Article 88c

Article 88c

Processing in the context of the development and operation of innovative technologies, including AI

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Where theThe processing of personal data is necessary for the interests oflegitimately pursued by the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursuedcarried for legitimate interestsout within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Where the processing of personal data is necessary for the interests of the controller, or a third party, in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, including a general-purpose AI model as defined in Article 3, point (63) of Regulation (E) 2024/1689, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Justification

Allowing Member States to regulate this issue through national law could lead to regulatory fragmentation across the Union. In addition, excluding the assessment of third-party interests from the legitimate interests balancing test may unduly restrict the flexibility available to AI developers and could hinder innovation. Furthermore, there are concerns from media companies regarding the practical feasibility of this approach. In particular, it would be extremely difficult to obtain and manage the consent of actors and performers throughout the production cycle, especially where consent would need to be secured upfront and managed after production has been completed. It is therefore unclear how this obligation would work in practice. It should also be clarified whether these situations are already covered by Article 21, in which case the proposed provision may be unnecessary or duplicative.

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject whichin requireaccordance protectionwith Articles 6 and 21 of personalthis dataRegulation, in particular where the data subject is a child.

Where the processing of personal data is necessary for the interests of the controller in the context of the development and operation of an AI system as defined in Article 3, point (1), of Regulation (EU) 2024/1689 or an AI model, such processing may be pursued for legitimate interests within the meaning of Article 6(1)(f) of Regulation (EU) 2016/679, where appropriate, except where other Union or national laws explicitly require consent, and where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with an unconditional right to object to the processing of their personal data.

Any such processing shall be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources andas well as during the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model against any disclosure, to ensure enhanced transparency toin respect of data subjects and providing data subjects with an unconditional right to object to the processing of their personal data. If the processing is carried out within a high-risk AI system within the meaning of Regulation (EU) 2024/1689, or within an AI regulatory sandbox or during testing in real world conditions under this Regulation, it shall comply with the conditions and safeguards provided for in Articles 14, 59, 60 and 61 of this Regulation respectively, which shall continue to apply.

Any such processing shall be subject to appropriate and legal organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as to ensure respect of data minimisation during the stage of selection of sources and the training and testing of AI an system or AI model, to protect against non-disclosure of residually retained data in the AI system or AI model to ensure enhanced transparency to data subjects and providing data subjects with anappropriate unconditionalrights rightas tooutlined objectin toArticle the processing21 of theirRegulation personal(EU) data2016/679.