Odia Kagan of Fox Rothschild writes:
The European Data Protection Board recently issued an opinion on AI models, shedding light on what the consequences could be for the unlawful processing of personal data in the development phase of an AI model on the subsequent processing or operation of the AI model.
Possible remedies: Up to and including model deletion
Supervisory authorities may impose:
- A fine.
- Temporary limitation on the processing.
- Erasure of part of the dataset that was processed unlawfully.
- Deletion of the data of certain data subjects (ex officio) [individuals can ask for this too].
- Erasure of the whole dataset used to develop the AI model and/or the AI model itself (this depending on the facts , having regard to the proportionality of the measure (and e.g. the possibility of retraining)).
- The SAs will consider, among other elements, the risks raised for the data subjects, the gravity of the infringement, the technical and financial feasibility of the measure, as well as the volume of personal data involved.
The unlawful processing of the developer may punish the deployer (depending on potential risks to individuals).
Read more at Privacy Compliance & Data Security.