DAILY

AI and GDPR

Available Artificial intelligence

The AI Act leaves the GDPR untouched. As soon as an AI system processes personal data – in training, inputs or outputs – all GDPR principles and duties apply. This checklist gathers the points that typically remain open with AI, following the German DSK guidance and EDPB Opinion 28/2024.

Starting point

1. Does the AI system process personal data, whether in training data, inputs (prompts, documents) or outputs?

Under EDPB Opinion 28/2024, a model trained on personal data is not automatically anonymous.

EDPB Stellungnahme 28/2024
2. Does the system make solely automated decisions that produce legal effects concerning persons or similarly significantly affect them?

According to the CJEU, even a score can be such a decision if a third party draws strongly on it.

EuGH C-634/21 (SCHUFA)

Lawfulness

3. Is a legal basis under Art. 6 identified and documented for each phase – training, operation, use of outputs?
Art. 6 Abs. 1 DSGVO Open in the law texts
4. For special categories of personal data: does an exception under Art. 9(2) apply in addition?
Art. 9 Abs. 2 DSGVO Open in the law texts
5. For solely automated decisions: does an exception under Art. 22(2) apply, and do data subjects have the right to human intervention, to express their view and to contest the decision?
Art. 22 Abs. 2 und 3 DSGVO Open in the law texts

Principles

6. Is only the data necessary used in training and inputs, anonymised or pseudonymised where possible?
Art. 5 Abs. 1 lit. c, Art. 25 DSGVO Open in the law texts
7. Are outputs about persons checked for accuracy before they are used (hallucinations)?
Art. 5 Abs. 1 lit. d DSGVO Open in the law texts
8. Are data subjects informed about the AI processing, and for automated decisions also about the logic involved and its significance?
Art. 13 Abs. 2 lit. f, Art. 14 DSGVO Open in the law texts

Governance

9. Can access, rectification and erasure be implemented for data in training sets, histories and outputs as well?
Art. 15–17 DSGVO Open in the law texts
10. Has it been assessed whether a data protection impact assessment is required, and has it been carried out where needed?

AI-supported processing that steers interaction with data subjects is on the DSK must-list.

Art. 35 DSGVO Open in the law texts
11. For external AI services: is a processing agreement in place, and is the provider barred from using inputs for its own purposes such as training?
Art. 28 DSGVO Open in the law texts
12. For processing outside the EEA: is the transfer secured under Art. 44 et seq.?
Art. 44–49 DSGVO Open in the law texts
This result is not saved. With an account, assessments are stored with date and catalog version.
Menu
Preview · What this means
Dark paper