Mind the gap: IC sets expectations for AI model developers, how this differs from the EDPB

The U.K. Information Commission published 8 Oct. an update on its work with the largest foundation model providers, hailing a number of commitments regarding data protection improvements. 

Alongside the update, the IC laid out a set of expectations for developers of generative artificial intelligence models and highlighted future considerations relating to agentic AI, for which it opened a call for evidence.

Several of the IC's expectations address issues also considered by the European Data Protection Board, allowing for a comparison of the U.K. and EU approaches. The IC looked at five topics: transparency, lawful basis, data subject rights, models and personal data, and special category data.

Special category data — a known problem without a solution

The final point concerning special category data is perhaps the most interesting. The clear privacy challenge is that no condition under Article 9 of the EU General Data Protection Regulation applies neatly or generally to model development, but the broad data collection often required to train models creates a risk that special category data will be processed.

The EDPB, in its draft guidelines 03/2026 on web scraping in the context of generative AI, acknowledges that, even where controllers implement filtering measures, it is not always possible to assess with reasonable certainty whether scraping will capture special category data until after the event.  

Drawing on the Court of Justice of the European Union's ruling in "GC and Others," the EDPB considers that incidental and residual collection of special category data may fall outside the strict Article 9 prohibition on a case-by-case basis, provided four conditions are met: the processing resembles search engine activity; the collection is not intentional; it was genuinely difficult to determine beforehand whether such data would be captured; and the controller implements measures to prevent dissemination.