The German Data Protection Conference, the conference of independent data protection supervisory authorities at federal and state level, has published guidance on “Artificial intelligence and data protection” (Version 1.0 from May 6, 2024 – The fact that the guidance will be adapted in the future is explicitly mentioned).
The orientation guide (OH) focuses on Generative AI and primarily addresses the Responsiblewho want to use AI applications; other functions such as developers, manufacturers and providers are only indirectly affected.
The OH goes through the usual data protection requirements and distinguishes between the conception of the use and selection of AI applications, their implementation and their use. However, the explanations overlap; some of the information for the conception phase, for example, also relates to the use phase. The following points should be emphasized:
Concept phase
- The OH places the emphasis here on an examination of how and for what purpose the model is to be used – the OH is therefore primarily directed against flying blind, perhaps out of curiosity or the hope of vague advantages. As far as possible, data controllers should refrain from using personal data. However, because the concept of personal data is broad, data controllers cannot prematurely hope to fall outside the scope of data protection law.
- At LLMs the DSK points out that the processing of personal data can also lie in the fact that the model itself contains personal data. However, it remains unclear to what extent this should fall within the area of responsibility of the controller.
- With reference to the Training the controller must ask himself whether errors during training can have an impact on his own data processing.
- A separate Legal basis (the OH refers to a Paper from the Baden-Württemberg data protection authority) would be required if personal data is used for training purposes, even if the controller uses a third-party system that is further trained by input;
- Secret regulations may be applicable;
- Information and transparency obligations must be observed. Insofar as an automated individual decision is made, the controller must, among other things, provide information about the “Logic” of the decision inform. According to the OH, this means “explaining the method of data processing in relation to the functioning of the program sequence in connection with the specific application”. Visualizations and interactive techniques” can help to “break down the complexity of the logic to an understandable level”;
- Data subject rightsAn AI model must be able to correct incorrect personal data, e.g. through retraining or fine tuning. An output filter is not sufficient in itself for the right to erasure, but they are at least a “contribution”.
Implementation
For the implementation phase, the OH states the following, among other things:
- The third-party provider of the system is usually a processor. A joint responsibility can be considered, however, if
a AI application fed or trained with different data sets or on the platform of one body their AI application from other bodies further developed into new AI applications becomes. It is not necessary for the controller to actually have access to the processed data in order to be classified as a joint controller.
- The disclosure of personal data between joint controllers requires a separate legal basis, so this relationship is not privileged in this sense (which is also evident from the case law of the ECJ).
- At internal ratio, managers should set clear rules on how employees should or may use AI applications. In addition, employees should be provided with their own work devices and accounts for this purpose, with non-blocking accounts (e.g. a functional email address).
- For AI applications, a data protection impact assessment (DSFA) is necessary. The “black list” of the DSK also stipulates that a DPIA is mandatory when using AI to “control the interaction with the data subjects or to evaluate personal aspects of the data subject” if personal data is processed in the process (e.g. in the case of a sentiment analysis of a call center or a chatbot that “interacts with customers through conversation” and uses personal data for the consultation).
Use of AI applications
Among other things, data controllers should keep the input of personal data to a minimum. If a personal data is generated by an AI, this should also be a Legal basis is required, i.e. when the user assigns an output to a specific person. The OH example is a suggested player line-up for a football coach.
The results of the AI must then be checked for their Correctness be checked if they relate to individuals, and such results must not be not in a discriminatory manner can be used.