The Information Commissioner’s Office (ICO) has launched a series of public consultations on generative artificial intelligence (GenAI), looking at how aspects of data protection law should apply to the technology’s development and use.

Generative AI models are being widely used by businesses and people to create new content, from text, to images, to code. The first consultation examines when it is lawful to train generative AI models, which typically require massive datasets, on personal data scraped from the web.

This first consultation is open until 1 March 2024, with stakeholders who have an interest in generative AI—including developers and users of GenAI, legal advisors and consultants working in this area, as well as civil society groups and other public bodies—encouraged to respond to help inform the regulator’s position.

Future consultations, which will examine other related areas such as the accuracy of generative AI outputs, will be launched throughout the first half of 2024.

As the UK’s data protection and information rights regulator, the ICO can take action to address and change the behaviour of organisations and individuals that collect, use, and keep personal information—including criminal prosecution, non-criminal enforcement, and audit.

Speaking on GenAI and the consultations, Stephen Almond, executive director for regulatory risk at the ICO, said: “The impact of generative AI can be transformative for society if it’s developed and deployed responsibly.

“This call for views will help the ICO provide industry with certainty regarding its obligations and safeguard people’s information rights and freedoms.”

Recommended reading

• Report: Scottish Employers Hesitant About GenAI
• Exploitation of GenAI a Stark Concern for IT Experts
• Are UK Consumers Ready for Businesses to Adopt AI?

Following the surge in the interest and usage of generative AI since November 2023, when artificial intelligence company OpenAI unveilled ChatGPT to the public, artificial intelligence has become a more prominent focus for the data protection regulator.

With these consultations, it said that it seeks to move fast to address risks but also enable businesses and the public to benefit from GenAI.