Has any court actually proven that LLMs always process personal data?

Controversial discussion-starter of the day: has any authority or court actually established that LLMs and other such models *do* involve the processing of personal data when they predict what might be a relevant next word/token/string of characters in a sequence, a next pixel in an image, etc.? I would love to see the reasoning.
Not just assumptions, mind you – real, tangible technical explanations.

Let’s not forget that many LLMs “interpret” information in terms of tokens when it comes to text, even at the level of the input, so it might not be as straightforward a question as some regulators and campaigners appear to think.

This is a *separate* discussion from the one regarding data sources, and also separate from the discussion of whether personal data is processed when prompts themselves are being received as input by the server of a web-based LLM. I’m talking here specifically about the actual “processing” when the LLM receives a query and prepares a response. The increase in popularity of smaller, on-device LLMs makes this an even more important question.

[It seems that everyone constantly forgets that the accountability obligation under the GDPR only kicks in after someone has been deemed to be a controller – which also requires first establishing that there is personal data. And even then, accountability doesn’t mean “presumed guilty of infringement until proven otherwise”.]

I realise this will probably just invite inflammatory remarks, but someone has to put it out there.

On another topic, if you are in Venice at the Privacy Symposium, do attend our panel discussion today on “Privacy by Design Online Marketing” (link: https://lnkd.in/eUB9zX3u ). I think you will be treated to some great interaction between speakers! See you there?

data protection gdpr AI privacy GenerativeAI