The ICO has launched the second chapter of its AI consultation series this month. This chapter focuses on how the data protection principle of purpose limitation should be applied to the generative AI lifecycle.
The ICO recognises the tension between the different ways in which AI models can be used (using a bank of data in a broad number of use cases), the need to use the data for different purposes at different times in the lifecycle (e.g. the use of data to answer a question posed but also to train the models themselves) and the need to comply with the purpose limitation principle.
The ICO considers that before processing begins it is necessary to:
- set out sufficiently specific, explicit and clear purposes of each different stage of the life cycle and;
- explain what personal data is processed in each stage and why it is needed to meet the stated purpose.
This is a great opportunity to get into the detail of the knotty questions that everyone engaged with AI is struggling with at the moment and share your experiences to help better regulate this evolving tech.
You can access the call for evidence and the full details of the ICO’s approach here.
