In an attempt to address ongoing regulatory uncertainty about how the UK General Data Protection Regulation (UK GDPR) and UK Data Protection Act 2018 apply to the development and use of generative artificial intelligence (AI), the UK Information Commissioner's Office (ICO) has released its initial response to its five-part consultation series on the topic which it conducted in 2024. The series covered the following areas:

What has changed?

In its initial response, the ICO updated its seemingly highly permissive position on 'legitimate interests' as a legal basis for web-scraping under the UK GDPR. In previous draft guidance, the ICO's position was that data controllers could rely on legitimate interests as a legal basis for training AI models on web-scraped data, provided that they could pass the 'three-part' test by demonstrating:

Following consultation on the initial draft guidance, the ICO has refined its position somewhat - and highlighted some specific considerations which organisations need to bear in mind if they want to rely on legitimate interests for training on web-scraped data.

Given this emerging line of thinking from the ICO, AI model developers relying on legitimate interests as their legal basis for web-scraping under the UK GDPR must assess (and document such assessment):

What happens next?

The ICO's initial response informs its current core guidance on AI and data protection. This guidance is expected to be formally updated when the UK's new UK GDPR reform legislation - the Data (Use and Access) Bill - is passed into law. This is expected to happen around Easter 2025.