Artificial intelligence: the CNIL opens a new public consultation on the development of AI systems

Many stakeholders have questioned the CNIL regarding the application of the General Data Protection Regulation (GDPR) to artificial intelligence (AI), in particular with the rise of generative AI systems.

For the CNIL, the development of these systems is compatible with the privacy principles entailed in the GDPR. Moreover, taking this imperative into account will make it possible to bring out devices, tools and applications that are ethical and faithful to European values.

This is the condition on which citizens will trust these technologies. For this, it is important that actors have clear and practical elements of analysis to inform the strategic decisions on the development or use of AI that many organizations need to make in the coming months.

What the consultation is about ?

1. A new serie of how-to sheets subjected to public consultation

On 8 April 2024, following a consultation with the ecosystem, the CNIL published its first recommendations on the development of AI systems. They answer questions relating to the application of the principles of purpose, minimisation and retention period for the development of AI systems. They also clarify certain rules applicable to scientific research, the re-use of databases or the realization of data protection impact assessments (DPIAs).

As a continuation of this work and in order to provide additional answers to the questions shared by professionals, the CNIL is opening a new public consultation on the following 7 how-to:

• Legal basis for legitimate interest and development of AI systems
• Legitimate interest: focus on open-sourcing models
• Legitimate interest: focus on webscraping
• Informing data subjects
• Respecting and facilitating the exercise of data subjects’ rights
• Annotating data
• Ensuring the safe development of an AI system

CNIL invites all stakeholders and actors involved to participate, including those who did not reply to the first consultation.

Participate in the consultation

2. A questionnaire on the application of the GDPR to AI models

As part of this consultation, the CNIL publishes a questionnaire on the application of the GDPR to AI models.

AI models can memorize some of the data used for their training. Various manipulations can then allow them to be extracted. Where training data contains personal data, AI models could thus fall within the scope of the GDPR, including where risks to individuals are limited.

The CNIL invites providers and users of AI systems, as well as all relevant actors, to shed light on the conditions under which AI models can be considered anonymous or must be regulated by the GDPR and on the consequences of such a qualification.

With this questionnaire, the CNIL is consulting all stakeholders in the AI sector in order to adapt its future recommendations to the real risks for the people concerned and the sector's capacity to reduce them.

Respond to the questionnaire

What was the process of preparing the how-to sheets and the questionnaire?

These sheets and the questionnaire were drawn up on the basis of exchanges organized by the CNIL with public and private stakeholders, including the scientific research community, to gather their comments or questions on the issues addressed.

Finally, during the public consultation on the first recommendations, the CNIL received 43 contributions from various actors in the AI ecosystem. They raised structuring question marks which made it possible to feed these new sheets.

What is the timing of the consultation and who can contribute?

This public consultation will end on September 1st 2024. 

The CNIL wishes to allow as many people as possible, whether natural or legal persons, public or private, to participate in this public consultation. In particular, it wants to mobilize all AI actors (companies, researchers, academics, associations, legal and technical counsels, etc.) around the challenges of protecting the rights and freedoms that its use entails.

How to participate in the consultation ?

Contributions must be made by responding directly to the form "How-to sheets on the development of artificial intelligence systems" and/or "Questionnaire on the application of the GDPR to AI models".

It is not necessary to comment on all the sheets or to answer all the questions in the questionnaire in order to respond to the public consultation. However, CNIL advises you to read all the sheets that interest or concern you before responding, in a consolidated manner, to the form on recommendations for AI systems.

Responses to the public consultation can be collective and can be submitted through federations, associations, etc.

What are the next steps?

The contributions will be analyzed at the end of the public consultation to allow the publication of the final recommendations on the CNIL website in the course of 2024.

This second set of recommendations will be complemented by further publications on AI throughout 2024.