The Limits of Legitimate Interests as a Legal Basis for Processing in Large Language Models: An Analysis Under the GDPR and EDPB Opinion 28/2024

The aim of this article is to assess the admissibility of relying on the ‘legitimate interests pursued by the controller’ under Article 6(1)(f) GDPR as a legal basis for the processing of personal data in large language models. The analysis is conducted, inter alia, in light of EDPB Opinion 28/2024, the positions adopted by national supervisory authorities (CNIL, Garante and AEPD), and the case law of the Court of Justice of the European Union, using the doctrinal legal analysis and systematic interpretation.

The findings indicate that reliance on Article 6(1)(f) GDPR for the training of LLMs may give rise to substantial difficulties in demonstrating the necessity of the processing and carrying out the balancing test, and may conflict with the principles of data minimisation and transparency. EDPB Opinion 28/2024 does not rule out reliance on this legal basis but requires a case-by-case assessment of its application at both the development and deployment stages, taking into account the nature and source of the data, the reasonable expectations of data subjects and the safeguards implemented.

The author concludes that reliance on this legal basis may be particularly difficult in the case of large-scale model training using data obtained from external sources, whereas at the inference stage it may be easier to demonstrate the limited and predictable nature of the processing. In each case, the applicable transparency requirements must be met, mechanisms enabling data subjects to exercise their rights must be provided, and the availability of alternative legal bases, such as consent or compliance with a legal obligation, must be assessed.