Amendment 1580· GDPR Article 88c

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, , including measures to limit the derivation, inference, extraction or regurgitation of personal data by the system or model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data. Where the processing is carried out in the context of a high-risk AI system within the meaning of Regulation (EU) 2024/1689, or in the context of an AI regulatory sandbox or of testing in real world conditions under that Regulation, it shall comply with the conditions and safeguards laid down, respectively, in Articles 14, 59, 60 and 61 of that Regulation, which continue to apply.