Guide on Generative Artificial Intelligence and the Protection of Personal Data Published

The Personal Data Protection Authority has published a new guide titled “Guide on Generative Artificial Intelligence and the Protection of Personal Data (In 15 Questions)” (Guide) with the aim of evaluating generative artificial intelligence technologies in terms of personal data protection. 

The Guide outlines fundamental concepts regarding personal data processing activities that may arise during the development and use of generative artificial intelligence systems and provides guidance on how these activities should be addressed within the framework of the Law on the Protection of Personal Data No. 6698.

Key points are summarized below:

• Personal data processing activities in generative artificial intelligence systems may occur directly or indirectly during the training, usage, and output generation phases of the system.
• It is stated that the identification of the roles of data controller and data processor should be determined through a contextual assessment based on the nature, scope, and actual roles of the parties involved in the data processing activity.
• The Guide emphasizes the necessity of compliance with fundamental principles such as lawfulness, transparency, and accuracy and timeliness in the processing of personal data.
• Attention is drawn to risks such as hallucinations, bias, data security breaches, and intellectual property rights issues, and technical and administrative measures for mitigating these risks are set out. 
• It is noted that outputs produced by generative artificial intelligence systems may not always be accurate or reliable, and thus the importance of human verification of such outputs is underlined.
• The Guide also evaluates key considerations for individuals using generative artificial intelligence tools in their daily lives, including specific safeguards for children’s use of such technologies.