New CNIL’s guidelines on AI models: a practical approach amidst EU’s regulatory tangles

Information of data subjects

The CNIL's guidelines on informing data subjects about AI data processing emphasize the importance of transparency and accountability. Following the public consultation, the CNIL has refined its approach to balance the need for detailed information with practical considerations, particularly concerning indirect data collection and web scraping.

One of the key adjustments after the public consultation involves the details to be provided into the information notice regarding the sources of training data containing personal data. For scenarios where data is collected from numerous public sources, CNIL recommends providing an information notice that only indicates categories or typical sources of training data, rather than listing each source individually. For example, if an AI model is trained using data from numerous news websites, CNIL advises that the notice states that data is sourced from "online news outlets" rather than specifying each of them. CNIL recommends similar approach in the context of data scraping, by mentioning only that data may be collected from “social media sites”, without listing every platform individually. This method allows for transparency while acknowledging the practical limitations of providing exhaustive details. 

Exercise of data subjects' rights

The CNIL's guidelines also place a strong emphasis on respecting and facilitating the exercise of data subjects’ rights. Under GDPR, these rights include the right to access, rectify and erase personal data, as well as the right to object to some of their processing.

As part of the key recommendations, the CNIL guidelines highlight the importance of establishing clear mechanisms for responding to data subjects’ requests for rectification. For instance, if a data subject requests the correction of inaccurate personal data used to train or to run an AI model, the developer should implement a verification process and update the data promptly. The CNIL suggests using version control systems to track changes and ensure that rectifications are applied consistently across datasets.

The CNIL also recommends using filtering techniques to manage data outputs without necessitating a complete re-training of the AI model. This specific recommendation for ‘outputs’ seems much more practical than the right of access or rectification applied to training data (‘inputs’). For example, if a data subject requests the removal of their data from an AI system, filters can be applied to ensure that the data is not used in future outputs. This approach allows for compliance with data subjects’ rights without the need for resource-intensive re-training processes.

Indeed, the CNIL acknowledges that the exercise of data subjects’ rights must be balanced against operational realities. Therefore, since re-training an AI model to accommodate a data subject's request is deemed disproportionately burdensome, CNIL suggests that alternative measures such as data anonymization or pseudonymization should be considered. It provides examples of scenarios where such measures can be effectively implemented at ‘input’ or even ‘scraping’ levels, to protect data subjects' rights, while minimizing further operational disruptions.