France | Regulatory Framework
Status:
Effective: N/A
moderate CNIL synthesis of consultation inputs on legitimate interest for AI development
Synthesis of contributions — Public consultation: Practical AI sheets on relying on legitimate interest for AI system development
I. Regulatory Summary
AI developers relying on legitimate interest should operationalise a documented assessment workflow and evidence safeguards for large-scale training and web scraping, including minimisation and risk balancing. Where these conditions cannot be met, projects may need to shift to another legal basis (e.g., consent).
II. Full Description
This CNIL document provides a structured synthesis of responses to its public consultation on applying the GDPR to AI development. It concentrates on the practical sheets concerning (i) reliance on legitimate interest as a legal basis for developing AI systems and (ii) web scraping as a data collection method, and explains how feedback led CNIL to add clarifications and examples.
Dates: the cover indicates only the month/year (“June 2025”); this record stores 2025-06-01 for both adoption/publication to preserve month-level accuracy.
III. Scope & Application
Summarises stakeholder feedback received in CNIL’s public consultation on GDPR compliance in the development of AI systems, with a focus on relying on the legitimate interest legal basis and on data collection via web scraping. The document explains the CNIL’s clarifications and intended adjustments to the related practical guidance sheets.
IV. Policy Impact Assessment
AI developers relying on legitimate interest should operationalise a documented assessment workflow and evidence safeguards for large-scale training and web scraping, including minimisation and risk balancing. Where these conditions cannot be met, projects may need to shift to another legal basis (e.g., consent).
Primary Focus: data_protection_legal_basis