歐盟AI訓練蒐用個資的合法性基礎——以GDPR正當利益條款為討論核心

The Legal Basis for the EU’s Processing of Personal Information in AI Training: Legitimate Interest of GDPR

AI發展依賴大量資料進行訓練，然而當AI訓練資料涉及個資時，如何在資料流通與隱私保護間取得平衡，成為法律討論的核心。歐盟「一般資料保護規則」（GDPR）第6條第（1）項2第（f）款「正當利益」（legitimate interest）條款提供在難以取得個人同意的情況下，符合三步驟檢驗法下，仍可合法蒐用個人資料的依據，因此正當利益概念在AI訓練資料庫蒐用個資的合法性爭議中扮演關鍵角色。本文將藉由歐盟資料保護委員會（EDPB）在2024年12月發布第28／2024號意見中，分析AI訓練資料庫運用個資如何適用GDPR第6條的正當利益條款，並回到國內相關個人資料保護法制，檢討正當利益條款用於AI訓練資料庫的可行性，讓資料利用和個人資料隱私保護更為周延。

The development of artificial intelligence (AI) relies on large datasets for training. However, when AI training data involves personal information, the legal debate arises as how to balance data flow with privacy protection. Article 6(1)(f) of the EU General Data Protection Regulation (GDPR) encompasses the“Legitimate Interest”clause, which stipulates that in the absence of the consent of the data subjects, the lawful processing of personal information is permitted by satisfying the criteria of“three step verification method.”This article examines how personal information in AI training databases can be used under the legitimate interest clause of Article 6 of the GDPR as discussed in Opinion No. 28/2024 by the EDPB. It will also consider domestic personal information protection laws to assess the feasibility of this approach for enhancing both data utilization and privacy protection.