EU Trends and Developments Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
Lawfulness, purpose limitation and continuous model optimisation AI-driven SaaS platforms frequently rely on continu - ous data ingestion to refine models and optimise outputs. This is even more the case where AI agents are deployed across enterprise-level infrastructure. In practice, optimisation capacity is closely linked to the scale and diversity of data processed. In all cases, data collected for one operational purpose is often reused for analytics enhancement or behavioural cali - bration. This dynamic directly engages Article 5 (1)(b) (purpose limitation), Article 5 (1)(c) (data minimisation) and Article 6 (lawful basis) of the GDPR. Under Article 6 (4), further processing must be assessed for compatibility with the original purpose. The CJEU has consistently emphasised strict adher - ence to purpose boundaries. In Bara (Case C-201/14), the CJEU held that repurposing personal data without proper notification and legal basis violates transparen - cy principles. In Breyer (Case C-582/14), it confirmed that even dynamic IP addresses may constitute per - sonal data where identification is reasonably possible. Supervisory authorities are increasingly sceptical of broad reliance on legitimate interests under Article 6 (1)(f) for large-scale AI optimisation. Generic referenc - es to “service improvement” or “innovation” are argu - ably insufficient where processing materially affects individuals or involves behavioural profiling. Necessity and proportionality must be demonstrated concretely. For non-European technology companies accus - tomed to expansive contractual data licences, this represents a structural compliance shift. European data protection law does not treat contractual permis - sion as determinative of lawfulness. As confirmed in Meta Platforms (Case C-252/21), contractual framing cannot artificially broaden processing beyond what is objectively necessary. Continuous optimisation models therefore sit in inher - ent tension with purpose limitation required under GDPR. Governance frameworks and product design must therefore anticipate this structural constraint.
Transparency, fairness and the substantive legitimacy of AI processing As AI systems increasingly mediate access to ser - vices, information and economic opportunities, the legitimacy of processing turns not only on lawful basis and purpose limitation, but equally on transparency and fairness – two structural principles of EU data protection law. Transparency under Articles 13–15 GDPR and fairness under Article 5 (1)(a) are not ancil - lary disclosure obligations. They operationalise the fundamental right to data protection and structure the relationship between organisations and individu - als whose data is processed. In AI contexts, transparency operates as a precon - dition of legitimate deployment. Where individuals cannot meaningfully understand the nature, logic or implications of automated systems affecting them, the substantive lawfulness of processing becomes difficult to sustain. Legitimacy under the GDPR is not secured through formal compliance alone; it depends on whether processing remains aligned with reason - able expectations and fundamental rights protections. The CJEU’s jurisprudence reinforces this orientation. In Meta Platforms (Case C-252/21), the court clarified that reliance on contractual necessity under Article 6 (1)(b) requires objective necessity, not strategic draft - ing. More broadly, the judgment confirms that fairness functions as a substantive constraint on how process - ing operations are structured and justified. It is not merely a formal recital-level principle. These principles have concrete implications for AI systems that infer preferences, assign behavioural risk categories, personalise outputs or structure oppor - tunities in ways that materially influence individuals. Generic disclosures or abstract descriptions of “AI use” may fail to satisfy transparency and fairness requirements. Supervisory authorities increasingly assess whether individuals receive intelligible expla - nations of the logic involved and the foreseeable con - sequences of profiling or automated evaluation. Transparency obligations under Articles 13–15, GDPR require the provision of meaningful information about the logic involved, as well as the significance and envisaged consequences of processing. While
106 CHAMBERS.COM
Powered by FlippingBook