On May 13, 2024, the Information Commissioner's Office (ICO) launched the fourth chapter of its consultation series on generative artificial intelligence (AI). The fourth chapter focuses on data subject rights, particularly in relation to the training and fine-tuning of generative AI.

Data subject rights in generative AI

The consultation highlighted that individuals have several rights under data protection law including the right to access, rectification, and erasure as well as the right not to be subjected to automated decision-making.

The consultation explained that these rights apply to personal data in the training data, fine-tuning data, outputs of the generative AI model, and user queries. The consultation emphasized that organizations must have processes to enable the exercise of these rights throughout the AI lifecycle.

Obligations of developers and deployers

The consultation states that organizations developing or deploying generative AI models must ensure individuals can exercise their rights. In this regard, the consultation outlines that organizations have an obligation to:

• inform individuals if their data is being processed;
• provide clear, accessible information about data usage and individuals' rights;
• justify any exemptions used and safeguard individuals' interests and freedoms; and
• apply privacy-enhancing technologies and pseudonymization techniques to safeguard data.

Among other things, the consultation is inviting views on the effectiveness of measures to prevent unauthorized data retention and usage, as well as evidence on how organizations can meet their legal obligations while supporting innovation in generative AI.

Comments can be submitted until June 10, 2024, through an online survey or via email at [email protected].

You can read the press release here, the consultation here, and the survey here.