The GDPR, the General Data Protection Regulation, is Regulation (EU) 2016/679. Adopted on 27 April 2016 and applicable since 25 May 2018, it sets the rules that any organization processing the personal data of people in the European Union must follow. In French it is called the RGPD; in Dutch, the AVG.
What personal data is
Personal data is any information that can identify a person, directly or indirectly: a name, an e-mail address, a phone number, an IP address, but also the description of a situation precise enough to recognize someone. In a conversation with an AI assistant, a visitor who gives their name or describes their heating problem along with their address is providing personal data.
Some data is called sensitive and enjoys stronger protection (Article 9): health, political opinions, religious beliefs, ethnic origin, sexual orientation, biometric data. An assistant should not ask for it, and the organization must plan what to do when a visitor shares it spontaneously.
The basic principles
Article 5 of the GDPR sets the principles every processing activity must respect:
- Lawfulness, fairness and transparency: a legal basis and clear information to people
- Purpose limitation: using data for a defined purpose, not for something else later
- Data minimization: collecting only what is necessary
- Accuracy: keeping data up to date and correcting errors
- Storage limitation: not keeping data longer than necessary, which requires a retention period
- Integrity and confidentiality: protecting data against unauthorized access and loss
- Accountability: being able to demonstrate compliance with these principles
The six legal bases
Every processing activity must rest on one of the six bases in Article 6: consent, performance of a contract or pre-contractual steps, a legal obligation, protection of vital interests, a task in the public interest, or the organization's legitimate interest balanced against the person's rights. For a website assistant, the most common are pre-contractual steps (answering a request for information about a service), legitimate interest (passing on to the team, improving the service) and consent (keeping information to personalize future exchanges).
People's rights
People have rights they can exercise with the organization: access to their data, rectification, erasure, restriction of processing, portability, objection. The organization must reply within one month, which can be extended by two months for complex requests. A tool that lets you find, export and delete all of a person's data from their e-mail address makes this work much easier.
Who is responsible for what
The GDPR distinguishes two roles:
- The controller decides why and how data is processed. For an assistant on your website, that is your organization
- The processor processes data on behalf of the controller, following its instructions. The platform providing the assistant, its host and the language model provider are processors or sub-processors
The relationship between the two is governed by a data processing agreement, required by Article 28.
Transfers outside the Union
When data leaves the European Economic Area, for example to a model provider based in the United States, the transfer must be safeguarded: an adequacy decision by the European Commission, standard contractual clauses or another mechanism provided for in Chapter V. For the United States, the adequacy decision of 10 July 2023 covers companies certified under the Data Privacy Framework.
Penalties
Fines can reach 20 million euros or 4% of worldwide annual turnover for the most serious breaches. In Belgium, the supervisory authority is the Data Protection Authority, which receives complaints, carries out investigations and can impose penalties. Beyond fines, the main risk for an SME is often the loss of its customers' trust.
The GDPR and AI assistants
An AI assistant does not change the rules, but it multiplies the points to watch: what visitors write freely, what the assistant remembers, where messages are processed, how long they are kept, whether they are used to train a model. Our article on AI assistants and the GDPR sets out the method for an SME. The European AI regulation, the AI Act, adds its own obligations without replacing the GDPR.
The GDPR in KernChat
KernChat is hosted in the European Union. Conversations are kept for 365 days by default, with a period the organization can change, and then purged. Contact memory relies on the contact's consent when the organization requires it, and every piece of information kept can be exported or deleted. Messages are sent to the model provider only to generate the answer; KERN-IT does not use them to train a model.