On 15 January 2024, the UK’s Information Commissioner’s Office (“ICO”) announced the launch of a consultation series (“Consultation”) on how elements of data protection law apply to the development and use of generative AI (“GenAI”). For the purposes of the Consultation, GenAI refers to “AI models that can create new content e.g., text, computer code, audio, music, images, and videos”.
As part of the Consultation, the ICO will publish a series of chapters over the coming months outlining their thinking on how the UK GDPR and Part 2 of the Data Protection Act 2018 apply to the development and use of GenAI. The first chapter, published in tandem with the Consultation’s announcement, covers the lawful basis, under UK data protection law, for web scraping of personal data to train GenAI models. Interested stakeholders are invited to provide feedback to the ICO by 1 March 2024.
The Lawful Basis for Scraping Personal Data
In its first chapter, the ICO acknowledges that legitimate interests, pursuant to Article 6(1)(f) of the UK GDPR, can be a lawful basis for using web-scraped personal data to train GenAI models. The ICO also notes that, as part of complying with the lawfulness principle of data protection law, developers need to ensure that their processing is not “in breach of any other legislation outside of data protection such as intellectual property or contract law.”
The Three-Part Test for Legitimate Interests
The ICO maintains that, in order for a GenAI model developer to rely on the legitimate interests lawful basis, it must pass the three-part legitimate interests test:
- Purpose test: GenAI model developers must first demonstrate a valid interest for processing web-scraped personal data. The ICO acknowledges that such an interest “could be the business interest in developing a model and deploying it for commercial gain, either on their own platform or bringing it into the market for third parties to procure” (e.g., offering a GenAI chatbot to consumers).
- Necessity test: Processing of web-scraped data must be necessary to achieve the interest identified in the purpose test. To this end, the ICO notes that, “currently, most generative AI training is only possible using the volume of data obtained though large-scale scraping”.
- Balancing test: If the first two limbs of the test are satisfied, the final step is to determine whether the interests, rights and freedoms of individuals override those pursued by the GenAI developer or third party. The ICO identifies two categories of potential risks that AI developers should balance against their own interests:
- Upstream risks: The ICO states that, if people are not aware that their personal data is being processed, they can lose control over that data by virtue of being unable to exercise their information rights (e.g., the right of access under Article 15 of the UK GDPR); and
- Downstream risks: According to the ICO, third parties can use GenAI models to generate inaccurate information about people which may result in reputational harm.
Additionally, the ICO notes that there are a number of risk mitigations that may help GenAI developers pass the third part of the legitimate interests test, including: (i) implementing technical and organisational controls over a specific deployment of a model; (ii) monitoring the use of the model (e.g., via API access); and (iii) specifying contractual controls with third parties that limit how the model is used.
Next Steps
Interested stakeholders are invited to provide feedback on the ICO’s first chapter by completing a survey or emailing the ICO by 1 March 2024. The ICO will use input received to update its guidance on AI and other related products.
The ICO also announced that, moving forward, it intends to produce additional chapters with analysis on topics including: (i) how the purpose limitation principle plays out in the context of GenAI development and deployment; (ii) expectations around complying with the accuracy principle; and (iii) expectations around complying with data subject rights.
***
Covington regularly advises the world’s top technology companies on their most challenging regulatory, compliance, and public policy issues in the UK, EU and other major markets. We are monitoring developments in AI policy and regulation closely and will be updating this site regularly – please watch this space for further updates.