Consent can be used as the basis of personal data processing both in the development and use of an AI system. An individual can give consent to processing their personal data for one or more purposes. Such consent must be a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to them.
The controller, meaning the organisation developing or using an AI system, must be able to prove that consent has been given as required by law. It must also be possible to withdraw consent for free at any time and as easily as it was given. After a data subject withdraws consent, the processing of the data processed based on the consent must be immediately stopped and the data erased. The implementation of the withdrawal of consent must be efficient in AI systems as well. If it cannot be implemented, for example, technologically, consent cannot be used as the processing basis.
The Data Protection Ombudsman stresses that choosing consent as the processing basis at the development stage of an AI system can be burdensome in terms of administrative work required, especially if personal data of a large group of people is processed.
Read more about the requirements for using consent as a basis
Contracts can be used as the basis of personal data processing both in the development and use of an AI system. When a natural person is party to a contract, personal data of the person can be processed if it is necessary for the performance of the contract.
Legal obligation can be used as a processing basis both in the development and use of AI systems if the personal data processing is necessary for compliance with a legal obligation to which the controller, or the organisation developing or using an AI system, is subject.
Protection of vital interests can be used as a processing basis in the development and use of AI system only if the processing is required in order to protect the vital interests of the data subjects or another natural person. For example, personal data processing may protect a vital interest in situations requiring humanitarian aid such as natural disasters or epidemics.
In order to meet this requirement, the danger to peoples’ lives must be sufficiently concrete, for example. This processing basis is therefore very rarely applicable.
Personal data can be processed in the development and use of AI systems if the processing is required for the public interest or the exercise of official authority vested in the controller. The public interest task or official authority must be vested by law or other legal provision. ‘Controller’ means the organisation developing or using an AI system.
Personal data can be processed in the development and use of AI systems if the processing is required for the purposes of a legitimate interest pursued by the controller or third party. ‘Controller’ means the organisation developing or using an AI system.
For example, a legitimate interest may exist when there is a meaningful relationship between the data subject and the controller. The relationship between an organisation and its customer is one example of such a relationship. However, personal data may not be processed if the interests and rights or the data subject override the legitimate interest of the organisation.
The European Data Protection Board has published guidelines on matters that must be taken into account when determining whether a legitimate interest exists.
The three stages of the determination are:
1. Identification and description of the legitimate interest. In order to use legitimate interest as a processing basis, all of the following must be met:
- The legitimate interest pursued is legal.
- The legitimate interest is clearly communicated and justified.
- The legitimate interest is real and exists (not based on an expectation).
2. Assessing the necessity of the planned personal data processing
- Do the planned processing activities promote achieving the legitimate interest?
- Are there alternative implementation methods that would require less personal data processing?
3. Determining whether the legitimate interest is overridden by the rights and freedoms of natural persons (‘balancing test’). The determination must be made on a case-by-case basis and the following must be taken into account in particular:
The risks to which the development and use of the AI system could expose the rights and freedoms of natural persons.
The effects that the personal data processing in the development and use of an AI system could have on the natural persons. There can be different types of effects and they can be positive or negative.
The nature of the personal data to be processed, the context of the processing activities, and the possible consequences of the processing to the natural person.
An organisation that plans to use legitimate interest as the basis for processing personal data in the development or use of an AI system should read the opinion of the EDPB (link directs to the EDPB website): Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models