Balancing AI Development and Privacy Compliance - An Analysis of the Principles of 'Complete Data Sets' in the AI Act and 'Data Minimization' in the GDPR

Sammanfattning

This thesis explores the relationship between two important legal principles in European Union law: the requirement for ‘complete data sets’ in Article 10 of the Artificial Intelligence Act (AI Act) and the principle of ‘data minimisation’ in Article 5(1)(c) of the General Data Protection Regulation (GDPR). The AI Act requires that high-risk AI systems be trained on data that is representative, accurate, and complete, in order to reduce bias and promote fairness. At the same time, the GDPR limits the collection and use of personal data to what is strictly necessary for a specific purpose. This difference creates tension when developing AI systems that depend on large and diverse datasets. The aim of the thesis is to clarify the legal scope and meaning of each of these two provisions, to examine the challenges that may arise when they are applied together, and to assess whether and how they can be aligned in practice. By using doctrinal legal research and drawing on academic literature, legal texts, regulatory guidance, and policy sources, the thesis finds that the two principles are not necessarily in conflict. Although they are based on different regulatory goals, they can be applied in a complementary way. A risk-based approach that uses privacy-preserving technologies, legal safeguards, and cooperation between regulators can help support both innovation in AI and compliance with fundamental rights.