CNIL launches new public consultation on practical guidelines for developing AI systems

On 10 June 2024, the CNIL initiated a second public consultation on the framework for developing AI systems, releasing a series of practical guides and a questionnaire to help professionals reconcile innovation with privacy rights. This consultation, open until 1 September 2024, aims to provide clear guidelines on how to develop AI systems in compliance with the General Data Protection Regulation (GDPR).

Context

The CNIL’s consultation follows initial recommendations published on 8 April 2024 (with the English translation published on 7 June – see my post on that here), which addressed the application of GDPR principles such as purpose limitation, data minimization, and storage duration to AI systems. These recommendations also covered scientific research rules, database reuse, and data protection impact assessments (DPIAs).

New Practical Sheets and Key Issues

The CNIL released seven new practical sheets for consultation:

1. Using the Legal Basis of Legitimate Interest in AI Development
2. Legitimate Interest: Open Source Model Distribution
3. Legitimate Interest: Web Scraping
4. Informing Data Subjects
5. Facilitating Data Subject Rights
6. Data Annotation
7. Ensuring AI System Safety

These sheets address important topics like the legal grounds for using personal data in AI, especially the frequently used legitimate interest basis, and offer concrete measures for compliance. They emphasize the need for rigorous oversight of data scraping practices and the importance of transparency and community collaboration in open-source AI development.

Public Consultation and Questionnaire

The consultation includes a questionnaire on GDPR application to AI models, focusing on whether AI models, which may retain training data, should be governed by GDPR. The CNIL seeks insights from AI suppliers, users, and other stakeholders to refine its future guidelines based on real-world risks and mitigation capabilities.

Stakeholder Participation and Timeline

The CNIL encourages a wide range of participants, including companies, researchers, academics, associations, and advisors, to contribute to the consultation. Contributions can be made individually or collectively, and participants are advised to review all relevant sheets before submitting responses.

The public consultation will close on 1 September 2024. After analysing the contributions, the CNIL will publish final recommendations on its website later in 2024, along with additional AI-related publications throughout the year.

👉 Read the press release here and the AI how-to sheets here (the new ones are at the bottom of the list, 8 to 12).

👉 The initial 7 AI How-To Sheets have been published in English, see my post here.