The European Commission’s proposal to codify legitimate interest as a legal basis for AI training marks the most significant reform to the GDPR since its adoption. By explicitly recognizing legitimate interest as legal basis for AI training, the Commission aims to reconcile data protection with the realities of modern artificial intelligence.
On 4 June 2025, the European Data Protection Board (hereinafter, "EDPB") adopted the final version of Guidelines 02/2024 on Article 48 of the GDPR (hereinafter, the "EDPB Guidelines"). The purpose of the EDPB Guidelines is to clarify the scope of Article 48 of the GDPR – which governs the limits on the recognition and enforcement of judicial or administrative decisions from third countries requiring the transfer of personal data – in order to provide practical mechanisms for companies called upon to respond to requests for the transfer or disclosure of personal data from authorities of third countries.
