On June 3, 2024, the European Data Protection Supervisor (EDPS) published guidelines on generative Artificial Intelligence (AI) and personal data for European Union (EU) institutions, bodies and agencies. The guidelines aim to help these organizations comply with the data protection obligations set out in Regulation (EU) 2018/1725 when using or developing generative AI tools. The guidelines are issued as part of the EDPS's data protection authority role and do not provide an interpretation of the AI Act.

The guidelines aim to cover a wide range of data processing scenarios, technologies and applications. In addition, the guidelines outline that Data Protection Impact Assessments (DPIAs) are necessary for high-risk processing operations, with regular monitoring to manage evolving risks.

Wojciech Wiewiórowski, EDPS, said: “The guidelines that I have issued today on generative AI are a first step towards more extensive recommendations in response to the evolving landscape of generative AI tools, which my team and I continue to monitor and analyse closely. Our advice published today is drafted with the aim of covering as many possible scenarios involving the use of generative AI, to provide enduring advice to EUIs so that they can protect individuals’ personal information and privacy.”

www.edps.europa.eu/...