{"id":6377,"date":"2023-10-26T19:14:00","date_gmt":"2023-10-26T17:14:00","guid":{"rendered":"https:\/\/cloix-mendesgil.com\/?p=6377"},"modified":"2023-12-22T19:15:04","modified_gmt":"2023-12-22T18:15:04","slug":"cnil-guidelines-ia","status":"publish","type":"post","link":"https:\/\/cloix-mendesgil.com\/en\/legal-insights\/it-contracts-data-and-compliance\/cnil-guidelines-ia\/","title":{"rendered":"Artificial Intelligence: CNIL guidelines on development and training databases"},"content":{"rendered":"\n

Artificial Intelligence (AI), a pivotal digital topic in 2023, falls under the purview of the GDPR. As AI algorithm development often involves processing substantial volumes of data, which may include personal information, adherence to the data protection principles set forth by the European regulation is crucial.<\/p>\n\n\n\n

On October 11, 2023<\/a>, the French Data Protection Authority (Commission Nationale Informatique et Libert\u00e9s – CNIL) provided initial guidance addressing this complex intersection.<\/p>\n\n\n\n

This announcement marks CNIL’s first formal response to industry professionals’ calls for legal clarity. Some stakeholders have voiced concerns that GDPR principles like purpose limitation, data minimization, restricted retention, and reuse might hinder AI research and applications.<\/p>\n\n\n\n

However, CNIL affirms that GDPR compliance and AI development can coexist, provided specific boundaries are respected.<\/p>\n\n\n\n

Regarding the principle of purpose, outlined in Article 6 of the GDPR, CNIL recognizes the need for a degree of flexibility in AI contexts. While it’s impractical to define all potential applications of an algorithm at the training stage, the system’s type and primary functions should be predetermined.<\/p>\n\n\n\n

The principle of data minimization also demands a pragmatic approach. It doesn’t necessitate minimal data usage, but rather the utilization of data proportionate to the intended purpose. This does not preclude using extensive datasets for algorithm training, but the use of superfluous personal data remains prohibited. CNIL reiterates the importance of data security in this process.<\/p>\n\n\n\n

Similarly, the principle of limited data retention doesn’t preclude setting extended durations for training databases when justified. CNIL acknowledges that these databases often represent significant scientific and financial investments and sometimes become widely used community standards.<\/p>\n\n\n\n

CNIL clarifies that reusing data sets, especially publicly accessible ones, is generally permissible, provided they were not collected illicitly.<\/p>\n\n\n\n

To assist professionals, CNIL has published a series of practical AI sheets<\/a> for GDPR-compliant tool development. These sheets offer detailed guidance on applying GDPR principles:<\/p>\n\n\n\n