Legal bases
Which basis carries which AI deployment, why consent is weak in employment, and what Article 22 triggers.
Which basis for what
| Basis | Typical AI use | Note |
|---|---|---|
| Contract performance, (b) | Ticket handling, order processing, information | Only what is necessary to perform |
| Legal obligation, (c) | AML checks, retention, regulatory reporting | The obligation must be concrete |
| Legitimate interest, (f) | Fraud detection, internal analysis, IT security | Document the balancing test |
| Public task, (e) | Administrative procedures | Needs a sectoral statutory basis |
| Consent, (a) | Newsletter, voluntary extras | Delicate in employment |
Special categories
Health, origin, political opinion, religion, trade union membership, genetics, biometrics for identification, sex life. For those, an additional basis under Art. 9(2) is required, and that list is narrow.
The balancing test
- 01
Name the interest
Concretely, not as a phrase. "Reduce fraud losses" carries; "improve processes" does not.
- 02
Check necessity
Is there a less intrusive means achieving the same purpose?
- 03
Weigh the data subjects' interests
Expectations, depth of intrusion, who is affected, possible consequences.
- 04
Record it in writing
Without a document, the balancing test does not exist in a dispute.
Article 22 in the AI context
The provision bites where three elements coincide: a decision, based solely on automated processing, with legal effect or similarly significant effect.
- Solely automated means: no human carries out an independent substantive assessment. A confirmation click does not suffice.
- Legal effect covers conclusion or refusal of a contract, dismissal, granting of a benefit.
- Similarly significant effect can arise for a goodwill refusal or a pricing decision.
Where it applies, rights arise to human intervention, to express one's point of view and to contest. Information duties about the logic involved and the significance apply on top.
What "logic involved" means in practice
Not the algorithm but an understandable description: which categories of data feed in, which criteria carry, and what would have to change for the decision to come out differently. An attribution such as "feature X contributed 0.3" does not suffice.
Which is exactly why linear models remain widespread for decisions about people: their coefficients translate into domain language. See Regression.
The change of purpose
Further processing for a different purpose needs either its own basis or a compatibility assessment under Art. 6(4). What must be weighed: the link between the purposes, the context of collection, the nature of the data, possible consequences, and whether appropriate safeguards such as encryption or pseudonymisation exist.
For model training from existing data that assessment frequently comes out negative, because the consequences for data subjects are hard to foresee and erasure from the model is not possible.
The decision worksheet
FREE ACCOUNT
Legal basis decision worksheet
A worksheet leading from the data type through the basis to the balancing test, with the note an audit wants to see.
Worksheet3 items
Related courses and sources
CNIL on artificial intelligence
The French supervisory authority publishes the most practical guidance on AI and data protection in Europe, in English as well as French.
For data protection leads who need a supervisory reading rather than the bare text of the law.
Guidelines of the European Data Protection Board
The GDPR as interpreted by the body of supervisory authorities. In a dispute about a legal basis, the most solid source after the text of the law itself.
For legal teams and data protection officers when an interpretation has to hold up.