Section 10.1.7 : GDPR, Data Privacy and EU AI Act
🎯 Learning Objective
Understand the major regulatory frameworks — GDPR and EU AI Act — governing the use of AI in Europe. Master data privacy best practices when using AI tools in business, and know how to assess the compliance of your practices.
GDPR and AI: An Essential Framework
The GDPR (General Data Protection Regulation), in effect since May 2018, governs the collection, processing, and storage of personal data in Europe. It is the strictest data protection framework in the world, and the use of AI in business raises specific and strategic GDPR questions.
The 6 GDPR Principles Applied to AI
| GDPR Principle | Application to AI | Risk if Not Respected |
|---|---|---|
| Lawfulness | Legal basis for processing data via AI (consent, legitimate interest...) | Fine + invalidation of processing |
| Purpose limitation | Data collected for one purpose cannot be freely reused for another | Purpose diversion |
| Data minimization | Only send the AI strictly necessary data | Excessive data exposure |
| Accuracy | Data used must be up-to-date and correct | Decisions based on erroneous data |
| Storage limitation | Don't retain AI conversations containing personal data indefinitely | Uncontrolled accumulation |
| Integrity and confidentiality | Secure data sent to AI | Data leaks |
GDPR Issues Specific to AI
1. Training data: LLMs were trained on data potentially containing personal information scraped from the web. In Italy, ChatGPT was temporarily banned in 2023 for this reason. OpenAI has since added data deletion mechanisms and a "data access request" form.
2. Prompts and conversations: when you send customer data to ChatGPT, where does that data go? Policies vary by provider and usage mode:
| Provider | Web Interface | API | Enterprise |
|---|---|---|---|
| OpenAI | Data used for training (opt-out available) | No training (by default) | Complete isolation (ChatGPT Enterprise) |
| Anthropic | Data used if feedback given | No training (30-day security retention) | Isolation (Claude for Work) |
| Variable by settings | No training (Gemini API) | Isolation (Gemini for Workspace) | |
| Microsoft | Data not used (Copilot Pro) | No training (Azure OpenAI) | Isolation + EU data residency |
3. Right to erasure (Article 17): how do you "delete" personal data from an already-trained model? Technically nearly impossible — model weights aren't indexable by individual data. Current solutions: output blocking (the model learns not to repeat certain data) and retraining (expensive).
4. Automated profiling (Article 22): GDPR strictly regulates automated decisions with significant impact on individuals. If you use AI to sort resumes, score credit applications, or evaluate employees, the concerned person has the right to: be informed, contest the decision, and obtain human intervention.
5. Transfers outside the EU: the majority of AI providers (OpenAI, Anthropic, Google) have their servers in the USA. Transfers of personal data outside the EU require safeguards (Standard Contractual Clauses, adequacy decisions). Microsoft Azure and Google Cloud now offer EU data residency options.
GDPR + AI Best Practices: The Checklist
| # | Risk | Best Practice | Priority |
|---|---|---|---|
| 1 | Personal data leaking in prompts | Systematically anonymize: replace names, emails, phone numbers with pseudonyms before sending to AI | 🔴 Critical |
| 2 | Uncontrolled retention | Use APIs with "no training" parameter + regularly clean history | 🔴 Critical |
| 3 | Missing DPA | Sign a Data Processing Agreement (DPA) with the AI provider before any professional use | 🔴 Critical |
| 4 | Automated decision without oversight | Always provide a human review for decisions impacting people | 🟡 Important |
| 5 | Transfer outside the EU | Verify server location and use EU residency options if available | 🟡 Important |
| 6 | No processing registry | Document AI uses in the company's GDPR processing registry | 🟡 Important |
| 7 | Untrained employees | Train teams on GDPR + AI risks and best practices | 🟢 Recommended |
Golden Rule: Never Send Raw Personal Data to AI
Before sending data to ChatGPT, Claude, or any other LLM:
- →Anonymize names → "Client A", "Employee 12"
- →Remove emails, phone numbers, addresses, social security numbers
- →Pseudonymize internal identifiers (replace with codes)
- →Aggregate sensitive data (averages instead of individual values)
- →Verify before sending: "If this prompt leaked, would it be a problem?"
For intensive enterprise use, prefer Enterprise versions (ChatGPT Enterprise, Claude for Work, Azure OpenAI) that guarantee data isolation.
The EU AI Act: The First Global Regulatory Framework
The EU AI Act, adopted in March 2024, is the first comprehensive legal framework in the world governing artificial intelligence. It doesn't regulate AI as a technology but based on its use and risk level. It's a "risk-based" approach aimed at protecting fundamental rights while enabling innovation.
The 4 Risk Levels of the AI Act
Unacceptable Risk (PROHIBITED):
- →Social scoring: ranking citizens by their behavior (Chinese "social credit" style)
- →Subliminal manipulation: AI techniques to manipulate a person's behavior without their knowledge
- →Exploitation of vulnerabilities: targeting vulnerable people (children, disabled individuals)
- →Real-time biometric identification in public spaces (with national security exceptions)
- →Untargeted scraping of facial images to build facial recognition databases
High Risk (strict regulation):
- →Recruitment: resume screening, candidate scoring, automated interviews
- →Credit scoring: AI-based creditworthiness assessment
- →Justice: judicial decision support, recidivism risk assessment
- →Education: automated grading, AI-based academic orientation
- →Healthcare: diagnostic assistance, AI medical devices
- →Critical infrastructure: water, energy, and transport network management
Obligations for high-risk systems:
- →Ex ante conformity assessment
- →Detailed technical documentation
- →Mandatory human oversight
- →Decision traceability (logs)
- →Bias risk management
- →Robustness and cybersecurity
- →Transparency toward users
Limited Risk (transparency):
- →Chatbots: inform the user they're interacting with an AI
- →Deepfakes: clearly label content as AI-generated
- →AI content: make all generated text, image, or video content identifiable
Minimal Risk (no regulation):
- →Spam filters, video games, writing assistants, content recommendations, machine translation
Obligations for Foundation Models (GPAI)
The AI Act also introduces specific obligations for General Purpose AI (GPAI) models like GPT-5, Claude 4.6, Gemini 3.1, Llama 4:
| Obligation | All GPAI | "Systemic" GPAI (> 10²⁵ FLOPS) |
|---|---|---|
| Technical documentation | ✅ | ✅ |
| Copyright compliance policy | ✅ | ✅ |
| Training data summary | ✅ | ✅ |
| Systemic risk assessment | ❌ | ✅ |
| Adversarial red teaming | ❌ | ✅ |
| Incident monitoring and reporting | ❌ | ✅ |
| Enhanced cybersecurity measures | ❌ | ✅ |
Implementation Timeline
| Date | Obligation | Impact |
|---|---|---|
| February 2025 | Ban on unacceptable-risk AI | Social scoring, manipulation → illegal |
| August 2025 | Obligations on foundation models (GPAI) | OpenAI, Anthropic, Google, Meta must document |
| August 2026 | Full rules on high-risk systems | AI recruitment, credit scoring → mandatory compliance |
| August 2027 | Full implementation | All provisions in effect |
Practical Implications for Businesses
Any company using AI in Europe must:
- →Map its AI uses and classify them by risk level
- →Document high-risk systems (data, model, decisions)
- →Guarantee human oversight on automated decisions
- →Inform users when they interact with an AI
- →Provide recourse mechanisms for affected individuals
- →Train teams on regulatory obligations
- →Appoint an AI officer (like the DPO for GDPR)
The AI Act Doesn't Kill Innovation
Contrary to initial fears, the AI Act was designed to be proportional to risk. The vast majority of AI uses in business (writing assistants, chatbots, data analysis, content creation) fall into the "minimal risk" category → no specific obligations. It's the sensitive uses (recruitment, credit, justice, healthcare) that require strict compliance — which is logical.
Practical Exercise: Express Compliance Audit
Duration: 15 minutes
- →List all AI tools you use at work
- →For each one, identify: data sent, provider, server location
- →Classify each use according to the AI Act's 4 risk levels
- →Identify the 3 priority actions to improve your compliance
According to the AI Act, what factor determines the level of regulation for an AI system?
If you use ChatGPT via the API to analyze anonymized customer emails, which GDPR provision best applies?