Information Commissioner’s Office launches consultation on Generative AI

The Information Commissioner’s Office (“ICO”) has launched a series of consultations on how UK data protection law should apply to the development and use of Generative AI models.

What is meant by Generative AI?

Generative AI refers to models of artificial intelligence (“AI”) that can create new content, including images, videos, high-quality text, audio or computer code. They are trained on extensive amounts of raw data (or “datasets”) which allow them to generate new content for a variety of use cases. 

Why are consultations needed?

The ICO notes that its recent engagement with technology and AI innovators has drawn out a variety questions raised by organisations, concerning the application of data protection law in this area. Examples include:

• What are the expectations in terms of complying with data subject rights?
• What is the appropriate lawful basis for training generative AI models?
• What are the expectations around complying with the accuracy principle?

A series of consultations

The consultations are being launched by the ICO in a series of “chapters”, with the first chapter addressing the lawful basis for training generative AI models on web-scraped data (a process of gathering and/or extracting data from websites and exporting that data into a structured format). This chapter aims to assess, in particular, whether or not legitimate interests can be relied on as a valid lawful basis for training Generative AI models, where the developer of a Generative AI model takes their legal obligations seriously and can demonstrate that they are able to pass the requisite three-part test. In doing so, the developer must be able to demonstrate that:

1. the purpose of the processing is legitimate;
2. the processing is necessary for that purpose; and
3. the individual’s interests do not override the interest being pursued.

Our views

The first consultation opened in mid-January and is due to end on 1 March 2024. Interested organisations are able to provide feedback on the first chapter by completing a survey (which can be found here) or by e-mailing the ICO. Whilst the ICO has not confirmed in certainty whether it will publish a summary of responses, we expect to see an outcome of this consultation in due course.

Read the other topical articles from our Winter Data Protection Update:

• AI News: EU reaches landmark agreement on Artificial Intelligence Act
• European Commission publishes first review of pre-GDPR EU adequacy decisions
• EDPB Rules Meta’s Advertising Practices Unlawful
• ICO Opens Consultation on Draft Recruitment and Employee Records Guidance