Sara Susnjar Discusses EU Privacy Law Regulations for Training LLMs with Bloomberg Law

Winston & Strawn partner Sara Susnjar was quoted in a recent Bloomberg Law article discussing challenges companies are facing when training large language models on users’ data under the EU’s General Data Protection Regulation (GDPR) guidelines for how companies must collect, process, store, and transfer individuals’ information. GDPR requires that individuals are asked for their consent in plain language, give it freely, and can withdraw it at any time. 

One lawful avenue to process personal data under GDPR is legitimate interest, which allows a company to use personal data from its users if it has a sufficient reason to do so. The company must apply a proportionality test weighing the rights and freedoms of data subjects against the interests of the business. The legitimate interest provision has been tested numerous times by Big Tech, but how it will be applied to AI providers’ use of personal data for model training is unclear.

“When it comes to AI and when it comes to the idea that it’s being used to give a flavor to a certain product in a certain region, I cannot say that the legitimate interest has failed because that’s not true,” said Sara. “But it’s hard to advance the argument that that is a legitimate interest in itself.”

Eventually, privacy law and generative AI will have a “reckoning,” she said. “The two will need to exist the same way laws and technology have existed since the beginning of time.”

Read the full article.