**The EDPB’s Opinion on AI Models: Data Security and Responsible Innovation**

In recent years, artificial intelligence (AI) models have gained increasing attention and consideration, not only for their innovative capabilities but also for the ethical and legal implications they entail. The protection of personal data is of fundamental importance in this context. In a recent opinion, the EDPB (European Data Protection Board) addressed several critical issues regarding the processing of personal data in relation to AI models, laying the groundwork for responsible development that complies with regulations.

### Key Aspects of the Opinion

The EDPB focused on three key issues raised by the Irish Data Protection Authority, reflecting on:

1. **Anonymization of AI Models**: When and how AI models can be defined as “anonymous.”
2. **Legitimate Interest**: The possibility for data controllers to use legitimate interest as a legal basis for developing or using AI models.
3. **Unlawful Processing of Data**: The consequences arising from the use of personal data processed unlawfully in the development of AI models.

These points are fundamental to ensure that AI technologies not only offer innovation but also comply with data protection regulations.

### Innovation and Responsibility

The EDPB’s opinion underscores an essential equation: there must be a balance between innovation and responsibility. AI models must not compromise the security of personal data; on the contrary, they should establish a series of criteria to ensure that their development takes place in compliance with existing regulations.

### Terminological Clarifications

The EDPB begins with clarifications on some key terminologies to ensure a common understanding:

– **First Party Data**: This refers to personal data collected directly by the data controller from the data subjects.
– **Third Party Data**: This represents data received or collected from external sources, such as in the case of web scraping—a technique used to gather online information that may include personal data.
– **Life Cycle of AI Models**: Includes phases such as creation, development, training, updating, fine-tuning, operation, and post-training, each of which may involve personal data for various purposes.

### Data Anonymization

According to the EDPB, it is essential to respect the principle of data anonymization as established by current regulations. However, anonymization should be evaluated on a case-by-case basis, as it is not always a fully realizable process. The agency states that AI models are generally designed to make predictions or generate conclusions, and even if they are not intentionally programmed to produce identifiable data, they may absorb information from training data, including personal data.

### Assessing the Anonymity of an AI Model

To consider an AI model as “anonymous,” a thorough assessment is required. The EDPB proposes several criteria for this evaluation:

1. **Model Design**: Supervisory authorities must examine how the model was designed to ensure it reduces the risk of identifying data subjects.
2. **Selection of Data Sources**: It is crucial to consider the appropriateness and relevance of the sources selected for training the model.
3. **Data Minimization**: The training phase must include strategies to minimize the volume of personal data used.
4. **Technical Protection Measures**: Methods must be implemented to prevent the identification of data through queries to the model.
5. **Model Audits and Testing**: Supervisory authorities must consider the robustness and resilience of the model, including stress testing to evaluate its strength against potential attacks.

### Reflections on Legitimate Interest

The EDPB’s opinion also provides an overview of the appropriateness…

(Note: The final sentence appears to be cut off. If more context is provided, I’d be happy to continue translating.)