If a generative AI service collects a person’s name from a public post, can it use that information without restriction? Not under the General Data Protection Regulation (GDPR): publicly accessible personal data is still protected. The EU regulation governs how organizations collect, store, and use personal data. It can also apply to organizations outside the EU when they process the personal data of individuals in the EU. section 3.15
The GDPR became enforceable in 2018, succeeding the EU’s 1995 Data Protection Directive. It builds on earlier international privacy principles while adding stronger individual rights, obligations for organizations, and enforcement powers. Its approach has influenced privacy laws elsewhere, although national approaches still differ. section 3.14
The regulation sets seven principles for handling personal data:
- Lawfulness, fairness, and transparency. section 3.15
- Purpose limitation and data minimization. section 3.15
- Accuracy and storage limitation. section 3.15
- Integrity, confidentiality, and accountability. section 3.15
Organizations must identify a lawful basis for processing personal data; consent is one possible basis, not the only one. Individuals have rights to information, access, correction, erasure, restricted processing, data portability, and objection, as well as rights concerning automated decision-making and profiling. These protections make data use a question of both organizational responsibility and individual control. section 3.15
ChatGPT and regulatory scrutiny
In March 2023, Italy’s data protection authority temporarily banned access to ChatGPT. It raised concerns about age verification, false information about individuals, transparency over data use, and the lawful basis for processing. The case illustrates why a useful AI service may still face questions about the personal data behind it. section 3.15
GDPR compliance is a baseline, not a complete answer to AI governance. AI systems can infer sensitive attributes, such as income estimates or risk scores, whose effects may be overlooked in practice. Organizations also need to address data quality, bias, and accountability across an AI system’s lifecycle. Users, meanwhile, should consider a service’s data policies before entering private information. section 3.18 section 10.18
