[CLOSED] Artificial intelligence: the CNIL opens a consultation on the creation of datasets for AI

Many stakeholders informed the CNIL of their questions regarding the application of the General Data Protection Regulation (GDPR) to artificial intelligence (AI), in particular since the emergence of generative AI systems.

The analysis of these systems shows that their development is compatible with  privacy issues. Moreover, taking this imperative into account will enable the emergence of ethical devices, tools and applications that are faithful to European values.

It is on this condition that citizens will trust these technologies. For this, it is important that actors have clear and practical elements of analysis to enlighten the strategic decisions to develop or use AI that many organisations need to make in the coming months.

What are the objectives of the how-to sheets submitted for public consultation?

The CNIL’s how-to sheets aim at supporting the actors of the AI ecosystem in their efforts to comply with the legislation on the protection of personal data.

They provide concrete and practical answers, illustrated by examples, to the legal and technical issues related to the application of the GDPR to AI.

They respond in particular to questions concerning the application of the principles of purpose limitation, data minimisation and storage limitation for datasets used for machine learningt. They also clarify the rules applicable to scientific research and the re-use of datasets.

What is the scope of the how-to sheets?

The how-to sheets concern only:

• the development phase, excluding the phase of deployment;
• systems that involve the processing of personal data subject to the GDPR.

They are organised in 9 documents divided as follows:

• The introduction specifies the scope of the how-to sheets;
• Sheet 1 deals with the legal regime applicable to data processing in the development phase of the AI system;
• Sheet 2 deals with the determination of the purpose of the data processing for the creation of a dataset for the development of an AI system;
• Sheet 3 refers to the legal qualification of AI system providers;
• Sheet 4 sets out how to choose the legal basis for the processing and the additional checks to be carried out according to the method of collection or in the case of re-use of the data;
• Sheet 5 deals with the carrying out of a data protection impact assessment;
• Sheets 6 and 7 help stakeholders to take data protection into account in the design choices of the AI system and in the data collection and management;
• A documentation model is provided in the Annex of sheet 7.

View the "AI how-to sheets"

What was the process of drawing up these sheets?

To develop these how-to sheets, the CNIL organised a series of meetings with public and private actors to gather their observations and questions on the development of datasets for AI.

On 27 July 2023, it also launched a call for contributions to feed its reflection, a summary of which is published. The CNIL received 8 responses from private companies, a research institute, a trade union of employees and an individual.

What is the timing of the public consultation and who can contribute to it?

This public consultation will end on 15 December 2023.

The CNIL wishes to allow as many persons as possible, whether natural or legal, public or private, to participate in this public consultation. In particular, it wants to mobilise all AI actors (companies, researchers, academics, associations, legal and technical counsels, public administrations, etc.) around the issues of protecting the rights and freedoms that its use implies. 

Responses to the public consultation can be collective and can be done through federations, associations, etc.

Contributions must be made by downloading and completing the form. It is not necessary to comment on all the sheets in order to respond to the public consultation.

The public consultation is closed.

What are the next steps?

The contributions will be analysed at the end of the public consultation to allow the publication of the final how-to sheets on the CNIL website in early 2024.

These first sheets will be supplemented, before the end of 2023, by other how-to sheets relating in particular to the legal basis of the legitimate interest, the exercise  of rights and the information of the persons concerned during the development phase.