ICO launches consultation series on generative AI and data protection

The question

What is the Information Commissioner’s Office’s (ICO) intended approach to developing guidance on how data protection law should be applied to the development and use of generative AI?

The key takeaway

The ICO’s consultation series on generative AI is intended to gather feedback and insights from all stakeholders with an interest in generative AI (including developers, legal advisors and users) to help inform the ICO’s drafting of updated guidance on responsible AI use and development in the UK.

The background

On 15 January 2024, the ICO announced the launch of its consultation series on generative AI and data protection. The ICO’s consultation series kicked off with the publication of the ICO’s first chapter on “the lawful basis for web scraping to train generative AI models”.

The announcement by the ICO of its consultation series on generative AI and data protection is also complimented by the UK Government’s recent publication, on 6 February 2024, of the response to its public consultation on its White Paper entitled “A pro-innovation approach to AI regulation” (see here).

The ICO’s consultation was closed to submissions on 1 March 2024.

The development

The ICO’s consultation on generative AI and data protection will continue to develop over the coming months as the ICO has stated that it will publish a number of “chapters” of guidelines which set out its initial thoughts on how it may interpret the application of data protection laws to emerging uses of generative AI technology in the future.

Some of the key topics which the ICO intends to cover include:

• what is the appropriate lawful basis for training generative AI models?
• how does the purpose limitation principle play out in the context of generative AI development and deployment?
• what are the expectations around complying with the accuracy principle?
• what are the expectations in terms of complying with data subject rights?

The first chapter in the ICO’s consultation series on “the lawful basis for web scraping to train generative AI models” is available here. This chapter covers the ICO’s initial thoughts on:

• the collection of training data as part of the generative AI lifecycle;
• legitimate interests as a possible lawful basis for collecting training data via web scraping – where the controller (eg an AI developer) can demonstrate: (i) the purpose of its processing of data is legitimate; (ii) the processing of data is necessary for those purposes; and (iii) the rights of any affected data subjects do not override the interests being pursued by the controller;
• how a controller may assess whether legitimate interests is a valid lawful basis for training generative AI models on web-scraped data;
• the risk mitigation measures which AI developers may want to consider in order to mitigate downstream harms during the deployment of generative AI models on the marketplace; and
• its expectations with respect to the control which the ICO considers AI developers should be able to exercise over the deployment of their generative AI models where they are deployed by the initial developer, by a third-party through an Application Programming Interface, and/or where they are made available to third parties generally.

However, it is important to note that the above represents the ICO’s preliminary consultations only and may be subject to change. Further, where they want to, stakeholders should be live to the publication of these chapters so that they can ensure that they can provide their feedback on the propositions put forward by the ICO.

Why is this important?

The ICO’s consultation series on generative AI demonstrates that the ICO is monitoring and engaging with one of the hottest data topics right now, being the development of generative AI in the UK and that the ICO is taking a proactive and collaborative approach with AI stakeholders to ensure guidance and regulation in this area is fit for purpose.

Any practical tips?

Organisations which utilise, or intend to utilise, generative AI should be thinking very hard about how data protection laws will apply to their use of this technology in the future. The consultation provided organisations with a prime opportunity to feed into the ICO’s proposed guidelines and thereby help shape the ICO’s view of the uses of generative AI technology moving forwards.

Organisations which utilise, or intend to utilise, generative AI should keep a close eye on all the ICO’s AI consultations to gain a deeper insight into, and understanding of, the direction the ICO intends to take in its interpretation of the application of data protection laws to the emerging uses of this most powerful of technologies.

Spring 2024