AI Memorisation and Anonymisation under the GDPR
// SPECIAL MENTION
download pdf
This paper examines the extent to which the General Data Protection Regulation (GDPR) applies to artificial intelligence (AI) models in light of the inherent memorisation of data during their training. Central to this inquiry is the concept of anonymisation and whether it should be assessed under an “objective” standard, requiring irreversibility for any party, or a “subjective” one, dependent on the means reasonably available to a specific controller.
We do so to demonstrate that using an objective standard of anonymisation to AI models would render them subject to the GDPR, regardless of best measures adopted by developers. If anonymisation is interpreted that way, then developers are met with the impossible choice of, either, adopting privacy-preserving techniques to anonymise data but make it lose its utility or degrade the model in the process, or conform themselves to have their model subject to the GDPR and run the risk of being confronted with the situation of i.e. having to fulfil data subject rights when they cannot, themselves, extract personal data stored in the model. We argue instead for a contextual, subjective assessment of identifiability: if specific third parties that have access to the model lack reasonable means to access memorised personal data, the model should be regarded as anonymised to them.
We argue instead for a contextual, subjective assessment of identifiability: if specific third parties that have access to the model lack reasonable means to access memorised personal data, the model should be regarded as anonymised to them.
