What lawful basis can a public authority use for AI that processes personal data?

Answered

Identify a purpose and lawful basis for each distinct processing operation. If you use AI in the exercise of official authority or to perform a public task set out by law, that is often the relevant basis for delivering public services. Public authorities can rely on legitimate interests only for a reason other than performing their tasks as a public authority. ICO AI guidance is under review after the Data (Use and Access) Act.

From the guidance

Primary (how) ICO: How do we ensure lawfulness in AI?

The development and deployment of AI systems involve processing personal data in different ways for different purposes. You must break down and separate each distinct processing operation, and identify the purpose and an appropriate lawful basis for each one, in order to comply with the principle of lawfulness.

Section: What should we consider when deciding lawful bases?

Read this in ICO: How do we ensure lawfulness in AI? (opens in new tab)

Secondary (normative) ICO: How do we ensure lawfulness in AI?

Similarly, if you use AI as part of the exercise of your official authority, or to perform a task in the public interest set out by law, the necessary processing of personal data involved may be based on those grounds. This is likely to be relevant to public authorities using AI to deliver public services.

Section: Can we rely on legal obligation, public task or vital interests?

Read this in ICO: How do we ensure lawfulness in AI? (opens in new tab)

Secondary (normative) ICO: How do we ensure lawfulness in AI?

Additionally, if you are a public authority you can only rely on legitimate interests if you are processing for a legitimate reason other than performing your tasks as a public authority.

Section: Can we rely on legitimate interests?

Read this in ICO: How do we ensure lawfulness in AI? (opens in new tab)

Related questions