AI model training: consent or legitimate interest? Guidance on choosing the most appropriate legal basis

Abstract

ChatGPT, Gemini, CoPilot are just some among the most talked-about examples of large generative AI models whose functioning relies on algorithms trained by means of large amounts of data. Acknowledging that such data may also include “information relating to an identified or identifiable natural person”, AI developers should then address the issue of the compliance of such models with personal data protection legislation. In this regard, this article seeks to identify, from an accountability perspective, the most appropriate legal basis for the collection and processing of personal data for AI training purposes. Specifically, after noting that - except in very limited cases - the choice should narrow between the prior consent of data subjects and a legitimate interest pursued by the controller or a third party, the article will first explore the pitfalls of a consent-only approach which indeed risks making data processing extremely burdensome for controllers. Next, the article will deal with the possibility of recognising and accepting legitimate interest as an appropriate legal basis for the pursuit of algorithm training purposes, through the implementation of sophisticated mitigation measures that can make the use of this basis as safe as possible for data subjects. Finally, assuming that legitimate interest can be used as a legal basis for algorithm training purposes, the article suggests overcoming the separation between the AI model development and deployment stages in order to choose the most appropriate legal basis between consent and legitimate interest.