The digital association Bitkom is calling for less strict regulations regarding the use of data for training artificial intelligence (AI). Ahead of a statement from the European Data Protection Board (EDPB), Bitkom fears that companies lack legal certainty in the development and use of AI. Susanne Dehmel, a member of Bitkom’s management, believes that the strictest interpretation of data protection laws causes an international competitive disadvantage.
Bitkom wants the EDPB to recognize AI training as a legitimate interest for companies. In a position paper, Bitkom argues that training AI models with personal data should be considered a legitimate interest. The General Data Protection Regulation (GDPR) allows the processing of personal data only under certain conditions, one of which is the protection of so-called legitimate interests. It is currently unclear whether the development and use of AI fall into this category. The EDPB’s statement is expected to provide this clarity. Although these statements are not legally binding, the European Court of Justice and national courts often refer to them.
Recognizing AI training as a legitimate interest for companies does not automatically mean that they can use all personal data. In such cases, the interests of the affected individuals must be weighed against those of the company. To avoid court cases where this balance is assessed on a case-by-case basis, the association advocates for clear guidelines. According to Bitkom, 70% of companies see data protection violations as the greatest risk in using AI.
If the EDPB decides against recognizing data processing as a legitimate interest and courts follow this view, companies will have to rely on other GDPR conditions. They would then need individual consent from the affected individuals, who can withdraw their consent at any time. Alternatively, companies must anonymize the data so that it cannot be traced back to individuals. However, this is not always technically possible and represents a significant effort for small and medium-sized enterprises, according to the industry association.
The position paper does not consider the consequences and potential risks for individuals arising from the processing of personal data. Instead, Susanne Dehmel points out that due to a lack of legal certainty, not all AI services are available to citizens in Europe. Bitkom is an interest group representing more than 2,000 companies from the IT and telecommunications sector. It advocates for the economic and political interests of its members. Recently, the association has called for strengthening Germany’s digital sovereignty and the construction of data centers.