Processing personal data while developing an AI System: CNIL has issued guidelines regarding legitimate interest as a legal basis

Measures to limit the collection or retention of personal data

• Anonymize collected data without delay or, failing that, pseudonymize the data;

• Where it does not affect the performance of the model, prioritize the use of synthetic data;

• Limit memorization risks in generative AI by deleting rare or outlier data, deduplicating training data, reducing the ratio between the number of model parameters and the training data volume, regularizing the objective function during training, using learning algorithms that guarantee a certain level of confidentiality, and implementing any measure that limits overfitting;

• Limit risks of extraction, regurgitation, or attacks in generative AI through access restrictions to the model, modifications to the model outputs, and security measures to prevent or detect attacks.

Measures allowing individuals to retain control over their data

Technical, legal, and organizational measures in addition to those required under the GDPR to facilitate the exercise of data subjects' rights:

• Provide for a discretionary and prior right to object via easily accessible / visible means (e.g. visible opt-out checkbox); for online data, implement technical solutions enabling this right to be exercised prior to collection (e.g. opt-out mechanisms, suppression lists);
• Provide for a discretionary right to erasure of data contained in the database;
• Implement measures to facilitate the identification of individuals, such as retaining metadata or information on the data source, where this does not pose additional risk to data subjects;
• Implement measures to facilitate the exercise of rights, such as introducing a delay between data collection and its use, and/or periodically retraining the model to reflect rights exercised where the data are still available;
• In the event of sharing or open-source distribution of the model, establish measures to ensure the transmission of rights through the entire chain of actors, in particular via contractual clauses requiring the propagation of rights to object, rectify or erase in downstream systems;
• Facilitate the notification of rights, notably through application programming interfaces (APIs), or at a minimum through download logging management techniques;
• Communicate more broadly on updates to the datasets or models.

Transparency measures, in addition to the obligations laid down in Articles 12 to 14 of the GDPR:

• Provide information on the risks of data extraction or regurgitation (especially for generative AI), the measures in place to limit these risks, and the remedies available in case of incident (e.g. possibility of reporting to the controller);
• Publish the DPIA, where applicable (publication may be partial where certain sections are protected by legal secrecy, such as trade secrets);
• Publish any documentation related to the dataset, development process, or AI system and its functioning;
• Publish information to improve public understanding of how AI systems work, particularly through public documentation (e.g. source code, model weights), explanations of key machine learning concepts, and descriptions of safeguards against malicious use;
• Conduct public awareness campaigns, especially where data are collected at scale (e.g. LLMs), and diversify communication formats targeted at data subjects;
• Implement measures and procedures ensuring transparent development of the AI system, enabling auditability: full documentation, logging, version control, parameter tracking, and recording of evaluations and tests.

Measures to limit risks during the use phase

• For general-purpose AI systems, limit the risk of unlawful reuse through technical measures (e.g. digital watermarking, functionality restrictions by design) and/or legal measures (e.g. contractual clauses prohibiting unethical or unexpected uses);

• Implement licenses restricting uses aimed at reidentifying individuals;

• Ensure consideration of serious ethical risks, including ensuring the quality of the training dataset.

Other measures

• Depending on the severity and likelihood of the risks, establish an ethics committee or designate an ethics officer to incorporate ethical considerations and the protection of rights during the design phase and throughout the development of the system.