The alliance of national European privacy regulators, the European Data Protection Board (EDPB), recently adopted a joint opinion on the use of personal data to develop and use LLMs. This gives individual privacy regulators tools to conduct case-by-case analyses.
The EDPB ‘s now-released opinion came at the request of the Irish national regulator. The alliance of national EU privacy watchdogs started investigating this. Information was gathered from, among others, the EU AI Office.
The final opinion addresses several aspects. First, the question of when and in what way LLMs should be anonymous, whether and how a legitimate interest can be sufficient motivation for the development and use of LLMs, and what happens if personal data that have been unlawfully processed have been used in the development of an AI model. In addition, the opinion details the use of so-called first-party and third-party data.
Anonymity of LLMs
Regarding anonymity, the EDPB indicates that privacy regulators should consider whether an LLM is truly anonymous on a case-by-case basis. In doing so, the individuals whose data was used to create the LLM may not be directly or indirectly identifiable. In addition, the individuals whose data has been used must be able to request that the data be removed from the LLM again.
Legitimate interest and unlawful use
Regarding legitimate interest, the advice helps regulators and companies determine whether this interest is a basis for processing personal data in an LLM. This may be the case, for example, if AI is used to improve online security.
The advisory states here that this can only be done if the processing of the personal data is strictly necessary and a proper balancing of interests has occurred. In addition, individuals must have a reasonable expectation that their personal data will be used for this purpose.
Furthermore, the opinion addresses AI models developed with unlawfully processed personal data. In such a case, the use of the model is likely to be prohibited unless the model is properly anonymized.
Further research
Because of the rapid development, the EDPB is continuing to work on guidelines that will provide answers about more specific cases involving the use of personal data for LLMs. For example, regarding scraping of personal data by LLMs.
Also read: OpenAI fined and must better explain ChatGPT
Author :
Publish date : 2024-12-24 02:15:00
Copyright for syndicated content belongs to the linked Source.
The post EU declares when an LLM may use personal data first appeared on Love Europe.
—-
Author : love-europe
Publish date : 2024-12-24 14:50:13
Copyright for syndicated content belongs to the linked Source.