EDPB(n2), 34. Cf Commission Nationale de l’Informatique et des Libertés, ‘IA: Assurer que le traitement est licite-En cas de réutilisation des données, effectuer les tests et vérifications nécessaires’(CNIL, 8 April 2028) https://www.cnil.fr/fr/assurer-que-le-traitement-est-licite-reutilisation-des-données accessed 18 March 2025, limiting controllers’ liability to the re-use of publicly accessible datasets whose creation was manifestly unlawful because, eg, resulting from a criminal offence or collected in absence of a legal basis
European Data Protection Board, ‘Opinion 28/2024 on Certain Data Protection Aspects Related to the Processing of Personal Data in the Context of AI Models’ (2024) 7 https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en accessed 20 March 2025.
GDPR,art65(1)(c). See also Lisette Mustert and Cristiana Santos, ‘The European Data Protection Board-a (Non)Consensual and (Un)Accountable Role?’ (Social Science Research Network, 15 October 2024) https://papers.ssrn.com/abstract=4988594 accessed 12 March 2025.
