Comments to the ICO on Generative AI

In this submission, the Center argues that the UK’s Information Commissioner’s Office should refine how it applies the purpose limitation principle to the development and deployment of generative AI models. The purpose limitation principle states that organizations should only collect and process data for specified, explicit, and legitimate purposes. However, the ICO should not attempt to apply this principle to general purpose generative AI models where, by definition, the various potential uses of these models are unknown. Instead, it should apply this principle to organisations that fine-tune models for deployment. Specifically, we make the following points:

1. The ICO should clarify its generative AI model lifecycle;
2. The ICO should clarify what is required of organisations in order to perform the compatibility assessment;
3. The ICO should reframe the purpose limitation principle to reflect the nature of generative AI model development; and
4. The ICO should only apply the purpose limitation principle at the deployment stage in the generative AI model lifecycle.

Read the comments.