European Union: Global Privacy Assembly adopted Resolution on collection, use and disclosure of personal data to pre-train, train and fine-tune AI models

On 19 September 2025, the Global Privacy Assembly adopted the Resolution on the collection, use and disclosure of personal data to pre-train, train and fine-tune Artificial Intelligence (AI) models. The resolution acknowledges concerns regarding the ethical and legal implications of artificial intelligence (AI) technologies, particularly generative AI, and their impact on fundamental rights such as privacy and data protection. It recognises that the development of AI frequently involves the large-scale collection and use of personal data, including special categories of data. The resolution reaffirms that existing data protection and privacy principles and laws apply to AI technologies across their lifecycle, from data sourcing to deployment and monitoring. It highlights eight data protection principles for the lawful use of personal data in AI training. These principles include a lawful and fair basis for processing, ensuring transparency and assessing data subject expectations, and adhering to purpose specification and use limitation. Data minimisation is emphasised, along with transparency in data practices, including clear information for data subjects on collection, use, and disclosure. The resolution also addresses accuracy, requiring developers to take reasonable steps for high-quality datasets and testing, and data security, necessitating appropriate technical and organisational measures to protect personal data and prevent its extraction from models. Accountability and privacy by design are promoted, advising impact assessments and governance. Finally, the resolution underscores the rights of data subjects, enabling individuals to access, delete, and object to the use of their personal data. The Assembly resolved to promote these principles, coordinate enforcement efforts on generative AI, and share ongoing developments among its members.