EDPS■EDPSEUROPEANDATAPROTECTIONSUPERVISORThe EU's independent dataprotection authority01011003June2024Generative Aland the EUDPR.First EDPS Orientations forensuring data protectioncompliance when usingGenerative Al systems.edps.europa.euThese EDPS Orientations on generative Artificial Intelligence (generative Al)and personal dataprotection intend to provide practical advice and instructions to EUinstitutions,bodies,officesandagencies(EUls)on the processing of personal data when using generative Al systems,to facilitatetheir compliance with their data protection obligations as set out,in particular,in Regulation(EU)2018/1725.These orientations have been drafted to cover as many scenarios and applications aspossible and do not prescribe specific technical measures.Instead,they put an emphasis on thegeneral principles of data protection that should help EUls comply with the data protectionrequirements according to Regulation (EU)2018/1725.These orientations are a first step towards more detailed guidance that will take into account theevolution of Generative Al systems and technologies,their use by EUls,and the results of theEDPS'monitoring and oversight activities.The EDPS issues these orientations in its role as a data protection supervisory authority and notin its new role as Al supervisory authority under the Al Act.These orientations are without prejudice to the Artificial Intelligence Act.11.What is generative Al?.42.Can EUIs use generative Al?.....63.How to know if the use of a generative Al system involves personal data processing?.74.What is the role of DPOs in the process of developmentor deployment of generative5.An EUI wants to develop or implement generative Al systems.When should a DPIA be6.When is the processing of personal data during the design,development andvalidation of generative Al systems lawful?.....117.How can the principle of data minimisation be guaranteed when using generative Al8.Are generative Al systems respectful of the data accuracy principle?......................159.How to inform individuals about the processing of personal data when EUls usegenerative Al systems?.....1710.Whatabout automated decisions within the meaning of Article 24 of the Regulation?1811.How can fair processing be ensured and avoid bias when using generative Alsystems?2012.What about the exercise of individual rights?...............13.What about data security?.................14.Do you want to know more?................2Introduction and scope1.These orientations are intended to provide some practical advice to the EU institutions,bodies,offices and agencies (EUls)on the processing of personal data in their use ofgenerative Al systems,to ensure that they comply with their data protection obligations inparticular as set out in the Regulation (EU)2018/1725 ('the Regulation',or EUDPR).Even ifthe Regulation does not explicitly mention the concept of Artificial Intelligence(Al),theright interpretation and application of the data protection principles is essential to achievea beneficial use of these systems that does not harm individuals'fundamental rights andfreedoms.2.The EDPS issues these orientations in his role as a data protection supervisory authorityand not in his new role as Al supervisory authority under the Al Act.3.These orientations do not aim to cover in full detail all the relevant questions related to theprocessing of personal data in the use of generative Al systems that are subject to analysisby data protection authorities.Some of these questions are still open,and additional onesare likely to arise as the use of these systems increases and the technology evolves in a waythat allows a better understanding on how generative Al works.4.Because artificial intelligence technology evolves quickly,the specific tools and means usedto provide these types of services are diverse and they may change very quickly.Therefore,these orientations orientations have been drafted to cover as many scenarios andapplications as possible.5.These orientations are structured as follows:key questions,followed by initial responsesalong with some preliminary conclusions,and further clarifications or examples.6.These initial orientations serve as a preliminary step towards the development of morecomprehensive guidance.Over time,these orientations will be updated,refined andexpanded to address further elements needed to support EUls in the development andimplementation of these systems.Such an update should take place no later than twelvemonths after the publication of this document.31.What is generative Al?Generative Al is a subset of Al that uses specialised machine learning models designed to producea wide and general variety of outputs,capable of a range of tasks and applications,such asgenerating text,image or audio.Concretely,it relies on the use of the so-called foundation models,which serve as baseline models forother generative Al systems that will be'fine-tuned'from them.A foundation model serves as the core architecture or base upon which other,more specialisedmodels,are built.These models are trained on the basis of diverse and extensive datasets,includingthose containing publicly available information.They can represent complex structures likeimages,audio,video or language and can be fine-tuned for specific tasks or applicationsLarge language models are a specific type of foundation model trained on massive amounts of textdata (from millions to billions of words)that can generate natural language responses to a widerange of inputs based on patterns and relationships between words and phrases.This vast amountof text used to train the model may be taken from the Internet,books,and other available sources.Some applications already in use are code generation systems,virtual assistants,content creationtools,language translation engines,automated speech recognition,medical diagnosis systems,scientific research tools,etc.The relationship between these concepts is hierarchical.Generative Al is the broad categoryencompassing models designed to create content.A foundation model,such as a large languagemodel,acts as the foundational architecture upon which more specialized models are built.Specialised models,built upon the foundation model,cater to specific tasks or applications,usingthe knowledge and capabilities of the foundational architecture.The life cycle of a generative Al model covers different phases,starting by the definition of the usecase and scope of the model.In some cases,it might be possible to identify a suitable foundationmodel to start with,in other cases a new model may be built from scratch.The followingphaseinvolves training the model with relevant datasets for the purpose of the future system,includingfine-tuning of the system with specific,custom datasets required to meet the use case of the model.To finalise the training,specific techniques requiring human agency are used to ensure moreaccurate information and controlled behaviour.The following phase aims at evaluating the modeland establishing metrics to regularly assess factors,such as accuracy,and the alignment of themodel with the use case.Finally,models are deployed and implemented,including continuousmonitoring and regular assessment using the metrics established in previous phases.Relevant use cases in generative Al are general consumer-oriented applications(such as ChatGPTand similar systems that can be already found in different versions and sizes',including those thatcan be executed in a mobile phone).There are also business applications in specific areas,pre-trained models,applications based on pre-trained models that are tuned for specific use in an areaThe size of a Large Language Model is usually measured as the number of parameters(tokens it contains.The size of a LLMmodel is important since some capabilities only appear when the model grows beyond certain limits.4