The Limits of Legitimate Interests as a Legal Basis for Processing in Large Language Models: An Analysis Under the GDPR and EDPB Opinion 28/2024
References
- Agencia Española de Protección de Datos, ‘Abordando conceptos erróneos de la Inteligencia Artificial’, 11 March 2025; https://www.aepd.es/prensa-y-comunicacion/blog/abordando-conceptos-erroneos-de-la-inteligencia-artificial (accessed: 20 July 2025).
- Article 29 Data Protection Working Party, Opinion 06/2014 on the Notion of Legitimate Interests of the Data Controller under Article 7 of Directive 95/46/EC, WP 217, 9 April 2014; https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf (accessed: 30 June 2025).
- Barberá I., Popa-Fabre M., Privacy and Data Protection Risks in Large Language Models (LLMs), Council of Europe, Strasbourg, 2025; https://rm.coe.int/privacy-and-data-protection-risks-in-large-language-models-llms-/1680b68fe9 (accessed: 10 July 2025).
- Carlini N., Tramèr F., Wallace E., Jagielski M., Herbert-Voss A., Lee K., Roberts A., Brown T., Song D., Erlingsson Ú., Oprea A., Raffel C., ‘Extracting Training Data from Large Language Models’, in: 30th USENIX Security Symposium (USENIX Security 21), 2021; https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting (accessed: 10 July 2025).
- Commission nationale de l’informatique et des libertés, ‘Artificial Intelligence: The Action Plan of the CNIL’, 16 May 2023; https://www.cnil.fr/en/artificial-intelligence-action-plan-cnil (accessed: 10 July 2025).
- Commission nationale de l’informatique et des libertés, ‘Relying on the Legal Basis of Legitimate Interests to Develop an AI System’, 5 January 2026; https://www.cnil.fr/en/relying-legal-basis-legitimate-interests-develop-ai-system (accessed: 10 July 2026).
- DataGuidance, ‘Spain: AEPD Initiates Investigation into OpenAI’, 14 April 2023; https://www.dataguidance.com/news/spain-aepd-initiates-investigation-openai (accessed: 10 July 2025).
- Data Protection Commission, ‘Data Protection Commission announces commencement of inquiry into X Internet Unlimited Company (XIUC)’, 11 April 2025; https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-announces-commencement-inquiry-x-internet-unlimited-company-xiuc (accessed: 26 August 2026).
- European Commission, Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725 and (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as Regards the Simplification of the Digital Legislative Framework, and Repealing Regulations (EU) 2018/1807, (EU) 2019/1150 and (EU) 2022/868 and Directive (EU) 2019/1024 (Digital Omnibus), COM(2025) 837 final, Brussels, 19 November 2025; https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0837 (accessed: 28 July 2026).
- European Data Protection Board, Guidelines 05/2020 on Consent under Regulation 2016/679, Version 1.1, adopted on 4 May 2020; https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en (accessed: 10 July 2025).
- European Data Protection Board, Guidelines 1/2024 on Processing of Personal Data Based on Article 6(1)(f) GDPR, Version 1.0, adopted on 8 October 2024; https://www.edpb.europa.eu/public-consultations/guidelines-12024-on-processing-of-personal-data-based-on-article-61f-gdpr_en (accessed: 4 September 2026).
- European Data Protection Board, Guidelines 03/2026 on Web Scraping in the Context of Generative AI; Version 1.0, adopted on 7 July 2026; https://www.edpb.europa.eu/system/files/2026-07/edpb_guidelines_2020603_webscraping_v1_en_0.pdf (accessed: 25 August 2026).
- European Data Protection Board, Opinion 28/2024 on Certain Data Protection Aspects Related to the Processing of Personal Data in the Context of AI Models, adopted on 17 December 2024; https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en (accessed: 19 June 2025).
- European Data Protection Board, European Data Protection Supervisor, EDPB-EDPS Joint Opinion 2/2026 on the Proposal for a Regulation as Regards the Simplification of The Digital Legislative Framework (Digital Omnibus), adopted on 10 February 2026; https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_edps_jointopinion_202602_digitalomnibus_en.pdf (accessed: 4 September 2026).
- Klein A., Kazandjian G., Valentini M., Salerno M., Kuchar B., Mertinz A., Bauer S.C., Hell-mich S., Kuß C., ‘Digital / Tech and Data – The World and AI: ChatGPT – Challenges in France, Austria, Germany and Italy’, Unyer Newsflash, May 2023; https://www.unyer.com/wp-content/uploads/2023/05/unyer-NL-IPIT_Tech-and-Data_2023_May-2023.pdf (accessed: 22 July 2025).
- Kuner C., Bygrave L.A., Docksey C., Drechsler L. (eds), The EU General Data Protection Regulation (GDPR): A Commentary, Oxford, 2020.
- Kuru T., ‘Lawfulness of the Mass Processing of Publicly Accessible Online Data to Train Large Language Models’, International Data Privacy Law, 2024, Vol. 14, No. 4.
- Lubasz D., RODO dla AI. Zgodność z zasadami godnej zaufania sztucznej inteligencji w modelu data protection by design, Warszawa, 2025.
- ODO Serwis, ‘Garante zezwala OpenAI na przywrócenie ChatGPT’, 5 May 2023; https://odoserwis.pl/a/1929/garante-zezwala-openai-na-przywrocenie-chatgpt (accessed: 20 June 2025).
- Parviainen H., ‘Can Algorithmic Recruitment Systems Lawfully Utilise Automated Decision--Making in the EU?’, European Labour Law Journal, 2022, Vol. 13, No. 2.
- Proposal for a regulation of the European Parliament and of the Council amending Regulations (EU) 2016/679, (EU) 2018/1724, (EU) 2018/1725, (EU) 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework, and repealing Regulations (EU) 2018/1807, (EU) 2019/1150, (EU) 2022/868, and Directive (EU) 2019/1024 (Digital Omnibus), COM(2025) 837 final.
- Raposo V.L., ‘The AI Gospel according to the EDPB – An Overview of Opinion 28/2024 on Data Protection Aspects in AI Models’, Computer Law & Security Review, 2026, Vol. 61, article number 106300; https://www.sciencedirect.com/science/article/pii/S2212473X26000416?via%3Dihub (accessed: 26 August 2026).
- Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI), OJ L 2026/1744, 24.7.2026, ELI: http://data.europa.eu/eli/reg/2026/1744/oj.
- Vaezi A., ‘Legal Challenges in the Deployment of Large Language Models: A Comparative Analysis under the GDPR and EU AI Act’, 1 June 2025, SSRN; https://doi.org/10.2139/ssrn.5285174 (accessed: 28 July 2026).
- Wachter S., Mittelstadt B., ‘A Right to Reasonable Inferences: Re-Thinking Data Protection Law in the Age of Big Data and AI’, Columbia Business Law Review, 2019, No. 2.
DOI: https://doi.org/10.2478/in-2026-0031 | Journal eISSN: 2545-0271
Language: English
Page range: 105 - 128
Published online: Oct 28, 2026
Published in print: Sep 1, 2026
Published by: Lazarski University Publishing House
In partnership with: Paradigm Publishing Services
Publication frequency: 4 issues per year
Keywords:
Related subjects:
© 2026 Agnieszka Grzelak, published by Lazarski University
This work is licensed under the Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.