CoChat
Sign Up
Cited by 16Digitalization, Law, and RegulationEthics and Social Impacts of AILaw, AI, and Intellectual Property

Generative AI and data protection

Open access
Ruschemeier, Hannah·2025·Cambridge Forum on AI: Law and Governance
DOI 10.1017/cfl.2024.2
Open this paper in CoChat — free accountOpen PDF

Abstract

Generative artificial intelligence (AI) has catapulted into the legal debate through the popular applications ChatGPT, Bard, Dall-E and others. While the predominant focus has hitherto centred on issues of copyright infringement and regulatory strategies, particularly in the context of the AI Act, a critical but often overlooked issue lies in the friction between generative AI and data protection laws. The rise of these technologies highlights unresolved tension between safeguarding fundamental protection rights and and the vast, almost universal, of scale of data processing required for machine learning. Large language models, which scrape nearly the whole Internet rely on and may even generate personal data falling under the GDPR. This tension manifests across multiple dimensions, encompassing data subjects’ rights, the foundational principles of data protection and the fundamental categories of data protection. Drawing on ongoing investigations by data protection authorities in Europe, this paper undertakes a comprehensive analysis of the intricate interplay between generative AI and data protection within the European legal framework.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1017/cfl.2024.2

Cites

6 of 6 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Because LLMs scrape nearly the entire internet for training datasets, they inevitably process personal data, creating a structural tension with fundamental privacy requirements such as the principle of data minimization.

    “Because these models scrape nearly the entire internet for training datasets, they inevitably process personal data, creating a structural tension with fundamental privacy requirements such as the principle of data minimization [4].”

    From Evaluation of NeMo Guardrails as a Firewall for User–LLM Interaction (2026) · cites this paper as [4]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 34

  1. Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016). Deep learning with differential privacy. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security - CCS (pp. 308-318).
  2. Ben-Shahar, O., & Schneider, C. E. (2011). The failure of mandated disclosure. University of Pennsylvania Law Review, 159, 647-749.
  3. Borgesius, F. J. Z., Kruikemeier, S., Helberger, N., & Helberger, N. (2017). Tracking walls, take-it-or-leave-it choices, the GDPR, and the ePrivacy regulation. European Data Protection Law Review, 3(3), 353-368.
  4. Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., … Amodei, D. (2020). Language models are few- shot learners. In Proceedings of the 34 th International Conference on Neural Information Processing Systems (pp. 1877-1901).
  5. Charlotin, D. (2023).Large language models and the future of law. SSRN Electronic Journal, Retrieved from. https://www.ssrn. com/abstract=4548258.
  6. Chen, S. (2024). Potential applications and safety of large language models in healthcare. Interdisciplinary Humanities and Communication Studies, 1(6), 1-5.
  7. Chiara, P. G. (2023). Italy: Italian DPA v. OpenAI's ChatGPT: The reasons behind the investigation and the temporary limitation to processing. European Data Protection Law Review, 9(1), 68-72.
  8. De, S. J., & Imine, A. (2020). Consent for targeted advertising: The case of Facebook. AI & SOCIETY, 35(4), 1055-1064.
  9. Donnelly, M., & McDonagh, M. (2019). Health research, consent and the GDPR exemption. European Journal of Health Law, 26(2), 97-119.
  10. Dwork, C. (2006). Differential privacy. In M. Bugliesi, B. Preneel, V. Sassone & I. Wegener (Eds.), Automata, Languages and Programming: 33rd International Colloquium, ICALP, Venice, Italy, July 10-14, 2006, Proceedings, Part II, (pp. 1-12).
  11. Eichenhofer, J. (2021). e-Privacy. Theorie Und Dogmatik Eines Europäischen Privatheitsschutzes Im Internet-Zeitalter: Jus Publicum, vol. 301.
  12. El Emam, K., & Alvarez, C. (2014). A critical appraisal of the article 29 working party opinion 05/2014 on data anonymization techniques. International Data Privacy Law, 5(1), 73-87.
  13. El Emam, K., Rodgers, S., & Malin, B. (2015). Anonymising and sharing individual patient data: BMJ (Clinical research ed.). BMJ (Clinical Research Ed.), 350, h1139.
  14. Gellert, R., & Gutwirth, S. (2013). The legal construction of privacy and data protection. Computer Law & Security Review, 29(5), 522-530.
  15. Georgieva, L., & Kuner, C. (2020). Art. 9 Processing of special categories of personal data. In C. Kuner, L. A. Bygrave, C. Docksey & L. Drechsler (Eds.), The EU General Data Protection Regulation (GDPR) (pp. 365-384). Oxford University Press.
  16. Gillotte, J. L. (2020). Copyright infringement in AI-generated artworks. UC Davis Law Review, 53(5), 2655-2691..
  17. Gupta, M., Akiri, C., Aryal, K., Parker, E., & Praharaj, L. (2023). From chatGPT to threatGPT: Impact of generative AI in cybersecurity and privacy. IEEE Access, 11, 80218-80245.
  18. Hacker, P. (2021). A legal framework for AI training data-from first principles to the Artificial Intelligence Act. Law, Innovation and Technology, 13(2), 257-301.
  19. Hondrich, L., & Ruschemeier, H. (2023). Addressing automation bias through verifiability. In EWAF'23: European Workshop on Algorithmic Fairness.
  20. Huang, K., Wang, Y., & Zhang, X. (2024). Foundations of Generative AI. In K. Huang, Y. Wang, B. Goertzel, Y. Li, S. Wright & J. Ponnapalli (Eds.), Generative AI Security: Theories and Practices (pp. 3-30). Springer.
  21. Kokott, J., & Sobotta, C. (2013). The distinction between privacy and data protection in the jurisprudence of the CJEU and the ECtHR. International Data Privacy Law, 3(4), 222-228.
  22. Mania, K. (2024). Legal protection of revenge and deepfake porn victims in the European Union: Findings from a comparative legal study. Trauma, Violence, & Abuse, 25(1), 117-129.
  23. Mühlhoff, R. (2020). Human-aided artificial intelligence: Or, how to run large computations in human brains? Toward a media sociology of machine learning. New Media & Society, 22(10), 1868-1884.
  24. Mühlhoff, R. (2023). Predictive privacy: Collective data protection in times of AI and big data. Big Data & Society, 10, 1-14. doi:10.1177/20539517231166886 · DOI · Paper page
  25. Mühlhoff, R., & Ruschemeier, H. (2024a). Predictive analytics and the collective dimensions of data protection. Law, Innovation and Technology, 16(1), 261-292.
  26. Mühlhoff, R., & Ruschemeier, H. (2024b). Regulating AI with purpose limitation for models. Journal of AI Law and Regulation, 1(1), 24-39.
  27. Nguyen, T. T., Backes, M., & Stock, B. (2022). Freely given consent? Studying consent notice of third-party tracking and its violations of GDPR in android apps. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, (New York, NY, USA: Association for Computing Machinery, 2022) (pp. 2369-2383).
  28. Nissenbaum, H. (2011). A contextual approach to privacy online. Daedalus, 140(4), 32-48.
  29. Pesch, P., & B ö hme. (2023). Verarbeitung personenbezogener daten und datenrichtigkeit bei großen sprachmodellen. Multimedia Und Recht, 16(12), 917-923.
  30. Ruschemeier, H. (2023b). The problems of the automation bias in the public sector -A legal perspective. In W. Institute (Ed.), Weizenbaum Conference Proceedings: AI, Big Data, Social Media and People on the Move, (Rochester, NY, 2023b) (pp. 59-69).
  31. Sag, M. (2023). Copyright safety for generative AI. Houston Law Review, 61(2), 295.
  32. Schreurs, W. J., Hildebrandt, M., Kindt, E., & Michaël, V. (2008). Cogitas, Ergo Sum. The role of data protection law and non- discrimination law in group profiling in the private sector. In M. Hildebrandt & S. Gutwirth (Eds.), Profiling the European Citizen (pp. 241-270). Springer.
  33. Solove, D. J. (2023). The limitations of privacy rights. Notre Dame Law Review, 98, 975.
  34. Zarsky, T. Z. (2017). Incompatible: The GDPR in the age of big data. Seton Hall Law Review, 47, 995-1020. Cite this article: Ruschemeier H. (2025). Generative AI and data protection. Cambridge Forum on AI: Law and Governance 1, e6, 1-16. https://doi.org/10.1017/cfl.2024.2

Cited by

Sorted by citations

Authors
Ruschemeier, H.
Affiliations
FernUniversität in Hagen (DE)
Corresponding author
Ruschemeier, Hannah
ORCID
Ruschemeier, Hannah
Venue
Cambridge Forum on AI: Law and Governance
Publisher
Cambridge University Press (CUP)
Published
2025
Volume
1
ISSN
3033-3733 (ISSN-L)
DOI
10.1017/cfl.2024.2
OpenAlex
W4406078368
Cited by
16
References
6
Citations by year
2026: 9 · 2025: 7
FWCI
100.15
Type
journal article
Language
en
Open access
Licence
Locations
Cambridge Forum on AI Law and Governance (publishedVersion, cc-by)
Topics
  • Social Sciences › Law › Digitalization, Law, and Regulation
  • Social Sciences › Safety Research › Ethics and Social Impacts of AI
  • Physical Sciences › Computer Science › Artificial Intelligence › Law, AI, and Intellectual Property
Keywords
generative AI, data protection law, GDPR, large language models, personal data, fundamental rights, data protection principles, data protection authorities, ChatGPT, EU AI Act, machine learning training data

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review