Polish data protection office guides businesses on legal AI use

The Polish Personal Data Protection Office (UODO) has released a guide to help businesses, particularly SMEs, navigate the legal complexities of using artificial intelligence tools. The guidance, published in August, provides a set of questions designed to assist entrepreneurs in determining whether their use of AI complies with personal data protection regulations.

UODO emphasizes that each application of an AI tool must be analyzed separately before purchase or implementation. The same AI system can pose different risks depending on its function, whether it's generating marketing texts, handling customer service, or aiding in recruitment. Entrepreneurs are advised to first identify the specific problem the AI is intended to solve and evaluate if AI is truly necessary.

Key considerations include assessing the benefits and risks of the planned AI use and, crucially, determining what information will be fed into the system. Businesses must ascertain if employees will input personal data of clients, staff, job candidates, or contractors. Special caution is required for sensitive data, such as health or children's information.

If personal data is to be processed by the AI, companies must establish a legal basis for this processing in accordance with GDPR. UODO also reminds businesses of their obligation to inform all individuals whose data is being processed via AI. Furthermore, understanding how the AI provider handles the transmitted information, including whether it's used for training models, how long it's stored, and if it's shared with third parties, is essential. The office also highlights the importance of the contract between the company and the AI provider, potentially requiring a data processing agreement if the provider acts on the company's behalf. Reviewing service terms and privacy policies, and verifying server locations and data transfer practices outside the European Economic Area, are also critical steps.