CNIL continues to promote AI that respects people's rights

On June 23, the data protection authorities of the G7 countries(Office of the Privacy Commissioner - Canada, Bundesbeauftragter für den Datenschutz und die Informationsfreiheit, BfDI (Federal Commission for Data Protection and Freedom of Information) - Germany, Garante per la Protezione dei Dati Personali (Authority for the Protection of Personal Data) - Italy, 個人情報保護委員会 (Commission de protection des informations personnelles) - Japan, Information Commissioner's Office - United Kingdom, Federal Trade Commission - United States) met in Tokyo They adopted a joint declaration and action plan on the subject of generative AI.

In this vein, the CNIL, questioned by economic players on the application of the RGPD to generative artificial intelligences, has applied itself to thinking about how to reconcile technological innovation and respect for people's rights.

Following the publication of its Artificial Intelligence Action Plan on May 16, on October 11 it published practical fact sheets designed to support players in the AI ecosystem in their approach to developing these tools, in compliance with existing regulations, and in particular with the RGPD.

These practical fact sheets, available here, provide a reminder of the existing rules, as well as case studies relating to AI learning databases. They cover the following topics:

- the legal regime applicable to the processing of personal data

- the definition of AI purposes

- The legal status of AI system suppliers

- Obligations to be met depending on how data is collected or reused

- conducting a data protection impact assessment

- Taking data protection into account from the outset of the thinking process and the design of the system

- virtuous data collection and management methods (minimizing the amount of data collected and the length of time it is retained)