Navigating the EDPB's Latest Opinion on AI and Data Protection

The European Data Protection Board (EDPB) has unveiled its pivotal Opinion 28/2024 on AI and data protection, shedding light on some of the most pressing issues faced by developers, regulators, and Artificial Intelligence (AI) users. The Opinion delves deep into three core areas: the anonymity of AI models, the use of legitimate interest as a legal basis, and the implications of developing AI with unlawfully processed personal data. For Ukrainian companies operating in the AI sector, these findings are not just academic—they carry profound implications for compliance, innovation, and business continuity.

AI’s potential is transformative, but its risks can’t be ignored. The EDPB’s stance on anonymity is a reminder that the road to compliance requires more than intent; it demands robust, demonstrable action. Claims that an AI model does not process personal data must be substantiated with rigorous evidence. Supervisory authorities will scrutinize such assertions, considering risks like re-identification and membership inference attacks. This creates a high bar for developers: mere assertions won’t suffice. Companies must be prepared with documentation, technical audits, and state-of-the-art methodologies to protect data and themselves.

For Ukrainian companies, the challenge lies in meeting these standards and navigating a regulatory landscape that may seem foreign or overly complex. The stakes are particularly high given the cross-border nature of AI applications. A failure to demonstrate compliance in the EU could lead to reputational damage, operational setbacks, and severe legal consequences, including fines or orders to cease operations. At the same time, firms can build trust and credibility by adhering to these rigorous standards early on.

The EDPB’s discussion on legitimate interest further underscores the delicate balancing act that AI developers must perform. To rely on Article 6(1)(f) of the GDPR, companies must meet three stringent criteria: demonstrate a legitimate interest, prove that processing is necessary, and ensure it does not override the fundamental rights of data subjects. The Opinion’s emphasis on transparency, opt-out mechanisms, and robust risk assessments highlights the need for meticulous planning and execution. For companies using third-party data—often scraped from the web or acquired from brokers—the compliance hurdles are even steeper. Transparency isn’t just a legal obligation; it’s a trust-building exercise. Failure to meet these expectations risks alienating users and attracting regulatory scrutiny.

Developers should note the broader implications of this guidance. The AI industry is a crucible where technical ambition meets ethical and legal accountability. Imagine an AI model as a fine-tuned orchestra - even a single discordant note (such as unlawfully processed personal data) can fail the entire performance. The EDPB makes it clear: compliance lapses in the development phase can poison the whole lifecycle of an AI model, leading to potential demands for retraining, re-engineering, or even destruction. This serves as a stark warning but also an opportunity. By embedding compliance measures early and thoroughly, Ukrainian companies can position themselves as trustworthy partners in the global AI ecosystem.

The Opinion also casts a spotlight on the societal risks posed by AI, from discriminatory outcomes to the creation of deepfakes or the spread of misinformation. These issues resonate deeply in a world increasingly defined by digital influence. For AI-related businesses, which often grapple with resource constraints, understanding and mitigating these risks isn’t just about compliance - it’s about safeguarding the ethical integrity of their innovations. Mitigating measures like data masking, output filters, and transparency initiatives (e.g., model cards or annual AI audits) are not just best practices; they’re fast becoming industry norms.

The question is about meeting regulatory demands and defining their role in a world increasingly shaped by AI challenges that call for thoughtful adaptation and forward-thinking strategies.