Data Subject Rights for AI Systems

Overview

AI systems create unique challenges for data subject rights exercise. Traditional rights mechanisms designed for structured databases do not map directly to ML model architectures where personal data is encoded in model weights, reproduced in model outputs, or used in opaque decision processes. This skill provides the framework for implementing each GDPR right (Arts. 15-22) and the AI Act Art. 86 right to explanation in the context of AI processing, addressing both training-time and inference-time rights.

Rights Framework for AI

Right of Access (Art. 15)

Technical Challenges:

• Identifying specific records in massive training datasets
• Determining if a data subject's data is in the training set without running membership inference
• Providing meaningful logic explanation for complex models

Right to Rectification (Art. 16)

Technical Challenge: Correcting training data may require model retraining to propagate the correction. For deployed models, correction may need model update or retraining pipeline.

Right to Erasure (Art. 17)

Technical Challenge: True erasure from a trained model requires either verified machine unlearning or complete model retraining. The EDPB acknowledges this challenge but expects controllers to demonstrate good faith effort and use best available techniques.

Right to Restriction (Art. 18)

Implementation: Quarantine data subject's data from training pipeline and inference pipeline during restriction period.

Right to Data Portability (Art. 20)

Right to Object (Art. 21)

Upon objection: Controller must cease processing unless compelling legitimate grounds override. For AI training: remove data from training pipeline and assess model impact.

Rights Relating to Automated Decisions (Art. 22)

AI Act Art. 86 — Right to Explanation

For high-risk AI systems, affected persons have the right to:

• Clear and meaningful explanations of the role of the AI system in the decision-making procedure
• The main elements of the decision taken
• This right is without prejudice to GDPR data subject rights

Operational Implementation

Rights Request Triage for AI

Data subject rights request received
│
├─ Identify if AI processing is involved
│  ├─ Was AI used in any decision affecting the data subject?
│  ├─ Is the data subject's data in any training dataset?
│  └─ Has AI generated any content about the data subject?
│
├─ Determine applicable AI-specific rights
│  ├─ Access: training data, inference records, logic explanation
│  ├─ Rectification: training data or output correction
│  ├─ Erasure: training data deletion, model unlearning
│  ├─ Restriction: quarantine from AI pipeline
│  ├─ Objection: cease AI training on their data
│  └─ Automated decision: explanation, human review, contestation
│
├─ Route to appropriate team
│  ├─ Standard rights: data protection team
│  ├─ AI-specific: data protection + ML engineering team
│  └─ Contestation: independent review panel
│
└─ Process within Art. 12 timeframe (one month, extendable by two)

Response Timeframes

Enforcement Precedents

• Austrian DPA v. CRIF (2023): Violation of Art. 15(1)(h) — credit scoring system failed to provide meaningful information about automated decision logic upon access request.
• Garante v. OpenAI (2023): Required mechanism for data subjects to request correction of inaccurate AI outputs and to object to AI training on their data.
• Dutch DPA guidance (2024): Right to erasure includes obligation to address erasure from AI training data, even if technically challenging.
• EDPB ChatGPT Taskforce (2024): Controllers must demonstrate capability to address rights requests affecting training data — technical difficulty does not exempt.

Integration Points

• ai-automated-decisions: Contestation and human review mechanisms
• ai-transparency-reqs: Logic explanation fulfils transparency obligations
• ai-data-retention: Erasure rights intersect with retention and unlearning
• ai-training-lawfulness: Objection right applies to legitimate interest-based training