Balancing Innovation and Data Protection - An analysis of legal basis under the GDPR for the training of artificial intelligence
(2025) HARN63 20251Department of Business Law
- Abstract
- This master thesis investigates the legal foundations for training of artificial intelligence (AI) models using personal data, with an emphasis on compliance with the European Union’s General Data Protection Regulation (GDPR). The core issue addressed is the lack of clear legal basis for AI training processes that involve the collection and use of personal data (gathered directly or indirectly through web scraping, data brokers, and other means), which can result in unlawful practices and infringements of data subjects’ rights. AI systems, in general, and the training phase in particular, is first described from a legal perspective. Current academic works related to the topic is then reviewed, and all relevant provisions, which can be... (More)
- This master thesis investigates the legal foundations for training of artificial intelligence (AI) models using personal data, with an emphasis on compliance with the European Union’s General Data Protection Regulation (GDPR). The core issue addressed is the lack of clear legal basis for AI training processes that involve the collection and use of personal data (gathered directly or indirectly through web scraping, data brokers, and other means), which can result in unlawful practices and infringements of data subjects’ rights. AI systems, in general, and the training phase in particular, is first described from a legal perspective. Current academic works related to the topic is then reviewed, and all relevant provisions, which can be considered as legal bases, have been analysed in detail, especially Article 6(1) of GDPR. The study further examines specific approaches in various countries, along with established case law, to provide a clear view of the status quo. The relevance and applicability of current regulations as legal basis for AI training have been thoroughly examined, and potential weak points have been identified and presented as a guideline. The thesis concludes with recommendations for establishing a framework to ensure regulatory compliance and consistency between supervisory authorities and the development of AI systems. (Less)
- Popular Abstract
- Artificial intelligence (AI) is transforming our world, but what happens when it learns from our personal data? This thesis explores the complex relationship between AI training and the General Data Protection Regulation (GDPR). It examines the legal uncertainties surrounding the use of personal data to train AI systems, particularly when data is gathered through web scraping. By analyzing current laws, reviewing academic debates, and comparing supervisory authorities' approaches across countries, the research uncovers the challenges and grey areas in the regulations. The thesis not only highlights where the rules fall short but also offers practical recommendations to help policymakers and AI developers create a fair and consistent legal... (More)
- Artificial intelligence (AI) is transforming our world, but what happens when it learns from our personal data? This thesis explores the complex relationship between AI training and the General Data Protection Regulation (GDPR). It examines the legal uncertainties surrounding the use of personal data to train AI systems, particularly when data is gathered through web scraping. By analyzing current laws, reviewing academic debates, and comparing supervisory authorities' approaches across countries, the research uncovers the challenges and grey areas in the regulations. The thesis not only highlights where the rules fall short but also offers practical recommendations to help policymakers and AI developers create a fair and consistent legal framework. The goal is to ensure that AI can grow responsibly while protecting our rights. (Less)
Please use this url to cite or link to this publication:
http://lup.lub.lu.se/student-papers/record/9215790
- author
- Almammadova, Aytaj LU
- supervisor
- organization
- course
- HARN63 20251
- year
- 2025
- type
- H1 - Master's Degree (One Year)
- subject
- keywords
- Artificial intelligence, training phase, lawfulness, GDPR, legal basis, web scraping, personal data
- language
- English
- id
- 9215790
- date added to LUP
- 2025-12-01 12:22:26
- date last changed
- 2025-12-01 12:22:30
@misc{9215790,
abstract = {{This master thesis investigates the legal foundations for training of artificial intelligence (AI) models using personal data, with an emphasis on compliance with the European Union’s General Data Protection Regulation (GDPR). The core issue addressed is the lack of clear legal basis for AI training processes that involve the collection and use of personal data (gathered directly or indirectly through web scraping, data brokers, and other means), which can result in unlawful practices and infringements of data subjects’ rights. AI systems, in general, and the training phase in particular, is first described from a legal perspective. Current academic works related to the topic is then reviewed, and all relevant provisions, which can be considered as legal bases, have been analysed in detail, especially Article 6(1) of GDPR. The study further examines specific approaches in various countries, along with established case law, to provide a clear view of the status quo. The relevance and applicability of current regulations as legal basis for AI training have been thoroughly examined, and potential weak points have been identified and presented as a guideline. The thesis concludes with recommendations for establishing a framework to ensure regulatory compliance and consistency between supervisory authorities and the development of AI systems.}},
author = {{Almammadova, Aytaj}},
language = {{eng}},
note = {{Student Paper}},
title = {{Balancing Innovation and Data Protection - An analysis of legal basis under the GDPR for the training of artificial intelligence}},
year = {{2025}},
}