Data Subjects as Controllers: Violation of GDPR's Fairness Principle

MoFo’s Lokke Moerel and Marijn Storm published an article with IAPP discussing whether individuals can be considered controllers for their own inputs and outputs, when using LLM chatbots. In its recent discussion paper, the Hamburg data protection authority considers deployers of LLM chatbots to be responsible for their prompts and resulting output. If this opinion is followed and consumers themselves are qualified as controllers, all responsibilities under the GDPR are then transferred to the individual. The taskforce of the European Data Protection Board rightfully considers this risk transfer a violation of the GDPR's fairness principle.

The article is part 2 of a series on key data protection issues posed by large language models. Read the full article.

The previous article, titled “Using special categories of data for training LLMs: never allowed?”, focused on the “lawfulness” of web scraping for purposes of training a LLM. Read the full article.