The European Commission’s proposal to codify legitimate interest as a legal basis for AI training marks the most significant reform to the GDPR since its adoption. By explicitly recognizing legitimate interest as legal basis for AI training, the Commission aims to reconcile data protection with the realities of modern artificial intelligence.
The recent ECJ judgment in Case C-65/23 (MK v K GmbH) delivers a clear and far-reaching message for employers across the EU: a works agreement cannot serve as a valid legal basis under the GDPR.
A potential AI Act vs GDPR conflict might arise from the tension between the AI Act’s goal of addressing algorithmic bias and the GDPR’s strict privacy protections, making it difficult for companies to process sensitive personal data for that purpose while remaining compliant.
