiple levels, with priority given to essential information at the first level. Such information may take the form of information provided to the data subject concerned or, by way of derogation from article 14.5 GDPR, general information. General information is permitted when the data subject has already been informed about the processing, or when providing information to the data subject would require disproportionate effort.
Examples of Good Practice and Recommendations on How to Inform Individuals about the Processing of Their Data
- When reusing a dataset or AI model subject to the GDPR, communicating the contact details of the initial data controller.
- When scraping data from websites or reusing scraped data, providing information about the sources or categories of sources used.
- When developing general-purpose AI models within the meaning of the AI Act, providing a summary of the content used for training.
Recommendation 2: Exercise of Rights
Two key facets of AI are highlighted in relation to the exercise of rights: training datasets and AI models that are subject to the GDPR.
Exercising Rights over Training Datasets
- Exercising rights over training datasets: The GDPR allows individuals to request any available information on the recipient of the data and its source. Even if the data controller is not required to store users’ data because it does not need, or no longer needs, to identify individuals, it must compile sufficient documentation on the sources of the training data to enable individuals to exercise their rights and demonstrate compliance with the GDPR.
Exercising Rights over Models Whose Processing is Subject to the GDPR
- The debate surrounding their anonymity is also addressed. It draws a distinction between cases where personal data is obviously present and those where the presence of personal data is yet to be determined.
Conclusion
The CNIL’s recommendations provide guidance on how to ensure that the development and use of AI models are consistent with the principles of the General Data Protection Regulation (GDPR). By following these recommendations, organizations can ensure that they are meeting their obligations under the GDPR and respecting the rights of individuals.
Frequently Asked Questions
- What are the key takeaways from the CNIL’s recommendations?
- The need to inform individuals about the processing of their data
- The need to respect the rights of individuals in relation to training datasets and AI models
- What are some examples of good practice and recommendations on how to inform individuals about the processing of their data?
- Providing information about the sources or categories of sources used when scraping data from websites or reusing scraped data
- Communicating the contact details of the initial data controller when reusing a dataset or AI model subject to the GDPR
- What are some examples of good practice and recommendations on how to exercise rights over training datasets and AI models?
- Providing information about the sources of the training data to enable individuals to exercise their rights and demonstrate compliance with the GDPR
- Compiling sufficient documentation on the sources of the training data to enable individuals to exercise their rights and demonstrate compliance with the GDPR
