MIL-OSI Europe: Answer to a written question – Training AI: will the EU allow major US platforms to draw on our personal data? – E-002743/2024(ASW)

The use of personal data, including in the context of Artificial Intelligence (AI) training, by online platforms established in the EU is regulated by the General Data Protection Regulation (GDPR)[1]. This includes the possible transfer of personal data to a third country outside of the European Economic Area.

Without prejudice to its powers as guardian of the Treaties, the monitoring and enforcement of the GDPR falls primarily under the competence of national data protection authorities (DPAs) and courts.

DPAs have launched several investigations into platforms’ uses of personal data to train AI models[2] and the European Data Protection Board has recently issued an opinion on the use of personal data for the development and deployment of AI models in line with the GDPR[3].

General purpose AI (GPAI) models generate content based on the input data it has been trained on. Article 4 of Directive (EU) 2019/790[4] introduced an exception for text and data mining (TDM), which provides a relevant framework for the use of protected content for AI training.

Article 4(3) allows rightsholders to reserve their rights, thereby preventing their works or subject matter from being used under the exception.

In such cases, GPAI models’ providers wishing to use such content to train their models must obtain authorisation from rightsholders to carry out TDM.

Moreover, according to Article 53(1)(c) of the AI Act[5], GPAI models’ providers placed in the EU market must put in place a policy to comply with EU copyright law, in particular with the rights reservation expressed under Article 4(3) of Directive (EU) 2019/790, irrespective of where the training of such models occurs.

This measure will facilitate the enforcement of copyright and related rights in the EU.

• [1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); OJ L 119, 04/05/2016, p. 1-88.
• [2] https://www.dataprotection.ie/en/news-media/press-releases/data-protection-commission-launches-inquiry-google-ai-model and https://www.edpb.europa.eu/system/files/2024-05/edpb_20240523_report_chatgpt_taskforce_en.pdf
• [3] https://www.edpb.europa.eu/news/news/2024/edpb-opinion-ai-models-gdpr-principles-support-responsible-ai_en
• [4] Directive (EU) 2019/790 of the European Parliament and of the Council of 17 April 2019 on copyright and related rights in the Digital Single Market and amending Directives 96/9/EC and 2001/29/EC, OJ L 130, 17.5.2019, p. 92-125.
• [5] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828, OJ L, 2024/1689, 12.7.2024.