The Brussels Privacy Hub invites you for a webinar, to be hosted online on 6 June 17:00 – 18:00 CET, titled ‘AI Training and Legal Basis: To Segment or Not to Segment Training and Deployment Phases?’. Registration is free but obligatory.
Data protection laws fully apply to Artificial Intelligence (AI) model development whenever the training data is personal, which is often the case. When training data is deemed personal, the subsequent question arises: does the AI developer (as a personal data controller) have a legal basis to process such data? This brings Article 6 of the GDPR to the forefront of the discussion, posing a fundamental ‘structural’ question: should the training phase be separated from the deployment phase for the purpose of determining the legal basis of the processing?
In its 2022 Clearview Decision, the French Data Protection Authority (CNIL) evaluated Clearview’s development practices and concluded that the company lacked a legal basis for engaging in such activities. To reach this conclusion, the CNIL considered Clearview’s ultimate goal: marketing the software to law enforcement authorities. Nonetheless, in its recent guidance on AI, the CNIL distinguishes between two phases: the learning phase and the production phase. This is done for the purpose of determining the processing purpose.
Does this imply that each phase could have its own distinct legal basis, and that the assessment of the deployment phase should have no bearing on the evaluation of the training phase? In a decision issued on March 15, 2024, the Belgian Data Protection Authority also made a distinction between the interim phase, i.e., the model-building phase, and the deployment phase. Is a consensus gradually emerging about how AI training should be approached for GDPR compliance?
The webinar will be moderated by BPH Co-director prof. Sophie Stalla-Bourdillon and will feature the following speakers:
Hielke Hijmans, GBA / APD (Belgian DPA)
Pablo Rodrigo Trigo Kramcsak, BPH
Member of the AI Department, CNIL