Legitimate interest as a legal basis for training your AI is not res ipsa loquitur. It does not speak for itself.
In the age of AI, we often hear clients, and see privacy policies, refer to a “legitimate interest in the improvement of our product” as the legal basis for using input data to train AI models.
Recent guidance from the European Data Protection Board and European data protection supervisory authorities indicates that legitimate interest can, indeed, be a legal basis under the GDPR for developing or training an AI model.
But just saying so in a document does not make it a reality.
To rely on legitimate interest, you need to conduct and document a legitimate interest assessment. Based on the circumstances at hand, you need to be able to answer “yes” to each part of the following three-part test.
