Data Protection Advice for AI Deployments

When your client deploys an AI system that processes personal data, data protection law applies. The UK General Data Protection Regulation (GDPR), UK Data Protection Act 2018, and EU GDPR create specific obligations for organisations that use data to train, operate or test AI systems.

The first obligation is lawful basis. Processing personal data requires a lawful basis under Article 6 of UK GDPR. The common bases are consent, contract performance, legal obligation and legitimate interests. Many organisations process personal data for AI without identifying a lawful basis. They assume that processing is acceptable because the data is “for AI purposes”. This is wrong. There must be a specific lawful basis for each processing activity.

If training an AI system on customer data, the lawful basis might be legitimate interests. The organisation has a legitimate interest in improving its systems and the individual’s expectation of use for such purposes is reasonable. But this argument only works if the organisation conducts a legitimate interest assessment (LIA) and finds that the processing is proportionate. An LIA is not a tick-box exercise. It requires genuine analysis of whether the organisation’s interest outweighs the individual’s privacy interests.

If using an AI system to make decisions about individuals (such as credit scoring, hiring, or benefit allocation), consent should be the lawful basis. Individuals should be told that their data will be used for AI decision-making and given the opportunity to opt out. Consent should be separate from other consents and must be freely given.

The second obligation is transparency. UK GDPR Article 14 requires that where personal data is collected not directly from the individual, the organisation must provide certain information. If the organisation collects data about individuals from third parties and uses it in an AI system, the individuals have a right to know this. The organisation must provide privacy information including the categories of data processed, purposes, recipients and the individual’s rights.

In practice, this means that if an organisation buys a customer list from a data broker and uses it to train a model, they must notify those individuals. This notification should happen within a reasonable period, typically within one month. Many organisations fail to do this. They process the data without informing individuals. This violates Article 14.

The third obligation is fairness. UK GDPR requires processing to be fair. What is fairness? The guidance suggests that individuals should not be surprised by the processing. If an individual provides their data for one purpose (such as customer service) and the organisation uses it for a completely different purpose (training a model sold to competitors), that is unfair even if there is a lawful basis.

Fairness also requires that where AI systems make decisions affecting individuals, the fairness of those decisions must be monitored. If the AI system discriminates against protected groups, that is unfair. The organisation should conduct impact assessments and fairness testing to ensure the system does not discriminate.

The fourth obligation is data subject rights. Individuals have the right to access their data, to rectify inaccurate data, to erasure in certain circumstances and to object to processing. If an individual objects to processing of their data for AI, the organisation must stop that processing unless a legitimate interest overrides their objection. Individuals also have the right to explanation of AI decisions under Articles 13 and 14 (indirectly) and 22 (directly, for automated decision-making).

The fifth obligation is data protection by design. If the organisation is building an AI system that will process data, they should build privacy protections into the system from the start. This might include techniques such as differential privacy, data minimisation or anonymisation. Building privacy in at the design stage is far better than trying to add it later.

Documentation is essential. The organisation must maintain records of their data protection compliance including LIAs, impact assessments and processing activity records (Article 30). If a regulator questions the organisation’s compliance, these records are evidence.

Your role is to help clients understand these obligations and to identify where their AI systems fall short. If the client is training a model on personal data, do they have a documented lawful basis? Have they conducted an LIA? Have they notified individuals? Have they implemented fairness monitoring? The answers to these questions determine whether the deployment is compliant.