Generative AI is a type of AI system that can generate new text, image, audio and video content. Generative AI models are typically trained on vast amounts of personal data. In a generative AI context, this training is called ‘pre-training’ because the core model is often fine-tuned with additional training data that can also contain personal data.
Generative AI gives rise to new and challenging data protection questions. It involves vast amounts of personal data, often processed invisibly and across a complex supply chain. It also poses risks to people’s rights and freedoms, particularly when they are not aware that the processing is happening. The pace of technological development means that technical aspects of generative AI models may not always be designed with data protection in mind, making it challenging for organisations to demonstrate compliance with the law.
At the same time, the principles of data protection apply wherever personal data is processed – including with new or novel technologies. We continue to monitor major developers of generative AI, who need to ensure that they demonstrate ongoing compliance when developing and deploying new technology.
Methodology
Our methodology was underpinned by the principles set out in our Policy Methodology15 and consultation policy.16. We have a documented, consistent, and transparent approach to policy making where we deliver evidence-based decisions that focus on achieving clearly stated regulatory outcomes.
The public consultation received responses via both survey responses as well as written responses submitted via email. We received response from 192 organisations and 22 members of the public.
The open text survey responses and email responses were systematically reviewed and analysed to identify key points across the responses. We also held three roundtables, held a workshop with counterparts at the CNIL, and engaged a wider range of stakeholders on particular issues.
The ICO is committed to making timely, informed and impactful decisions, drawing on evidence and insight, as well as understanding the impacts of our interventions to ensure that we are making a material positive difference.17 Impact considerations formed part of our public consultation. A summary of the impact related responses is provided in the Annex.
17 Our impact approach ensures that in making a decision to intervene our actions are both proportionate to the issue at hand and not unduly burdensome on the those that we regulate. For more information, see: Measuring our impact