HB Ad Slot
HB Mobile Ad Slot
HTML Embed Code
HB Ad Slot
Under the GDPR, what Information Should an Organization Put in its Record of Processing Activities if it is Processing Personal Data Using an AI (i.e., putting personal information into AI prompts)?
Tuesday, November 7, 2023

Data is typically added to an AI to explain a problem, situation, or request (“input data”). Some popular AI models refer to input data by the term “prompt” as the user is prompting the AI to initiate an action, or to create additional information. Prompts can take different forms such as text prompts or image prompts, and may, or may not, contain personal information. As an example, the prompt “what is Pi to the 15th digit” would contain no personal information whereas the prompt “write a letter to David Zetoony, a data privacy attorney in Colorado,” would contain personal information. 

Organizations that use an AI may either be acting as a controller or a processor depending on the degree of discretion they exercise in deciding how the AI will function, including whether personal information will be inputted into an AI prompt. For example, if an organization determines that it will input personal information into an AI it will likely be considered a “controller.” If the same organization directs a third party to input the personal information into an AI on its behalf, that third party would likely be considered a “processor.”

Whether an organization is a controller or a processor, the GDPR requires each organization to create a record of processing activities. The record of processing activities can take many forms, and many organizations choose to satisfy the requirement through a data inventory (i.e., a list of all the systems that collect and process personal information). What must be included in that record of processing activities or data inventory differs, however, based upon the company’s controller or processor designation. The following summarizes the information that must be included when personal information is added to input data/prompts depending on whether an organization is a controller or a processor. Click on the chart to view larger.

HB Ad Slot
HB Mobile Ad Slot
HB Ad Slot
HB Mobile Ad Slot
HB Ad Slot
HB Mobile Ad Slot
 
NLR Logo
We collaborate with the world's leading lawyers to deliver news tailored for you. Sign Up to receive our free e-Newsbulletins

 

Sign Up for e-NewsBulletins