Foreword and summary
Welcome to our second consultation response. In this response we have taken stock of what the purpose limitation means, why it's important and how it should work with generative artificial intelligence ("GenAI"). We have reached the view that the purpose limitation is extremely important to the successful operation of any data protection legal system, but the old (twentieth century) way of applying the purpose limitation can’t work for GenAI. It is very hard to be explicit and specific about how a GenAI model will use personal data because, by its nature, GenAI is creative. What it creates is a response to unpredictable inputs and it works on a scale never before seen. The purpose limitation cannot, at least in the conventional sense, be achieved in the same way. So, cutting to the chase, what should we do? To be more precise, what should organisations developing and using GenAI do to comply with the purpose limitation? Without giving away the detailed responses, we think they need to communicate in a clear and meaningful way what the GenAI systems capabilities are or explain the effect it may have in a particular context. This is a simple solution, but an effective one. Through public notices, supplier commitments or via enhanced regulation and transparency duties, organisations can explain how and why they process personal data in GenAI systems development and use, enabling the average person to check what’s going on and in theory to object to the processing of their data. If this can’t be achieved (and to be clear, we can’t think of a good reason why it can’t be achieved) then the purpose limitation should be reframed to enable GenAI to fit. You may be interested to know that this group’s thought processes were less equivocal than with consultation one. We didn't always see things the same way, but we took time to listen to each others' opinions and to debate the nature of purpose limitation in this unique context. I would like to thank each contributor for taking to time out of their busy schedules to read, think, study and debate this topic. You are a brilliant and inspirational group and I feel blessed to work with you. I hope this document accurately reflects your thoughts on this important legal topic, and that the ICO takes your message on board. Sincerely yours,
Matthew Holman
Partner Technology, data and AI matthew.holman@cripps.co.uk +44 (0)20 7591 3353