On 7 June 2024, the French data protection regulator (CNIL) issued its first set of recommendations on the development of AI systems.
The CNIL states that these recommendations will allow those involved in the “AI ecosystem” to
- determine the applicable legal regime;
- define a purpose (in several circumstances);
- determine the legal classification of the actors;
- define a legal basis (with a look at where the different bases may be applicable);
- carry out tests and checks in the event of re-use of data (e.g. where the data was collected for another purpose);
- carry out a data impact assessment if necessary;
- take data protection into account when designing the system;
- take into account data protection in the collection and management of data.
The guidance is in English as well as French and can be found here.
