Balancing Innovation and Data Protection - An analysis of legal basis under the GDPR for the training of artificial intelligence

Sammanfattning

This master thesis investigates the legal foundations for training of artificial intelligence (AI) models using personal data, with an emphasis on compliance with the European Union’s General Data Protection Regulation (GDPR). The core issue addressed is the lack of clear legal basis for AI training processes that involve the collection and use of personal data (gathered directly or indirectly through web scraping, data brokers, and other means), which can result in unlawful practices and infringements of data subjects’ rights. AI systems, in general, and the training phase in particular, is first described from a legal perspective. Current academic works related to the topic is then reviewed, and all relevant provisions, which can be considered as legal bases, have been analysed in detail, especially Article 6(1) of GDPR. The study further examines specific approaches in various countries, along with established case law, to provide a clear view of the status quo. The relevance and applicability of current regulations as legal basis for AI training have been thoroughly examined, and potential weak points have been identified and presented as a guideline. The thesis concludes with recommendations for establishing a framework to ensure regulatory compliance and consistency between supervisory authorities and the development of AI systems.