AI training and its legal basis for the processing of Personal data; Between innovation and legal ambiguity

To date, most developers of generative AI systems (GAI) have relied on the legitimate interest legal basis to justify the processing of personal data for model training. This approach was met with skepticism by national data protection authorities in the EU, because the legitimate interest ground leaves considerable room for subjective interpretation. Still, currently engaged in a process of simplification of the European digital acquis, the European Commission proposed, in a digital omnibus, to extend the legitimate interest ground for the training of generative AI systems. This contentious choice raises questions, notably given the unprecedented scale of data processing in the context of GAI training. This presentation provides an overview of the legitimate interest legal basis for processing data, and addresses the main arguments that have been raised regarding the application of the legal basis to AI training. Hence the first part of the presentation covers the legitimate interest basis as articulated in the GDPR, and the reasons it is sometimes considered a “loophole”. The second part will focus on the relevant Omnibus changes and their broader implications for privacy and the digital sector.