GDPR and AI: what rights do you have over your data with AI systems?
The GDPR, EU Regulation 2016/679, fully applies to AI whenever personal data is processed, both in training and in use. Your rights: access, rectification, erasure, objection, restriction, portability. The CNIL has published specific recommendations on AI system compliance with the GDPR.
The General Data Protection Regulation, GDPR, Regulation EU 2016/679, fully applies to artificial intelligence as soon as a system processes personal data, whether for training or usage. AI benefits from no exemption: the principles of lawfulness, purpose limitation, minimization and security apply, and you retain all your rights. The CNIL, the French data protection authority, has published specific recommendations on the compliance of AI systems with the GDPR.
Applicable principles
Lawfulness and transparency: processing must be based on a legal basis and be brought to your attention.
Purpose limitation: data may only be used for specified and legitimate purposes.
Minimization: only necessary data may be processed.
Security: data must be protected.
These principles apply to both model training and their operation.
Your rights
Access: know what data concerning you is processed.
Rectification: have inaccurate data corrected.
Erasure: obtain deletion of your data, subject to conditions.
Objection: object to processing, particularly for marketing purposes.
Restriction: request the suspension of contested processing.
Portability: retrieve your data in a reusable format.
These rights are exercised with the data controller, identified in the service's privacy policy.
The specific case of training
The use of personal data to train a model is processing subject to the GDPR. The CNIL has specified compliance conditions, particularly the legal basis, informing individuals and respecting their rights. Technical difficulties exist, but they do not erase obligations.
Frequently Asked Questions
Can I object to my data training an AI?
You have a right to object and, depending on the case, the legal basis may be contested. Check the service settings.
How do I exercise my rights?
Address your request to the data controller, get a response within one month, contact the CNIL in case of refusal.
Can the CNIL impose sanctions?
Yes, it has control and sanction powers.
ICIA Resource
ICIA offers MentivisOS ICIA, a free lifelong platform to learn AI with a personalized learning path.
Discover MentivisOS ICIA