European Union: Issued EDPS guidelines for ensuring data protection compliance when using Generative AI systems

On 3 June 2024, the European Data Protection Supervisor (EDPS) issued guidelines for ensuring data protection compliance when using Generative Artificial Intelligence (AI) systems. The guidelines aim to help European Union (EU) entities meet data protection requirements, including in their procurement and selection of AI technologies. In particular, the guidelines define generative AI systems as systems which use machine learning to generate outputs such as text, images, or audio. In addition, the guidelines outline that Data Protection Officers (DPOs) play an essential role in advising on data protection and ensuring compliance throughout the AI system's lifecycle, while Data Protection Impact Assessments (DPIAs) are necessary for high-risk processing operations, with regular monitoring to manage evolving risks. Moreover, the guidelines outline that a legal basis for processing personal data, such as consent or public interest, shall be established. EU institutions, bodies, offices, and agencies (EUIs) must ensure that the personal data they process is necessary and accurate, manage datasets properly, and regularly monitor AI systems. Furthermore, transparency with individuals about data processing, safeguards for automated decision-making to allow human intervention, and bias detection are essential to ensure fair processing and avoid discrimination. The guidelines are issued as part of the EDPS's data protection authority role and do not provide an interpretation of the Artificial Intelligence Act.