Legitimate interest as a legal basis for training your AI is not res ipsa loquitur. It does not speak for itself.
In the age of AI, we often hear clients, and see privacy policies, refer to a “legitimate interest in the improvement of our product” as the legal basis for using input data to train AI models.
Recent guidance from the European Data Protection Board and European data protection supervisory authorities indicates that legitimate interest can, indeed, be a legal basis under the GDPR for developing or training an AI model.
But just saying so in a document does not make it a reality.
To rely on legitimate interest, you need to conduct and document a legitimate interest assessment. Based on the circumstances at hand, you need to be able to answer “yes” to each part of the following three-part test.
1. Is the interest actually legitimate?
This requires stating the interest with sufficient specificity, clarity and precision for the individual to understand it. “Improving our product” without any additional information may be too general.
The interest also must be lawful, and real and present rather than speculative. Developing a conversational agent to assist users, identifying fraudulent activity, or improving threat detection may qualify. But the specific interest still needs to be identified and assessed in the context of the particular AI model.
2. Do you really need to process this personal data?
Just like the conversation you have with your kids at the toy store, the fact that they want it and it would be great to have it, does not mean that they actually need it.
So too your processing and the use of the data.
The question here is whether the purpose could reasonably be achieved in a way that is less intrusive to the rights of individuals.
Could less data be used? Could anonymous or synthetic data be used? Could you exclude certain categories of information or certain sources? Could you apply technical measures that make individuals more difficult to identify?
The answers will depend on the model, the purpose, the data, and the relationship between the organization and the individuals involved.
3. What does this mean for the people whose data you are using?
Finally, you must weigh the organization’s interest against the interests, rights, and freedoms of the individuals and conclude that your interest is not overridden by them.
Consider the nature of the data, how it was obtained, how much data is involved, what the model will be able to do, and what could happen if personal data is reproduced, inferred, or extracted from it.
Reasonable expectations of the individuals of particular importance:
Would individuals expect the information they enter into a service to be used to train an AI model? Would they expect information they posted online for one purpose to be collected and used for another? What is the organization’s relationship with them, and what were they told when the data was collected?
Putting AI training in a privacy policy does not automatically make the processing reasonably expected.
In addition, you should consider what mitigating measures you can add to reduce the impact on people’s rights. These may include informing individuals, limiting the data used, filtering sensitive information, reducing identifiability, giving individuals an effective opportunity to object, honoring deletion requests, and testing whether the model can disclose information from its training data.
What to do now?
When wishing to use AI for training your models, opt-in consent or contractual necessity are often not viable as legal basis for training an AI model. Thus, per the recent guidance from the European Data Protection Board, at least when dealing with non-sensitive data, legitimate interest is not off the table.
However, but simply writing “we have a legitimate interest in improving our product” is does not manifest or magic a valid legal basis into reality. To do that, you need to test the proposed use against the particular purpose, data, model, individuals, risks, and safeguards involved and go through the three-part test prescribed by GDPR and the EDPB.