DPC Guidance on AI and Large Language Models: What Employers Should Check

Staff using AI tools at work can create data protection risks even when the employer has not rolled out any formal system. The Data Protection Commission (DPC) set out its views for organisations in a blog post, “AI, Large Language Models and Data Protection”, dated 18 July 2024. This guide summarises that post. It is general information and not legal advice. For the wider employer picture, see our guide to GDPR staff training requirements in the UK and Ireland.

Understand the processing first

The DPC says that before using an AI system, an organisation should identify what personal data it uses, how it uses it, and whether a third party is involved. It also suggests checking whether the provider retains or reuses the data.

Risk assessment and DPIAs

If your organisation is a controller, the DPC suggests considering a formal risk assessment. The post notes that a data protection impact assessment (DPIA) may be required, particularly for new technology, combined datasets, or data about minors or vulnerable people. Even when one is not required, it may be good practice. The post does not explain when a DPIA is mandatory and links to further detail instead.

Transparency

Provider documentation should explain the AI tool’s handling of data clearly and accessibly, and the DPC encourages organisations to read it.

Staff use of third-party tools

The post says that personal data entered by employees into a third-party AI tool can create security and data protection risks. The organisation needs to understand how that data is protected, including when another organisation processes it on its behalf.

Data minimisation and alternatives

The DPC warns of a tendency to use large amounts of personal data, sometimes unnecessarily, and suggests considering whether non-AI alternatives could achieve the purpose with less risk.

Accuracy and automated decisions

The post says AI outputs can be inaccurate or biased. Relying on them without critical human review may create automated decision-making risks, which can seriously affect individuals.

Retention and individual rights

• Without a retention schedule and related processes, an organisation risks breaching the storage limitation principle.
• Organisations need processes to handle access and erasure requests, including for data held within an AI system.
• Models may reproduce personal training data and safety filters can potentially be circumvented, so organisations should assess these risks and how they are mitigated.

Published personal data

The DPC notes that personal data on a website may be collected for AI training. It suggests considering protection where people have not agreed to that use or would not reasonably expect it.

Our suggestions

These are our own practical suggestions, not DPC guidance. Keep a list of the AI tools staff actually use. Write down, for each, whether personal data may be entered. Give staff a short, written rule on what not to paste into public tools. Review contracts with AI providers for retention and reuse terms. Our guide to generative AI at work and data protection for staff covers staff-facing points.

When assessing a provider, the points the DPC raises translate into practical questions. Does the provider retain or reuse the data that staff enter? Is its documentation about data handling clear? Can the tool support access and erasure requests for data held within it? Who else processes the data on the provider’s behalf? What does the provider say about the risk that a model reproduces personal training data? The answers can be recorded in a short assessment note, which also helps if a DPIA is needed.

A short staff briefing can cover four points: which tools are approved, what types of personal data must never be entered, that outputs must be checked by a person before they are used to make decisions about individuals, and who to ask if in doubt.

What the sources do not say

The post does not say which lawful basis an organisation using an AI tool should rely on, because its lawful basis discussion is mainly aimed at providers. It names no tools or vendors, gives no technical security controls, sets no retention periods, and includes no enforcement examples or penalties. It is from July 2024, so check the DPC site for later guidance.

Frequently asked questions

Does using an AI tool always need a DPIA?

The post says a DPIA may be required, especially for new technology, combined datasets or data about minors or vulnerable people, but it does not set out the mandatory criteria.

Is staff use of public AI tools a data protection issue?

The DPC says personal data entered by employees into a third-party AI tool can create security and data protection risks.

Do access and erasure rights apply to AI systems?

The DPC says organisations need processes to handle access and erasure requests, including for data held within an AI system.

Is this guidance current?

The post is dated 18 July 2024, so check the DPC website for newer material.

Next steps

Learnsignal’s offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.