Article 88c

Article 88c

Justification

The AI Act does not create a new legal basis for personal data. The existence of a legitimate interest must be assessed on a case-by-case basis and must not be predetermined by law in favour of AI providers.

Article 88c

Justification

Article 88c is deleted in its entirety.

Article 88c

Article 88c

Article 88c

Justification

Deletion of the whole article 88c

Processing in the context of the development and operation of AIinnovative technologies

Justification

Replaces ‘artificial intelligence’ by ‘innovative technologies’. The considerations governing the processing of personal data in the development and operation of AI are not specific to that technology: they apply to any innovative technology involving large-scale processing. Technological neutrality prevents the provision from becoming obsolete with the next technological cycle.

In Article 88c, the following paragraph is added:

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.(1) Where the processing of personal data is necessary for the development of an AI model Article 6(1)(f) the protection of interests or fundamental rights and freedom of data subject’ require at least: (a) providing data subjects with an absolute right to object to the processing of their personal data after informing the data subject under Article 13(3) or 14(4) about such processing; (b) ensuring that all personal data is immanently and effectively anonymized, according to state-of-the-art technologies, and only further processed if it is technically impossible to anonymize individual exceptionally remaining personal data; (c) relevant abstraction during the training phase from any such exceptionally remaining personal data, ensuring that any disclosure of personal data is extremely unlikely; (d) continuous testing of the AI model to ensure that the disclosure of personal data does not occur and the measures under points (a) to (c) were effective; (e) ensuring that the controller or any subsequent controller using the AI model can comply with data subject’s rights if any personal data is exceptionally remaining in, processed or disclosed by an AI model.

Where the processing of personal data is necessary for the interests of the controller, or a third party, in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) of Regulation (E) 2024/1689, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and except where other Union explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of this Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child and where other Union laws explicitly require consent. The processing of personal data in the context of the development and operation of an AI system may also be based for the performance of a task carried out by public authorities in the public interest pursuant to Article 6, paragraph 1, point (e) and paragraph 2.

1) Where the processing of personal data is necessary for the interests of the controller in the contextpurposes of the development, andtraining, testing, validation, deployment, operation or monitoring of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or of an AI model, such processing may beconstitute pursued fora legitimate interestsinterest within the meaning of Article 6(1), point (f), ofprovided Regulationthat: (EUa) 2016/679,the whereprocessing appropriate,is exceptnecessary wherefor otherthe Unioninterest pursued by the controller or nationalby lawsa explicitlythird requireparty; consent,(b) andthat whereinterest suchis interests arenot overridden by the interests, or fundamental rights and freedoms of the data subject which require the protection of personal data, intaking particular whereaccount of whether the data subject is a child; and (c) no provision of Union or Member State law expressly requires the consent of the data subject for that processing.

Where the processing of personal data is necessary for the interests of the controller or a third party in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) Regulation (EU) 2024/1689 such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.