Module 5: GDPR for AI Systems

Introduction to GDPR for AI Systems

Capsule description

GDPR isn't new — it's been in force since 2018. But applying it to AI systems is still territory most engineers misunderstand. The reason: GDPR was designed before the generative AI boom, and applying its principles to LLMs, RAG systems, and automated decision-making requires a specific interpretation that doesn't come in any standard tutorial.

In Module 4 you saw the EU AI Act — the AI-specific regulation. GDPR is the other law that applies simultaneously in the EU to any system that processes personal data. Together, M4 and M5 give you the complete EU regulatory picture for AI.

The key point of this module is Article 22: the right not to be subject to purely automated decisions that produce legal or similarly significant effects. Translated into AI Engineering: if your system makes decisions that affect people (approving a loan, filtering a résumé, setting a price, prioritizing a case) without meaningful human intervention, you must be able to explain the logic, the consequences, and provide ways to object. The "right to explanation" isn't a nice-to-have — it's an obligation with fines of up to 4% of annual global revenue.

By the end of the module you'll be able to:

Explain GDPR Art. 22 and when it applies to AI systems
Define what your system must explain under the "right to explanation"
Apply data minimization, consent, and retention to the AI context
Distinguish between legitimate interest and consent as legal bases
Produce a GDPR Compliance Checklist specific to AI

Where are we?

Phase 1: Ethics Foundations ✅ (M1-M3)
Phase 2: Regulatory Compliance (M4-M6)
  └── Module 4: EU AI Act ✅
  └── Module 5: GDPR for AI ← YOU ARE HERE
  └── Module 6: Industry Standards (NIST, IEEE, ISO)

Phase 3: Practical Implementation (M7-M8)

GDPR + the EU AI Act overlap in high-risk systems. Understanding them together lets you architect compliance from the design stage.

The problem: GDPR vs. generative AI

GDPR was drafted in 2016 and in force from 2018. Generative AI exploded in 2022-2024. Applying it to modern AI has real tensions:

Tension 1: LLMs vs. the "right to explanation"

Art. 22 requires explaining the logic of automated decisions. A random forest has feature importances; you can show "the decision was based on credit history, income, tenure." An LLM is fundamentally less interpretable: "why did it say X?" → there's no clear answer.

Current strategies:

Document the process (not the internal "reasoning")
Detailed logging of inputs, retrieved context, and outputs
Human-in-the-loop before significant decisions
Acknowledge the limitations honestly

Tension 2: Data deletion vs. trained models

GDPR grants the "right to be forgotten." A user asks you to delete their data. But that data already trained your model. Is deleting the original data enough if the model "learned" from it?

There's no definitive answer yet. Strategies:

Design to avoid it: use synthetic data, federated learning
If you trained on personal data: document it, be prepared to retrain
For LLMs: retrieval-based instead of fine-tuning on personal data

Tension 3: Data minimization vs. ML's hunger for data

ML improves with more data. GDPR demands the minimum necessary. A direct conflict.

Strategies:

Define necessity clearly: does this data actually improve your model?
Differentiate: data for training (more relaxed with anonymization) vs. inference (strict)
Synthetic data to avoid real personal data in training

Module map

Capsule	Topic	Output
01	Introduction (this one)	A mental model + the GDPR vs. AI tensions
02	Art. 22 — Automated Decision-Making	When it applies, what it requires
03	The Right to Explanation for LLMs	Practical strategies given the opacity
04	Data Minimization applied to AI training	Training vs. inference, techniques
05	Granular consent for AI processing	UX design + revocation
06	Legitimate Interest vs. Consent	When each one applies
07	Documentation and the DPO in AI contexts	What to document, the DPO's role
08	Project: GDPR Compliance Checklist for AI	An AI-specific checklist

Art. 22 on one page

Article 22 — Automated individual decision-making, including profiling

1. The data subject shall have the right not to be subject to a decision
   based solely on automated processing, including profiling, which produces
   legal effects concerning him or her or similarly significantly affects him or her.

2. Paragraph 1 shall not apply if the decision:
   (a) is necessary for entering into, or performance of, a contract between the
       data subject and a data controller;
   (b) is authorised by Union or Member State law to which the controller is
       subject and which also lays down suitable measures to safeguard the data
       subject's rights and freedoms and legitimate interests; or
   (c) is based on the data subject's explicit consent.

3. In the cases referred to in points (a) and (c) of paragraph 2, the data
   controller shall implement suitable measures to safeguard the data subject's
   rights and freedoms and legitimate interests, at least the right to obtain
   human intervention on the part of the controller, to express his or her
   point of view and to contest the decision.

Translation for AI Engineers

When it applies: your system makes automated decisions that affect people (a legal effect or a significant impact).

What it requires:

Information: the user must know the decision is automated
Logic: meaningful information about the logic involved
Consequences: the envisaged implications
The right to challenge: the user can request human intervention, express their point of view, and contest the decision

Exceptions: contractual necessity, authorizing law, explicit consent.

Real cases: when Art. 22 applies

AI system	Does Art. 22 apply?	Why
Automated credit scoring	✅ Yes	Solely automated decision, and it affects people significantly
Automated CV filtering	✅ Yes	It affects access to employment
A chatbot answering questions	❌ No (typically)	It doesn't "decide" with legal effect
Individual dynamic pricing	⚠️ Maybe	Depends on how "significant" it is
AI medical diagnosis	✅ Yes	Health is a significant effect
Fraud detection that blocks an account	✅ Yes	It affects access
Product recommendations	❌ No	No significant effect

The practical rule: if your system makes a decision that changes the outcome of the user's life (access to a service, an opportunity, a resource), Art. 22 applies.

Common traps

Trap 1 — Thinking "consent fixes everything." "We asked for consent and we're done." No. Consent must be informed (they know it's AI), granular (separate from base consent), and revocable.

Trap 2 — Believing LLM responses aren't decisions. If your LLM answers "we can't approve your application" and that affects the user, it is an automated decision. Phrasing it as a "response" doesn't exempt you.

Trap 3 — Documenting only for audits. The documentation has to be accessible to the data subject who requests it. Your DPA must be able to show the user what decision was made and why.

Trap 4 — Ignoring the conflict with LLM opacity. "My LLM is a black box, I can't explain it." That doesn't exempt you — you have to implement alternative explainability strategies (logging, human review, decision templates).

Trap 5 — Treating GDPR as EU-only. If you process EU residents' data from outside the EU, GDPR applies. Hosting in the US doesn't exempt you.

Self-assessment question

Before moving on to M5-02:

When exactly does Art. 22 apply? Give 3 clear-cut examples.
Your LLM tells a user "you don't qualify for our premium program." Is that an automated decision under Art. 22?
Why can consent as a legal basis be weaker than legitimate interest in some cases?

Guide answers

3 examples:
1. Credit scoring that approves/rejects loans automatically
2. An ATS that filters résumés with no human review before the decision
3. An anti-fraud system that blocks transactions with no intervention
Yes, Art. 22 applies. "You don't qualify for premium" affects access to a service. It's a solely automated decision (the LLM) with a significant impact. You need to: notify that it's automated, explain the logic, and offer human review.
Consent can be weak because:
- Consent must be freely given — if the user "has no choice" (they can't use the service without consenting), it isn't freely given
- Consent is revocable at any time → if they revoke it, you have to stop the processing
- Legitimate interest isn't revocable in the same way, but it requires a documented balancing test showing your legitimate interest doesn't override the data subject's rights

Evidence of success when you finish the module

You'll know you finished well if:

✅ You can explain Art. 22 to a non-legal colleague in 5 minutes
✅ You can identify when it applies to a specific AI system
✅ Your GDPR Compliance Checklist has verifiable items (yes/no + evidence)
✅ You know how to handle the LLM + explainability conflict
✅ You can distinguish when to use consent vs. legitimate interest

Next capsule

02 — Art. 22: Automated Decision-Making. We go deep on the article most relevant to AI engineers, with real application cases and exceptions.

Resources

GDPR — Article 22 official text — the official source.
WP29 Guidelines on Automated Decision-Making — the official interpretation.
ICO — AI and data protection — UK ICO guidance.
GDPR Enforcement Tracker — ongoing fines, to see what actually gets sanctioned.
CNIL — IA et RGPD — the French DPA's AI-specific guidance.

← Previous8. Mini-project: Risk Classification Next →Art. 22: Automated Decision-Making in detail