When does data protection regulation apply to the use of artificial intelligence?
"Personal data" and "processing"
The Data Protection Act applies to the electronic processing of personal data.
The law is technically neutral and should therefore cover all technologies used to process personal data, such as with artificial intelligence programs.
It should be noted that the data protection laws are not challenged if the artificial intelligence processes completely non-personal identifiable data.
The data protection rules are mainly tested when using artificial intelligence in the following situations:
personal data is collected, entered into a computer system and used to train the artificial intelligence
One example of this is the use of OpenAI on five different databases to train ChatGPT. One of these databases collected data from social media platforms, such as Reddit, Youtube, Facebook, TikTok, Snapchat and Instagram without the user’s consent.
The technology companies say they have used data that has been publicly published on the internet and that they are necessary for training grammar models.
This is where the issues arising concerning whether data from the Internet – for example from Facebook – can be used to train artificial intelligence without the people concerned being aware of or having agreed to such use of the information.
The rules can also be challenged when the AI is charged with making automated decisions about the rights and obligations of individuals, see here more on such decisions.
