Supervisory Authority of Baden-Württemberg issues discussion paper on AI

The Data Protection Supervisory Authority of Baden-Württemberg (DPA BW) has published on 17 October 2024 its "Discussion Paper "Legal Basis of Data Protection when Applying AI - Using Data – Protecting Data, Version 2.0" to encourage and give comfort in using AI technologies, considering in particular the legal basis of processing personal data. The DPA BW discusses the principles and certain use cases (such as LLM models AI-based driver-assistance systems, employee data protection), and provides the structure to address five different areas: collecting training data, the actual training of algorithms, providing and use AI applications, and using AI generated output.

The DPA BW emphasizes the need for a proper legal basis such as consent, contract performance, performance of a legal obligation, or legitimate interest, as well as the need for regular risk assessment and the implementation of suitable technical and organisational measures. The DPA BW invigorates the principles of lawfulness of processing, transparency, purpose limitation, and data minimisation. The DPA BW dedicates a separate chapter on AI-based processing for scientific or historical research purposes, as well as for statistical purposes. As regards processing special categories of personal data, the DPA BW points at the need for "state-of-the art security and privacy-preserving measures, including pseudonymisation" (Art. 10 para. 5 AI Act) and the prerogative of consent-based processing.

The DPA BW concludes the paper with a helpful checklist on the different steps to run through before starting training algorithms.