The EDPS has published the EDPS Orientations on “generative Artificial Intelligence and personal data protection” to provide EU institutions, bodies, offices and agencies (EUIs) with practical advice and instructions on the processing of personal data when using generative AI systems, to facilitate their compliance with the requirements of the data protection legal framework. These Orientations mark the first step towards more detailed guidance; they focus on the core data protection principles and the challenges posed by generative AI.
Generative Artificial Intelligence, like other new technologies, offers solutions in several fields to support and enhance human capabilities. However, this tool also poses challenges, with potential impact on fundamental rights and freedoms that run the risk of being unnoticed, overlooked, or not properly considered and addressed.
With the EDPS Orientations we aim to help EUIs achieve compliance with their data protection obligations under Regulation 2018/1725, by focusing on the core principles of data protection and the challenges posed by generative AI.
The EDPS Orientations are not intended to cover all relevant issues relating to the processing of personal data when using generative AI systems. Many of these questions are still open, and additional ones are likely to emerge as the use of these systems increases and the technology evolves to allow a better understanding of how generative AI works.
Because artificial intelligence technology evolves quickly, the specific tools and means used to provide these types of services are diverse and can change very quickly. Therefore, the Orientations have been drafted to be as technologically neutral as possible to stand the test of time.
The EDPS Orientations are a first step towards more detailed guidance that will take into account the evolution of Generative AI systems, their use by EUIsand the results of the EDPS’ monitoring and oversight activities.
The EDPS’ Orientations should be considered within the framework of its role as a data protection supervisory authority and not within its new role as AI supervisory authority under the AI Act.
Read the press release and download the orientations on “generative Artificial Intelligence and personal data protection”.