Federated Learning for GDPR Compliance

Overview

Federated learning (FL) is a distributed machine learning approach that trains models across multiple data holders without centralising personal data. Instead of collecting training data into a central repository, federated learning sends the model to the data, computes local updates on each participant's device or server, and aggregates only model updates (gradients or weights) at a central coordinator. This architecture directly addresses GDPR data minimisation (Art. 5(1)(c)) and data protection by design (Art. 25) principles by eliminating the need to transfer and centralise personal data for AI training. However, federated learning is not a privacy silver bullet — it introduces its own privacy risks that must be managed through complementary techniques.

Federated Learning Architecture Patterns

Pattern 1: Cross-Device Federated Learning

Use case: Training on data from millions of user devices (smartphones, tablets, IoT).

GDPR Analysis:

• Data minimisation: personal data never leaves the device — strong compliance
• Controller role: platform operator is controller; device owners are not processors
• Lawful basis: consent or legitimate interest for on-device processing
• International transfers: no personal data transfer if aggregation is privacy-preserving
• Right to erasure: device can be excluded from future rounds; model unlearning may be needed

Pattern 2: Cross-Silo Federated Learning

Use case: Training across organisational boundaries (hospitals, banks, subsidiaries).

GDPR Analysis:

• Joint controller determination: participants and aggregator may be joint controllers (Art. 26) — requires joint controller agreement
• Data processing agreements: if aggregator is a processor, Art. 28 DPA required
• Data minimisation: personal data stays within each silo — strong compliance
• International transfers: if silos are in different jurisdictions, gradient transfer legality depends on privacy guarantees
• Lawful basis: each silo needs independent lawful basis for local training; aggregation needs separate basis

Pattern 3: Vertical Federated Learning

Use case: Different organisations hold different features for the same individuals.

GDPR Analysis:

• Joint controller: participants are likely joint controllers — each processes personal data for a common purpose
• Purpose limitation: combined training purpose must be compatible with each party's original collection purpose
• Data subject notification: data subjects must be informed about cross-organisation federated training
• Consent: may be required for combining data across organisations

Secure Aggregation Protocols

Protocol 1: Masking-Based Secure Aggregation

Participants mask their local updates with pairwise random masks that cancel out upon aggregation. The aggregator receives the sum without seeing individual updates.

Protocol 2: Homomorphic Encryption Aggregation

Participants encrypt their updates with a homomorphic encryption scheme. The aggregator computes the sum on encrypted data without decryption.

Protocol 3: Trusted Execution Environment (TEE)

Aggregation occurs within a hardware-protected enclave (Intel SGX, ARM TrustZone). Participants send updates to the TEE, which performs aggregation in isolated memory.

Differential Privacy Integration

Local Differential Privacy (LDP)

Each participant adds noise to their gradient update before sending to the aggregator:

• Mechanism: Gaussian noise calibrated to sensitivity and privacy budget (epsilon, delta)
• Guarantee: Individual update is differentially private — aggregator cannot infer specific data points
• Trade-off: Higher noise reduces model accuracy; need more participants to compensate
• Recommended epsilon: 1-10 per round, with privacy accounting across rounds

Central Differential Privacy (CDP)

The aggregator adds noise to the aggregated update before applying to the global model:

• Mechanism: Gaussian noise added to the sum of clipped gradients
• Guarantee: Global model is differentially private with respect to any single participant's data
• Trade-off: Less noise needed than LDP for same accuracy (noise averages out); requires trusted aggregator
• Recommended epsilon: 1-8 total privacy budget

Privacy Budget Management

GDPR Compliance Assessment for Federated Learning

Data Protection by Design (Art. 25) Alignment

Remaining GDPR Challenges

1. Gradient leakage: Model updates can leak training data even without transmitting raw data — secure aggregation and DP mitigate but do not eliminate
2. Model memorization: The aggregated model may still memorize individual records — privacy auditing required post-training
3. Right to erasure: Removing a participant's contribution from the trained model is challenging — machine unlearning or retraining required
4. Controller/processor determination: Complex multi-party FL architectures require clear role delineation
5. Lawful basis: Each participant needs independent lawful basis; the aggregator needs basis for processing updates
6. Transparency: Data subjects must be informed about federated learning participation

Implementation Considerations

Communication Efficiency

Participant Selection

Enforcement Relevance

While no enforcement action has specifically addressed federated learning, the technology is directly relevant to:

• CNIL AI recommendations (2024): Identified federated learning as a recommended privacy-enhancing technology for AI training
• EDPB Guidelines 04/2025: Mentioned distributed training as a data minimisation measure for AI systems
• Garante v. OpenAI (2023): Centralised data collection was a key compliance issue — federated alternatives could have mitigated
• AI Act Art. 10: Data governance for training data — FL enables data governance while maintaining data locality

Integration Points

• ai-dpia: FL architecture reduces data centralisation risk in DPIA assessment
• ai-training-lawfulness: FL may simplify lawful basis by keeping data local
• ai-model-privacy-audit: Federated models require distributed privacy auditing
• ai-privacy-inference: FL complements confidential computing for inference privacy
• ai-data-retention: Data locality in FL simplifies retention compliance