Recital 33a

The processing of personal data in the context of the development and operation of an AI system or of an AI model, may be carried out for a legitimate interest of the controller concerned in accordance with Article 6(1)(f) of Regulation 2016/679, where appropriate, except where such interests are overridden by the interests, or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child, or where other Union or national laws explicitly require consent. This does not affect the obligation of the controller to choose an appropriate lawful ground of processing set out in Article 6 of Regulation (EU) 2016/679, such as Article 6(1)(e) with regard to processing by public authorities. It is recalled that Article 6(1)(e) may be regarded as a lawful ground of processing where a public authority develops, including training, or operates an AI system or an AI model used in the performance of a task carried out in a public interest or in the exercise of official authority. Regardless of the lawful ground of processing, any such processing should be subject to appropriate organisational, technical measures and safeguards for the rights and freedoms of the data subject, such as respect data minimisation during the stage of selection of sources, and to protect against non-disclosure of residually retained data in the AI system or AI model. Other provisions of this Regulation remain unaffected by the fact that a controller relies on this legal basis. It is important to clarify that the development and operation of an AI system or AI model does not in itself constitute a legitimate interest, and the applicability of Article 6(1)(f) to processing in the context of AI is to be assessed on a case-by-case basis, taking into account the underlying purpose of that processing.