In a recent talk I attended, a legal expert advised against inputting personal data into artificial intelligence (AI) models. But is this blanket statement truly accurate?

Reading the room, recent discussions surrounding artificial intelligence (AI) have sparked concerns about the use of personal data.

While some experts advise complete avoidance, the reality is more nuanced, especially when viewed through the lens of the General Data Protection Regulation (GDPR), the gold standard for personal data protection. This article delves into how GDPR compliance intersects with the use of personal information in Large Language Models (LLMs) – the cutting-edge AI technology behind tools like ChatGPT.

Understanding Large Language Models

AI is a vast field, but our focus here is on GPT-style LLMs – the powerhouse technology driving services from OpenAI, Google, Microsoft, and Anthropic. These models represent the forefront of AI advancement, capable of understanding and generating human-like text.

How LLMs Work

LLM deployment involves two key stages: training and inference. Training is a complex, highly technical, and data-intensive process handled by a select few. Inference, on the other hand, is the act of using the model, and accessible to millions. Each time you interact with a chatbot, pose a question to ChatGPT, or use an AI-powered writing tool, you’re engaging in inference.

The GDPR and Personal Data in Inference Dilemma

Can you safely input personal data during inference? The answer: it depends. The LLM itself doesn’t retain data from your interactions. Your input and the model’s output are not recorded, stored or remembered. This means that if both input and output adhere to GDPR guidelines, and the LLM’s modifications to the data are legally permissible, using personal data can be safe.

Key Considerations

1. Data Retention Policies: While the LLM doesn’t store data, the model provider might. Understanding their data retention policies is crucial.
2. Data Leaks: There’s always a risk of data leaks during transmission.
3. GDPR Compliance: Ensure your LLM provider adheres to GDPR and other relevant standards.

Mitigating Risks

One approach to mitigating these risks, which I recommend, is using private LLMs that are hosted within your own controlled environment. This gives you complete control over data handling. When using the LLM, GDPR-controlled data exists briefly in the system’s memory before being cleared for the next request. This process is similar to how a database temporarily loads information to display on a screen.

LLMs and GDPR Compliance

LLMs, like any data-handling software, must adhere to GDPR principles: lawfulness, fairness, transparency, and purpose limitation – in other words it’s conducted for specified, explicit, and legitimate purposes. This requires careful consideration of how you utilise the LLM.

Recommended reading

• Scotland’s Synthetic Data Journey
• ICO Joins Global Data Protection Enforcement Programme
• ICO Publishes New Data Protection Fining Guidance

At smartR AI, we prioritise transparency and fairness by designing LLM data transformations that can be independently reproduced without the model. This approach, akin to traditional software development, enhances validation and ensures compliance.

Using LLMs in a GDPR-compliant manner is entirely feasible and achievable. While data storage during inference isn’t a major concern, the focus should be on how you transform the data, and ensuring you know the data retention policy of your LLM provider is compliant to GDPR. By prioritising transparency and fairness in your LLM’s operations, you can harness this powerful technology while safeguarding personal data and upholding data protection regulations.