The ICO calls for views on generative AI and data protection

Why should I read this?

The consultation series is intended to engage a range of industry stakeholders across a series of chapters that will outline the ICO’s preliminary thinking on the interpretation of the UK GDPR and Part 2 of the DPA 2018 in relation to generative AI models.

Generative AI refers to the use of AI to create new content, like text, images, music, audio, and videos (like ChatGPT). Generative AI has already become a transformative tool for people and businesses – and the legal landscape is changing quickly to adapt to it.

The first chapter in the ICO’s series is titled “Chapter one: The lawful basis for web scraping to train generative AI models”. Stakeholders with an interest in generative AI are invited to share their thoughts on this topic and help inform the ICO’s position on the same. The ICO will use the input received to update their guidance on AI and other products.

The ICO’s consultation series comes after the European Commission launched a call on 9 January 2024 for feedback on the level of competition in the context of virtual worlds and generative AI. Hot off the heels of the political agreement reached on the Commission's proposal for the EU AI Act – a landmark legislation that might well lead the framework for the regulation of AI in and outside the EU - the European Commission has now turned its attention to how generative AI is impacting the digital market.

What should I do?

Those in the industry who are interested in informing the ICO’s position on generative AI and data protection can respond to the ICO’s call for feedback by 1 March 2024 using the survey or by emailing generative.ai@ico.org.uk.

Interested parties to the Commission’s call on competition in virtual worlds and generative AI can also submit responses here by 11 March 2024.

What else do I need to know about these consultations?

The ICO wants to hear from a wide range of stakeholders, including developers and users of generative AI, legal advisors and consultants working in this area, civil society groups and other public bodies with an interest in generative AI.

The ICO have set out helpful context here on the basics of web scraping to train generative AI models, and the lawful basis that may be used for doing so. This call for evidence focuses specifically on the legitimate interests lawful basis (Article 6(1)(f) of the UK GDPR), which in principle may apply in this case.

It’s important to consider in addition that sensitive data known as special category data and criminal offence/convictions data would require extra lawful reasons should it be scraped/processed.

As for the wider context - there are of course (amongst others) copyright and database rights concerns under intellectual property law, as well as website terms and conditions, to be mindful of too.

Further reading on generative AI

• EU AI Act legal insights podcast - Episode 3
• UK AI Developments: Preparing for the AI Safety Summit
• One step closer to AI regulation – the EU AI Act moves to final stages with a ban on facial recognition in public places
• Data scraping: intellectual property rights and risks
• Patenting AI innovations in the UK – a paradox to be resolved?
• Webinar: Unlocking generative AI and copyright law
• Getty wins round one in UK AI infringement case