Many discussions about artificial intelligence treat data protection as bureaucratic friction. In practice the friction points are real and technical, and ignoring them produces systems that have to be redesigned.
Minimisation versus \u201cmore data is better\u201d
The minimisation principle requires collecting only data necessary for the stated purpose. The technical culture of machine learning pushes the other way: more variables, more history, more examples.
The friction resolves through a question asked at the start rather than the end: does this variable measurably improve the result? If it has not been tested, it is not collected.
Purpose limitation versus data reuse
Data collected for one purpose cannot automatically be used for another, incompatible one. Training a model on data collected for something else is precisely the situation in view.
That does not make it impossible — it means compatibility of purposes must be assessed and, often, the individuals concerned informed.
The right to erasure versus a trained model
What happens to a model trained on the data of someone who requests erasure? The data is no longer in the training set, but its influence is distributed across the model's parameters.
There is no simple answer. In practice, approaches range from periodic retraining to unlearning techniques with known limits. What matters is that the problem is anticipated at design time, not discovered at the first request.
Automated decisions and the right to human intervention
The regulation restricts decisions based solely on automated processing that produce legal or similarly significant effects. The individual has the right to human intervention, to express their point of view and to contest the decision.
The critical word is \u201csolely\u201d. A human who automatically approves whatever the system proposes, without the information and the authority to decide otherwise, does not turn the decision into a human one. Oversight has to be effective, not decorative.
Transparency towards the individual
The individual has the right to be informed that an automated decision exists and about the logic involved. \u201cThe logic involved\u201d does not mean source code or network architecture — it means an intelligible explanation of the factors that matter.
Impact assessment
Where processing presents a high risk to individuals' rights, a data protection impact assessment is required before it begins. Many AI systems that assess people fall into this category.
The assessment is not a form. It is the document in which the organisation explains what it does, what can go wrong, what it did to reduce the risk, and what residual risk remains — and accepts.
Worth doing
- Map the personal data used in each system, with its legal basis.
- Check whether the current purpose is compatible with the original collection purpose.
- Document what human oversight concretely means: what the operator sees, what they can change, in what time.
- Prepare in advance for an access or erasure request — including the awkward part about models already trained.
Informational article, not legal advice.