Europe's privacy regulators set the test for when an AI model is truly anonymous
The EDPB's opinion on AI models says training on personal data does not make a model anonymous by default, and spells out how legitimate interest can apply.
Picture made for ABUREAU.
On 18 December 2024 the European Data Protection Board published Opinion 28/2024, answering questions from Ireland's regulator about personal data in AI models. It remains the reference point for every later piece of European guidance on training data.
The opinion makes three points. AI models trained with personal data cannot, in all cases, be considered anonymous: a claim of anonymity has to be shown, case by case, by proving that personal data can neither be extracted from the model nor obtained by asking it. Legitimate interest can be a legal basis for developing and using a model, but only after a three-step test of the interest, the need and the balance against people's rights. And a model built on data processed unlawfully can carry that problem into how it is used later.
For owners, the lesson is about what comes in, not just what goes out. Data with personal details properly taken out before it is shared, and with clear rights behind it, is data a developer can use without inheriting a risk. That makes careful preparation part of what gives data its value.
