France: Opened Consultation on CNIL Action Plan on Artificial Intelligence

On 27 July 2023, the French Data Protection Authority (CNIL) opened a public consultation on its action plan on artificial intelligence (AI). The action plan puts forward its intended approach to regulating the development of AI in a manner that ensures the rights of end-users such as privacy and fair treatment. The CNIL is seeking opinions of all concerned private and public actors on four aspects relating to the application of the GDPR to AI. First, the CNIL will examine how the use of AI can be aligned with the principle of purpose limitation, meaning specified, explicit and legitimate purposes. Second, the CNIL will examine the principle of data minimisation in the context of creating AI databases. Third, the CNIL will identify measures which allow implementation data protection by design and by default. And fourth, the criteria to determine the lawfulness of data collection and processing for AI training.