Why AI governance runs on privacy law

Lesson 1 of 6 in Privacy and Data Protection Law for AI: GDPR from Scratch.

Before the EU AI Act existed, before NIST wrote a framework, before anyone said "responsible AI" in a boardroom — AI systems were already regulated. Not by AI law, but by data protection law, because almost every consequential AI system runs on personal data: the training corpus, the features, the outputs, the logs.

The regulators proved it early. Italy’s Garante ordered ChatGPT suspended in March 2023 — the first regulatory action against a frontier model anywhere — using nothing but the GDPR, a law written before large language models existed. Clearview AI, which scraped billions of face photos to build a search engine for police, has been fined €20 million or more by data protection authorities in France, Italy, Greece, and the Netherlands, again under GDPR alone. Privacy law is the incumbent AI law, and it applies today, everywhere, at every risk tier.

That is why this module exists. AIGP Domain II, the EU AI Act’s FRIA, DPIAs in your operations toolkit — all of them assume you already speak GDPR. This module teaches it from scratch, then crosses the Atlantic to CCPA/CPRA and California’s automated decision-making rules.

Read that definition the way a regulator does: "any information" and "identifiable" are both deliberately vast. A device ID is personal data. An IP address usually is. A cluster label like "customer segment 47" is, the moment it can be linked back to a person. Pseudonymised data — names swapped for tokens — is still personal data, because the link can be restored. Only truly anonymised data escapes the GDPR, and the bar is high: if anyone, using means reasonably likely to be used, can re-identify the person, it is not anonymous.

For AI this has a consequence people keep re-discovering the hard way: a model trained on personal data may itself contain personal data. Researchers have extracted training examples — names, emails, phone numbers — from large language models via membership inference and extraction attacks. The EDPB confirmed in Opinion 28/2024 that an AI model trained on personal data is not automatically anonymous: anonymity must be demonstrated case by case, considering the likelihood of extracting or regurgitating the data. Get this wrong and the entire GDPR applies to your model file.

Two roles then organise every obligation in the statute. The controller decides the purposes and means of processing — why and how essentially. The processor processes personal data on the controller’s behalf, under instructions. Duties, liability, and fines track these roles, and in an AI supply chain they get genuinely tricky: a foundation-model provider is typically a controller for its own training, while a cloud vendor fine-tuning a model strictly on a customer’s instructions is that customer’s processor. Two organisations that jointly decide purposes — say, co-developing a shared fraud model — are joint controllers under Article 26 and must allocate responsibilities in writing.

Key terms: controller, processor, lawful basis, special category data, data protection impact assessment, GDPR Article 22

Interactive sorting exercise: Assign the GDPR role each organisation plays in these AI scenarios.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.