At a glance
The key idea of this competency: AI does not get a privacy exemption. Where an AI system processes personal data — to train on it, to infer from it, or to make decisions about people — the existing data-protection regime already applies in full. The exam anchors this in the GDPR, so learn how each GDPR principle and obligation lands on AI:
- Transparency, choice, lawful basis and purpose limitation (II.A.1)
- Data minimization and privacy by design (II.A.2)
- Controller obligations — DPIAs, processors, transfers, DSRs, Art. 22 automated decisions, breach notification, record keeping (II.A.3)
- Special-category data, including biometrics (II.A.4)
A useful framing: AI stresses the GDPR’s oldest principles. Its hunger for data fights minimization; its re-use of data fights purpose limitation; its opacity fights transparency; and its automated outputs trigger Art. 22.
The FIPs — where all of this comes from
Modern privacy law worldwide descends from the Fair Information Practices (FIPs) — principles first articulated in the 1970s (US HEW report, then the OECD Privacy Guidelines, 1980). The recurring set:
- Notice / openness — tell people what you collect and why.
- Choice / consent — give people a say in the use of their data.
- Purpose specification & use limitation — collect for a stated purpose; don’t repurpose freely.
- Data quality / accuracy and collection limitation (minimization).
- Access & correction — individuals can see and fix their data.
- Security safeguards and accountability.
The GDPR’s Art. 5 principles, the CCPA, and most other privacy statutes are elaborations of the FIPs — so “applying privacy law to AI” is at bottom “applying the FIPs to AI”: an LLM trained on scraped personal data strains collection limitation; re-using data to train strains use limitation; opacity strains notice.
II.A.1 — Transparency, choice, lawful basis and purpose limitation
Lawful basis (Art. 6). Every act of processing personal data — including building a training set and running inference — needs one of the six lawful bases. For AI training, organisations most often rely on consent or legitimate interests; legitimate interests requires a balancing test that weighs the individual’s rights against the benefit, and consent must be freely given, specific, informed and unambiguous. Scraping the open web does not by itself create a lawful basis.
Purpose limitation (Art. 5(1)(b)). Data collected for purpose A cannot be freely repurposed to train a model for purpose B if B is incompatible with A. Re-using customer-service transcripts or photos to train a new model is a classic incompatible secondary use trap.
Transparency (Arts. 5(1)(a), 12–14). Individuals must be told, in clear language, that their data is processed, for what purposes, on what basis, and — where automated decisions are involved — given meaningful information about the logic involved. AI’s opacity makes this duty harder, not optional.
Choice. Where consent is the basis, individuals must be able to give and withdraw it; where legitimate interests is the basis, they retain a right to object (Art. 21).
II.A.2 — Data minimization and privacy by design
Data minimization (Art. 5(1)(c)). Collect and retain only what is necessary for the purpose. This is in direct tension with the “more data is better” instinct of ML. Mitigations the exam likes: collecting fewer features, anonymization or pseudonymization, synthetic data, federated learning, and shorter retention. Note that pseudonymized data is still personal data; only true (irreversible) anonymization takes data outside the GDPR.
Privacy-enhancing technologies (PETs) — be able to tell them apart, because the exam presents them as look-alike options:
| PET | Mechanism |
|---|---|
| Differential privacy | Adds calibrated random noise so outputs reflect group trends but no individual’s data can be inferred |
| Federated learning | The model trains locally on each device/site and only model updates are shared — raw data never leaves its source |
| Homomorphic encryption | Computation performed on data while it stays encrypted |
| Secure multi-party computation | Several parties jointly compute a result without revealing their inputs to each other |
| Synthetic data | Artificial data that preserves statistical properties of the real dataset without real records |
| Anonymization / pseudonymization | Remove identifiers irreversibly (outside GDPR) / replaceably (still personal data) |
Storage limitation (Art. 5(1)(e)). Personal data must not be kept longer than necessary — relevant to retaining training data and model logs indefinitely.
Privacy by design and by default (Art. 25). Build data-protection safeguards into the AI system from the outset (design) and default to the most privacy-protective configuration (default). This is a proactive, lifecycle obligation — not a post-hoc audit. It pairs naturally with the DPIA: design choices are documented and justified before deployment.
II.A.3 — Obligations on data controllers
The controller (the party determining purposes and means) carries the accountability. The BOK enumerates the obligations; learn each as it applies to AI.
| Obligation | GDPR anchor | How it lands on AI |
|---|---|---|
| DPIA | Art. 35 | Required where processing is “likely to result in a high risk” — covers most large-scale, novel or profiling AI. Assess necessity, proportionality and risks to individuals before deployment. |
| Third-party processors | Art. 28 | A cloud or vendor AI provider acting on your instructions is a processor — bind it by a written contract; it may act only on documented instructions and must support your compliance. |
| Cross-border transfers | Arts. 44–49 | Training or inference abroad moves data outside the EEA — lawful only via an adequacy decision or appropriate safeguards (e.g., Standard Contractual Clauses) plus a transfer risk assessment. |
| Data subject rights | Arts. 15–22 | Access, rectification, erasure, restriction, portability, objection. AI must be able to locate, correct or delete an individual’s data — including from training sets where feasible. |
| Automated decision-making | Art. 22 | A right not to be subject to a solely automated decision with legal/similar effect, unless it is necessary for a contract, authorised by law, or based on explicit consent — with safeguards: human intervention, the right to contest, and an explanation. |
| Breach notification | Arts. 33–34 | Notify the supervisory authority within 72 hours of becoming aware of a personal-data breach; notify affected individuals if high risk. Applies to AI-related leaks (e.g., model inversion exposing training data). |
| Record keeping | Art. 30 | Maintain records of processing activities (ROPA) covering AI processing. |
Art. 22 in depth. This is the single most-tested GDPR provision for AI. It bites only when a decision is (a) solely automated (no meaningful human involvement) and (b) produces legal or similarly significant effects (e.g., a loan denial, a job rejection, a credit limit). The required safeguards are human intervention, the ability to express a view and contest the decision, and meaningful information about the logic. Adding a rubber-stamp human does not take you out of Art. 22 — the involvement must be meaningful.
II.A.4 — Special categories and biometric data
Special-category data (Art. 9). Processing of sensitive data — racial/ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, biometric data used to uniquely identify a person, health data, and data on sex life/sexual orientation — is prohibited unless a specific Art. 9(2) exception applies (most commonly explicit consent, or substantial public interest with a legal basis). The default is prohibition; an exception must be affirmatively found.
Biometrics. Biometric data is only special-category when processed for the purpose of uniquely identifying a natural person (e.g., facial recognition for access control). The same face image used merely to estimate age may not be special-category — purpose matters. AI systems that classify or infer sensitive traits (e.g., inferring health or ethnicity from non-sensitive inputs) can pull ordinary data into the special-category regime.
Interaction with the EU AI Act. The AI Act layers on top of the GDPR: it prohibits certain biometric practices outright (e.g., untargeted scraping of facial images to build recognition databases; most real-time remote biometric identification in public spaces by law enforcement) and treats remote biometric identification and emotion recognition as high-risk or restricted. The GDPR and the AI Act apply cumulatively — satisfying one does not excuse the other.
How this shows up later
- The DPIA here is the privacy-law cousin of the AI Act’s fundamental-rights impact assessment and ISO/IEC 42005 impact assessments in II.C–II.D and Domains III–IV.
- Art. 22 / automated decision-making reappears as a transparency and human-oversight requirement under the EU AI Act (II.C.3) and in nondiscrimination contexts (II.B.2).
- Controller vs. processor maps onto the AI Act’s provider vs. deployer roles (II.C.6) — related but not identical distinctions the exam likes to blur.