| name | ai-training-lawfulness |
| title | Lawful Basis for AI Training Data |
| description | Assesses lawful basis for AI training data processing per EDPB April 2025 report on LLMs and general-purpose AI. Covers legitimate interest balancing tests, consent challenges for ML training, public dataset assessment, and web scraping lawfulness. Keywords: AI training data, lawful basis, EDPB LLM, legitimate interest, consent, web scraping. |
| author | onfire7777 |
| author_url | https://github.com/onfire7777/universal-ai-skills-library/tree/main/skills/ai-training-lawfulness |
| license | MIT |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Lawful Basis for AI Training Data
Overview
The processing of personal data for AI model training constitutes a distinct processing operation requiring its own lawful basis under GDPR Art. 6(1). The EDPB Guidelines 04/2025 and the coordinated ChatGPT Taskforce findings establish that AI training creates unique lawful basis challenges: the scale of data collection, the difficulty of obtaining meaningful consent for open-ended AI training purposes, the tension between legitimate interest and data subject expectations, and the complexity of determining lawfulness for web-scraped and third-party datasets. This skill provides the comprehensive lawful basis assessment framework for AI training data processing, addressing each Art. 6(1) basis as applied to ML training contexts.
Fundamental Principles
AI Training as Personal Data Processing
The EDPB has confirmed that AI model training constitutes processing of personal data under Art. 4(2) GDPR when:
- Training datasets contain personal data (directly or indirectly identifiable natural persons)
- The model is trained on data that includes personal data, even if the intent is to learn general patterns
- The resulting model retains the capability to generate or reproduce personal data from training sets
- Personal data is used in any pipeline stage: collection, cleaning, annotation, augmentation, validation, testing
The controller cannot avoid GDPR obligations by claiming the model has "learned" rather than "stored" personal data. The processing occurs at the point of training, regardless of whether the model can later reproduce specific records.
Purpose Specification for AI Training
Art. 5(1)(b) requires that personal data be collected for specified, explicit, and legitimate purposes. For AI training, this means:
- "Training an AI model" is insufficiently specific — the controller must articulate the specific capability being developed
- "Improving our services" through AI training must be disaggregated into concrete purposes
- Each purpose must be documented before training begins, not retroactively justified
- The purpose must be communicated to data subjects in privacy notices per Arts. 13-14
Lawful Basis Analysis for AI Training
Art. 6(1)(a) — Consent
Requirements for Valid AI Training Consent
| Requirement | AI Training Application |
|---|
| Freely given | Data subjects must have genuine choice; consent cannot be bundled with service access unless AI training is necessary for the service |
| Specific | "AI training" alone is insufficient — must specify what type of model, for what purpose, what data elements are used |
