Privacy
AI governance should limit personal-data collection, use and retention to what is necessary for defined purposes, rather than treating available data as freely reusable.
Privacy & surveillance IWIB4AI session Needs review
Nordic Privacy Arena 2025
Embedding privacy and data-protection responsibilities into AI governance.
Draft – legal and case law references not yet verified
Summary
This use case concerns privacy and data-protection responsibilities in AI governance. It examines how organisations can handle personal data responsibly when developing or using AI. The supplied material establishes a privacy and GDPR focus but does not describe a specific AI system, deployment or compliance outcome.
The Problem
AI development and use can create pressure to collect and reuse personal data beyond people's expectations. The central question is how organisations can support innovation while maintaining lawful processing, meaningful transparency and effective protection of individual rights.
Ethical Grounds
Accountability
Organisations should assign responsibility for data-protection decisions and document how privacy risks are identified and addressed throughout the AI lifecycle.
Transparency
People should receive accessible explanations of how their personal data is used in AI processes, including relevant purposes and recipients.
Autonomy
Privacy governance should enable people to exercise applicable rights over their data. Consent, where relied upon, must provide genuine choice rather than function as a procedural formality.
Legal Compliance
| Framework | Provision | Relevance |
|---|---|---|
| GDPR | Arts. 5–6 | AI processing of personal data must have a lawful basis and comply with principles including purpose limitation, data minimisation, accuracy and accountability. |
| GDPR | Art. 25 | Controllers must integrate data protection by design and by default into AI-related processing, including appropriate limits on the personal data processed. |
| GDPR | Arts. 12–15 | Controllers must provide transparent information and facilitate access rights when personal data is processed through AI systems. |
| GDPR | Art. 35 | A data protection impact assessment is required before AI-related processing that is likely to result in a high risk to individuals' rights and freedoms. |
Sources
Court & Regulator Decisions
CK v Dun & Bradstreet Austria (opens in a new tab)
Explanation rights for automated decisions show how AI governance must provide meaningful information about processing despite claims of commercial confidentiality.
Garante per la protezione dei dati personali – ChatGPT (OpenAI) limitation (opens in a new tab)
The ChatGPT limitation illustrates how inadequate legal basis and transparency can obstruct AI deployment despite a system’s usefulness.
CNIL – Clearview AI sanction (opens in a new tab)
The sanction for scraping facial images demonstrates that publicly accessible personal data cannot automatically be repurposed lawfully for AI.
Key Takeaways
- Map personal-data flows, processing purposes and lawful bases before deploying AI.
- Build data minimisation and privacy-protective defaults into system design.
- Assess whether a data protection impact assessment is required before processing begins.
- Assign clear accountability and provide practical routes for exercising data-protection rights.
Related Use Cases
From the Session
Nordic Privacy Arena 2025
Speakers
