首份生成式人工智能数据合规指南

0 03June2024 GenerativeAIandtheEUDPR. FirstEDPSOrientationsforensuringdataprotectioncompliancewhenusingGenerativeAIsystems. TheseEDPSOrientationsongenerativeArtificialIntelligence(generativeAI)andpersonaldataprotectionintendtoprovidepracticaladviceandinstructionstoEUinstitutions,bodies,officesandagencies(EUIs)ontheprocessingofpersonaldatawhenusinggenerativeAIsystems,tofacilitatetheircompliancewiththeirdataprotectionobligationsassetout,inparticular,inRegulation(EU)2018/1725.Theseorientationshavebeendraftedtocoverasmanyscenariosandapplicationsaspossibleanddonotprescribespecifictechnicalmeasures.Instead,theyputanemphasisonthegeneralprinciplesofdataprotectionthatshouldhelpEUIscomplywiththedataprotectionrequirementsaccordingtoRegulation(EU)2018/1725. TheseorientationsareafirststeptowardsmoredetailedguidancethatwilltakeintoaccounttheevolutionofGenerativeAIsystemsandtechnologies,theirusebyEUIs,andtheresultsoftheEDPS’monitoringandoversightactivities. TheEDPSissuestheseorientationsinitsroleasadataprotectionsupervisoryauthorityandnotinitsnewroleasAIsupervisoryauthorityundertheAIAct. TheseorientationsarewithoutprejudicetotheArtificialIntelligenceAct. Introductionandscope3 1.WhatisgenerativeAI?4 2.CanEUIsusegenerativeAI?6 3.HowtoknowiftheuseofagenerativeAIsysteminvolvespersonaldataprocessing?.7 4.WhatistheroleofDPOsintheprocessofdevelopmentordeploymentofgenerativeAIsystems?8 5.AnEUIwantstodeveloporimplementgenerativeAIsystems.WhenshouldaDPIAbecarriedout?9 6.Whenistheprocessingofpersonaldataduringthedesign,developmentandvalidationofgenerativeAIsystemslawful?11 7.HowcantheprincipleofdataminimisationbeguaranteedwhenusinggenerativeAIsystems?14 8.AregenerativeAIsystemsrespectfulofthedataaccuracyprinciple?15 9.HowtoinformindividualsabouttheprocessingofpersonaldatawhenEUIsuse generativeAIsystems?17 10.WhataboutautomateddecisionswithinthemeaningofArticle24oftheRegulation? .............................................................................................................................................18 11.HowcanfairprocessingbeensuredandavoidbiaswhenusinggenerativeAIsystems?20 12.Whatabouttheexerciseofindividualrights?22 13.Whataboutdatasecurity?23 14.Doyouwanttoknowmore?25 Introductionandscope 1.TheseorientationsareintendedtoprovidesomepracticaladvicetotheEUinstitutions,bodies,officesandagencies(EUIs)ontheprocessingofpersonaldataintheiruseofgenerativeAIsystems,toensurethattheycomplywiththeirdataprotectionobligationsinparticularassetoutintheRegulation(EU)2018/1725(‘theRegulation’,orEUDPR).EveniftheRegulationdoesnotexplicitlymentiontheconceptofArtificialIntelligence(AI),therightinterpretationandapplicationofthedataprotectionprinciplesisessentialtoachieveabeneficialuseofthesesystemsthatdoesnotharmindividuals’fundamentalrightsandfreedoms. 2.TheEDPSissuestheseorientationsinhisroleasadataprotectionsupervisoryauthorityandnotinhisnewroleasAIsupervisoryauthorityundertheAIAct. 3.TheseorientationsdonotaimtocoverinfulldetailalltherelevantquestionsrelatedtotheprocessingofpersonaldataintheuseofgenerativeAIsystemsthataresubjecttoanalysisbydataprotectionauthorities.Someofthesequestionsarestillopen,andadditionalonesarelikelytoariseastheuseofthesesystemsincreasesandthetechnologyevolvesinawaythatallowsabetterunderstandingonhowgenerativeAIworks. 4.Becauseartificialintelligencetechnologyevolvesquickly,thespecifictoolsandmeansusedtoprovidethesetypesofservicesarediverseandtheymaychangeveryquickly.Therefore,theseorientationsorientationshavebeendraftedtocoverasmanyscenariosandapplicationsaspossible. 5.Theseorientationsarestructuredasfollows:keyquestions,followedbyinitialresponsesalongwithsomepreliminaryconclusions,andfurtherclarificationsorexamples. 6.Theseinitialorientationsserveasapreliminarysteptowardsthedevelopmentofmorecomprehensiveguidance.Overtime,theseorientationswillbeupdated,refinedandexpandedtoaddressfurtherelementsneededtosupportEUIsinthedevelopmentandimplementationofthesesystems.Suchanupdateshouldtakeplacenolaterthantwelvemonthsafterthepublicationofthisdocument. 1.WhatisgenerativeAI? GenerativeAIisasubsetofAIthatusesspecialisedmachinelearningmodelsdesignedtoproduceawideandgeneralvarietyofoutputs,capableofarangeoftasksandapplications,suchasgeneratingtext,imageoraudio.Concretely,itreliesontheuseoftheso-calledfoundationmodels,whichserveasbaselinemodelsforothergenerativeAIsystemsthatwillbe‘fine-tuned’fromthem. Afoundationmodelservesasthecorearchitectureorbaseuponwhichother,morespecialisedmodels,arebuilt.Thesemodelsaretrainedonthebasisofdiverseandextensivedatasets,includingthosecontainingpubliclyavailableinformation.Theycanrepresentcomplexstructureslikeimages,audio,videoorlanguageandcanbefine-tunedforspecifictasksorapplications. Largelanguagemodelsareaspecifictypeoffoundationmodeltrainedonmassiveamountsoftextdata(frommillionstobillionsofwords)thatcangeneratenaturallanguageresponsestoawiderangeofinputsbasedonpatternsandrelationshipsbetweenwordsandphrases.ThisvastamountoftextusedtotrainthemodelmaybetakenfromtheInternet,books,andothe