Purpose limitation
GDPR Article 5(1)(b) says personal data must be collected for specified purposes and not further processed in an incompatible way. Licensing it for AI training is a new purpose.
The compatibility test
Article 6(4) weighs the link between the original and new purpose, the context and relationship with the person, the nature of the data, the consequences for them, and safeguards like pseudonymisation.
EDPB Opinion 28/2024
The European Data Protection Board said whether a trained model is anonymous is decided case by case, and that legitimate interest can be a lawful basis under a three-step test, depending on people's reasonable expectations (Hunton summary).
Practical steps
- Exclude EU/UK personal data where you can.
- Otherwise, anonymize it fully, or document a compatibility assessment and legitimate-interest balancing test.
- Check cross-border transfer rules if the buyer is outside the EU/UK.
Most current US programs prioritize US companies with English-language data, so many DataPaid applicants can sidestep this by excluding EU records.
Frequently asked questions
Can I license EU personal data for AI training?
Only with a lawful basis and a compatible purpose under GDPR, or after true anonymization. Many companies simply exclude EU/UK personal data.
What is EDPB Opinion 28/2024?
A December 2024 opinion on AI models and personal data, covering when models are anonymous and when legitimate interest can justify training.