On November 13, 2023, the Baden-Württemberg data protection authority (LfDI Baden-Württemberg) published a discussion paper on the legal basis for data protection when using artificial intelligence (AI) and invited public comments on the same. In particular, the LfDI Baden-Württemberg stated that the focus of the discussion paper is on the question of when and how personal data may be processed for the training and application of AI. The discussion paper, among other things, provides a short checklist for data processing when using AI, the legal basis of processing for public and private bodies, and the processing of special categories of personal data.

Additionally, the LfDI Baden-Württemberg stated that the discussion paper is not a final data protection assessment of the use of AI, but rather a working aid to better locate specific application scenarios within the legal framework and is intended to help responsible bodies in Baden-Württemberg to deal with the legal basis that current data protection law provides for the use of AI systems. The discussion paper further clarifies that it only covers the permissions required for the processing of personal data and the topics of transparency and non-discrimination (bias) of the AI systems, rights of those affected, data security, and data protection by design are not addressed and may be reserved for further discussion papers.

Public comments can be submitted here until February 1, 2024.

You can read the press release here and the discussion paper here, both only available in German. 

Update: January 24, 2024

LfDI Baden-Württemberg publishes AI discussion paper in English

On January 23, 2024, LfDI Baden-Württemberg published the AI discussion paper in English. 

You can read the discussion paper here.

Update: October 18, 2024

LfDI Baden-Württemberg publishes version 2 of AI discussion paper

On October 17, 2024, LfDI Baden-Württemberg published version 2 of the discussion paper. 

Version 2 of the discussion paper contains feedback from practitioners and citizens who took part in the discussion. For instance, when presenting the legal bases, version 2 of the discussion paper differentiated more clearly between the individual processing phases, provided that certain special features arise in the context. Version 2 of the discussion paper puts particular emphasis on the extensive revision of Article 6(1)(f) of the GDPR, as this legal basis is particularly important in practice and offers corresponding scope for design for data-processing AI systems.

LfDI Baden-Württemberg noted that the discussion is still in flux and the new considerations are a work in progress that may need to be reassessed in the context of further expected guidance at the national and the EU level.

You can read the press release here and version 2 of the discussion paper here, both only available in German.