The ICO has launched a consultation series on generative Artificial Intelligence, examining how aspects of data protection law should apply to the development and use of the technology.
Generative AI models are being used across the economy to create new content, from music to computer code. The first consultation examines when it is lawful to train generative AI models on personal data scraped from the web.
The ICO says that the fact that generative AI is developed and deployed in ways that are distinct from simpler AI models used for classification or prediction objectives raises new questions. These include:
- what is the appropriate lawful basis for training generative AI models?
- how does the purpose limitation principle play out in the context of generative AI development and deployment?
- what are the expectation around complying with the accuracy principle?
- what are the expectations in terms of complying with data subject rights?
Over the coming months, the ICO will share a series of chapters to outline its emerging thinking on how it will interpret specific requirements of UK GDPR and Part 2 of the DPA 2018 in relation to these questions.
The ICO will use the response to update its guidance on AI and other products. The first chapter relates to the lawful basis for web scraping to train generative AI models.
Developers using web scraped data to train generative AI models need to be able to:
- Evidence and identify a valid and clear interest
- Consider the balancing test (do individuals’ rights overrise the interest of the generative AI developer) particularly carefully when they do not or cannot exercise meaningful control over the use of the model.
- Demonstrate how the interest they have identified will be realised, and how the risks to individuals will be meaningfully mitigated, including their access to their information rights.
The consultation ends on 1 March 2024.
