Good & bad in judgment on Meta AI training & personal data (legitimate interests, sensitive data) + new French & German guidance

Does training of AI systems involve the processing of personal data, and is it permitted under the GDPR? These were the two fundamental questions that I have already looked into in two previous articles:

• “AI training data = (non-)personal data? And is consent really relevant?”, of 14 October 2024
• “About AI training & legitimate interest as a GDPR legal ground”, of 23 May 2025

On the date of that second article, the Cologne Higher Regional Court (the Oberlandesgericht Köln – the Cologne HRC) delivered a judgment that denied a request by a plaintiff for an injunction to prevent Meta from using certain (public) Facebook and Instagram content to train its AI models. The Cologne HRC’s reasoning (available in German here)? These plans were lawful under the GDPR.

It is a really interesting judgment. While the judgment is based on summary proceedings regarding an injunction, and thus focusses on whether there is an appearance of a right rather than being a full judgment on the merits, it highlights key aspects of legal reasoning that should be taken into account by all judges, lawyers, in-house counsel and other professionals dealing with these issues.

In addition, the German Datenschutzkonferenz or DSK (= conference of German supervisory authorities) published in June 2025 a new guide for AI systems, with notably a focus on filtering as opposed to deletion, and the French CNIL published its own updated guidance on legitimate interest as a legal ground for AI system development purposes. We’ll get back to these ones a bit, but first, let’s look at the judgment of the Cologne HRC.

A note on scope: This piece focusses purely on data protection aspects, because it looks at the Cologne HRC judgment and the new CNIL + DSK guidance (all excerpts are tweaked machine translations). There are many other relevant angles to the assessment of AI systems, notably regarding intellectual property rights, product safety etc. Lots of news on these topics too, so keep up to date, but this article doesn’t look at the question of AI models & systems through those other lenses.

1. Personal data? First-party data at stake (vs third-party data)

First, it is worth stressing that the training data set in question – first-party data already processed by Meta through Facebook & Instagram – clearly includes personal data from Meta’s perspective. This is not questioned by anyone.

This is not the same situation as with scraped data (such as data coming from Common Crawl). With first-party data already processed by Meta in relation to users through Facebook and Instagram, there is a clear link to an identified natural person as far as Meta is concerned; with scraped data, the “identifiability” test remains relevant. So no need to draw any lessons from this point from the Cologne HRC’s judgment for situations where only third-party data is involved. Instead, I invite you to look at the points I raised in my two previous articles on the topic (“About AI training & legitimate interest as a GDPR legal ground” & “AI training data = (non-)personal data? And is consent really relevant?”).

2. DMA: no merging of data when placing datasets in same AI training set

A first section worth highlighting is linked to the Digital Markets Act or DMA. Under Art. 5(2), first paragraph, point (b) DMA, consent (+ choice) is required before a gatekeeper (such as Meta) can “combine personal data from the relevant core platform service [= Facebook and Instagram in this case] with personal data from any further core platform services or from any other services provided by the gatekeeper or with personal data from third-party services”.

In paragraph 44 of its judgment (in section 2(b)(aa)), the Cologne HRC states that “the incorporation of partially de-identified and disaggregated data from two central platform services into an unstructured training data set for an AI […] is not a combination within the meaning of [the DMA]. There is no targeted linking of personal data of a user from one central platform service with personal data of the same user from the other central platform service”.

In other words, because the data from the core platform services is used in parallel with other data (e.g. Facebook data of one person might appear in the training data set just like Instagram data of that same person) but not combined to form one larger set of data regarding one individual (so no matching to build a “Facebook + Instagram” combination by way of the AI training process), the DMA’s prohibition does not apply here. Or, as the Cologne HRC put it: “What is required in this respect is a targeted connection of data from the same person” (para. 47).

Paragraph 48 explains this further:

“[…] a “merging” of data can only be assumed in the case of their connection in the context of user profiles, but not in the case of their – as here – unassigned and even de-identified contribution to a uniform “data silo”. Only the former understanding explains the possibility of the users concerned to consent to the merging […] [Art. 5 para. 2 DMA] assumes that an end user consents to the merging of data from multiple sources and that the merging is then lawful. This also shows that the provision is tailored to the case of the targeted linking of data from one and the same user.”

In support of its reasoning, the Cologne HRC quotes the European Commission’s DMA decision of 23 April 2025 regarding Meta’s Pay or OK approach, which states the following in its paragraph 30:

“a gatekeeper is prohibited from combining the personal data of end users from one of its CPSs with the personal data of those end users from its other CPSs or distinct services, or with personal data of the same end users from third party services” (emphasis mine)

I have serious doubts as to the Commission’s legal reasoning in that DMA decision (see part 1 and part 2 of my critical analysis), but on this particular point I agree with the Commission (and the Cologne HRC) that this is the reading one should make of Article 5(2) of the DMA.

3. GDPR & legitimate interest assessment: green light (+ no DPIA? no unlawfulness of processing)

The Cologne HRC carries out in its judgment a legitimate interest assessment, i.e. a verification of the legal ground for the processing by Meta of personal data as training data for AI models. As per case law of the EU Court of Justice (CJEU), the legitimate interest assessment involves three tests: legitimacy, necessity and balancing.

[A reminder: these are summary proceedings, not the case on the merits, and the Cologne HRC repeatedly says things such as “on the basis of a summary examination” for this reason when reaching its conclusions on compliance with the GDPR.]

3.a) Legitimacy test: interest in training AI model is legitimate & lawful (no DPIA? no impact)

First, as part of the legitimacy test, the Cologne HRC stresses that economic interests can be legitimate interests (by reference to the CJEU’s KNLTB judgment of 4 October 2024) and that the interest in question is “sufficiently clearly and precisely formulated” and “real and present and not merely speculative” (para. 60 of the judgment of the Cologne HRC). The interest in question is defined summarily much further in the judgment (“to offer a generative AI optimised to regional customs and to implement it in [Meta]’s services” – para. 69) but is described in this section as corresponding to Meta’s “intention to use the possibilities of generative AI to provide a conversation assistant that offers answers in real time for chats, help with the organisation and planning of a holiday, for example, and assistance with the formulation of texts. To this end, the AI is to be adapted to regional customs. It should also be possible to create content such as text, images and audio” (para. 62).

The Cologne HRC also stresses that the legitimacy of the interest is not affected by the potential absence of a data protection impact assessment (DPIA). To reach that conclusion, it quotes the CJEU’s UZ v Bundesrepublik Deutschland judgment of 4 May 2023.

By way of a quick reminder, in that case, the CJEU found that an infringement of Articles 26 (on joint controllership) and 30 GDPR (on records of processing activities) does not affect the lawfulness of the processing itself. See notably para. 66 of the judgment: “an infringement of Articles 26 and 30 of the GDPR by the controller does not constitute ‘unlawful processing’ within the meaning of Article 17(1)(d) or Article 18(1)(b) of that regulation, read in conjunction with Article 5(1)(a) and the first subparagraph of Article 6(1) thereof, conferring on the data subject a right to erasure or restriction of processing”. The reason is that these provisions are part of Chapter IV of the GDPR, which deals with specific obligations for controllers and processors, and not part of the “principles” (Chapter II of the GDPR, i.e. Articles 5 to 11 of the GDPR), and that they are sanctioned differently.

That CJEU judgment has its own share of inconsistencies (what is the status of Articles 8 and 11 GDPR, given that they are part of Chapter II of the GDPR but are subject to lower fines like Articles 25 to 39 of the GDPR?), but it remains a CJEU judgment that has to be taken into account.

Because the DPIA obligation is found in Article 35 and within Chapter IV of the GDPR, the Cologne HRC stated the following: “the transparency requirements (Art. 12 et seq. GDPR) are met by the extensive information provided by [Meta]. Furthermore, it does not matter whether [Meta] has violated an obligation to obtain a data protection impact assessment pursuant to Art. 35 GDPR” because this provision is “not a lawfulness requirement for data processing” (para. 64 of the Cologne HRC judgment).

3.b) Necessity test: AI training through such data = suitable to achieve purposes, and no adequate less privacy-intrusive alternatives (synthetic data = insufficient)

The necessity test involves checking “if [the processing] is suitable for achieving the processor’s interest and there is no less intrusive way of achieving the corresponding purpose” (para. 67, by reference to the CJEU’s Bundeskartellamt judgment of 4 July 2023).

Here again the Cologne HRC emphasises the difference between summary proceedings and proceedings on the merits. It states that “there is a deviation from the standard standard of proof of full conviction of the truth of a fact for the prima facie evidence required in proceedings for interim legal protection. It is sufficient if its existence is predominantly probable, i.e. that there is more evidence in favour of the existence of the fact than against it” (para. 68), before stating that “According to these standards, the [Cologne HRC] has no doubts that the training of the AI developed by [Meta] with the user data is suitable to achieve the stated purposes pursued with it, i.e. to offer a generative AI optimised to regional customs and to implement it in [Meta]’s services” (para. 69).

The plaintiff attempted to counter this position by arguing that (i) Meta could train its AI models “using anonymised or so-called synthetic data”, (ii) Meta “could limit the training of the AI to flywheel data” and (iii) “the necessity must be given with regard to each individual data point” (para. 70).

A few words on this.

First, synthetic data is highlighted by some (such as the European Data Protection Board / EDPB indirectly in its Opinion on personal data & AI models – see para. 73 of that Opinion) as some sort of miracle solution that allows AI model training without (would-be) personal data. Synthetic data is the result of the creation of information that mimics the patterns of real-world data – but you only get synthetic data if you first analyse real-world data (typically by feeding it to… a machine learning AI system). So if you consider that the training of an AI model involves the processing of personal data (which I still contend is not always the case) and that this is unlawful, do you then consider that only synthetic data that has been created on the basis of consent-supported data processing can be lawfully used? Or can we used “synthetic data” as a general magical solution, no matter the creation process behind it?

Second, I assume the reference to “flywheel data” is about data flywheels, i.e. feedback loops based on user interaction or other actions. In summary, a user’s interaction with an AI model leads to feedback to help the AI model improve; as it improves, that user and others are led to use the AI model more, which leads to more feedback, further improving the AI model. This is useful for incremental improvements but cannot be used to jump-start a large-scale AI training exercise.

Next, the allegation that necessity has to be shown in relation to each individual data point is unworkable in any setting. No controller is required to show that in data subject A’s case, all of the data points processed regarding A are indeed always necessary; in data subject B’s case, etc. Each controller has to make an assessment of which types of data are necessary, ideally which contents of a field in a database are necessary, but not systematically whether an individual data point is indeed necessary to a given purpose.

Fortunately in my view, the Cologne HRC dismisses all three allegations of the plaintiff in this respect.

First, regarding synthetic data:

• it states that “it appears to the [Cologne HRC] that [Meta]’s submission, made credible by means of an affidavit, that […] ‘there is no other reasonable alternative for Meta to pursue and achieve its interests just as effectively by other, milder means. Meta has considered available alternative ways to achieve its objectives that would allow for less intensive use of personal data’ is predominantly probable” (paragraphs 71-73).
• It also quotes Recital 105 of the AI Act in this respect, which states that “The development and training of such models require access to vast amounts of text, images, videos and other data”. (In all fairness to the plaintiff, though, and I personally do not see this as an actual factual & technical response to the plaintiff’s claim. This explains the logic behind some provisions of the AI Act, but it doesn’t actually prove whether there is a need for data or not)

Still on synthetic data but also on the data flywheel, the Cologne HRC refers to an affidavit, with a quote that is perhaps hard to counter but that in my view is correct in any case: “With regard to the mere use of so-called flywheel data, it is hardly plausible that the significantly smaller amount of data to be obtained in this way compared to the existing data stock from active user accounts leads to comparable results when training the AI. The fact that an “inferior product” would be created in this respect was made credible by [Meta] in the affidavit of the Director GenAI Product Management at Meta Platforms Inc, […] as was the lack of equivalence of the use of synthetic data” (para. 73).

Finally, on the issue of individual data points, the Cologne HRC states that “[Meta] is not obliged to prove the necessity of each data point. The training of an AI requires the use of masses of data to generate patterns and probability parameters […]. In this respect, the individual data hardly ever has a measurable influence in case of doubt” (para. 73).

The final considerations regarding necessity go in all directions, but are worth highlighting as well:

“Insofar as it can be considered to relate the principle of necessity to the type of data processed, i.e. to avoid the processing of personal data as far as possible […] [Meta] has made a credible case for relying on methods of de-identifying the data entered in the training data set. […] Insofar as the frequently performed form of data collection through web scraping and crawling is regarded in the literature as the “most effective” form of data collection […], this is not relevant: This would involve significantly more substantial interference with the rights of the data subjects, as the mitigation measures implemented by [Meta] in the injunction would not be effective in this respect. In addition, [Meta] intends to carry out training with “regional” data, so that this type of data collection would not be equally suitable.” (para. 73)

In summary, necessity established, and the advantage of using first-party data here is to be combined with the fact that mitigation measures can be more powerful in relation to such first-party data.

3.c) Balancing test, first part: no data archive, sufficient mitigation measures implemented

The judgment’s section on the balancing test is extensive and makes a distinction between the controls available in the case of data made public by the data subject him-/herself as a user of Facebook or Instagram and those available regarding other kinds of data (in particular data of third parties as well as data made public by accounts of institutions such as schools).

A first important point highlighted by the Cologne HRC is that “only the training of the AI with personal data and its consequences are relevant for the decision”, and that “[o]ther possible infringements that may arise from the subsequent “work” of the AI (such as disinformation, manipulation, other harmful practices) are currently not sufficiently foreseeable and can be pursued separately” (para. 76). The Cologne HRC also stresses that “it is unlikely that these risks will materialise to such an extent that the lawful use of the AI would become impossible and the suitability of the data processing would ultimately be called into question” (para. 76). In other words: you cannot rely on the hypothetical possibility of harm at an output level to obtain an order to block the training of an AI model.

Next, the Cologne HRC emphasises that “AI systems cannot be equated with a ‘data archive’, but regularly consist solely of parameters for probability calculations”, before stating nevertheless that “the storage of personal data in the AI harbours a legally relevant […] risk of the AI ‘remembering’ […] personal data and thus of reconstructability and output of this data during the ‘work’ of the AI” (para. 78).

I continue to struggle with this, as this mixes in my view a few things.

First, it mixes the training phase with the output phase. The training phase might involve personal data from Meta’s perspective (because this involves first-party data), which isn’t the case for every AI model provider (or even every AI system provider).

Second, it mixes the deterministic (stored data) and probabilistic (synthetic data) approaches as far as the operation itself is concerned. Either we consider that an AI system is truly probabilistic in its operation and that everything it generates is synthetic data from the perspective of the AI system, or we consider it to be properly deterministic and that it remembers, looks up and regurgitates (and thus processes) personal data at the stage of its operation. If by way of an exaggeration the probability is 99.99% in a specific set of circumstances (for instance, the overused example of an LLM being asked what is the birthday of Donald Trump – which is a question involving personal data from the perspective of the user but the response of which is based on an interpretation of the likelihood of a given token following another), it still remains a probabilistic operation involving the creation of synthetic data from the perspective of the AI system, as a change to the training data could affect that probability.

“Surely you’re not suggesting that considering there is a 60% chance of someone being female doesn’t involve the processing of personal data!” First, who is making this consideration? Is it the user of a tool or the provider of the tool itself? Next, is that person identifiable from that user or provider’s perspective? If it’s the user and the person is identifiable from the perspective of the user, then no, because you are then linking information of a certain likelihood of accuracy to someone who is already identifiable – i.e. it is personal data (even if potentially inaccurate). However, from the perspective of the provider of the tool, saying “60% chance that unknown user is female” isn’t processing of personal data, only potentially personal data if the recipient has legal & lawful means of identification at its disposal.

“But this is Meta we’re talking about! Meta knows the individuals!” Perhaps, as far as the training phase goes (at least, before de-identification measures) because it is first-party data – but not necessarily as far as the output is concerned. Meta, OpenAI, Google, Mistral etc. do not know as part of the operation of their AI model if you are using the AI model for the processing of personal data or even if the information being generated could potentially be perceived as personal data from your perspective.

Back to the judgment, then, which states that “it must be taken into account in this respect that a later deletion of the data from the AI is only possible to a limited extent and that once the AI has been trained, [Meta] will have achieved its goal of developing a model. By restricting the right to erasure (Art. 17 GDPR), a central data subject right is impaired” (para. 79). This is an important point on which the Cologne HRC comes back later – but even more important is the guidance from the DSK on this (see below).

To assess whether there is an appropriate set of measures to mitigate the impact of the interference with data subjects’ fundamental rights (notably their right to the protection of their personal data), the Cologne HRC refers to measures taken by Meta “to de-identify the data records (removal of full names, email addresses, telephone numbers, national identification numbers, user IDs, credit/debit card numbers, bank account numbers/bank sort codes, vehicle registration numbers, IP addresses and postal addresses) and to compile these in unstructured and ‘tokenised’ form”, which in its view “will minimise the corresponding risk overall” (para. 82).

It also states that Meta “has also credibly demonstrated that it has taken technical, physical and organisational measures to prevent unauthorised access to the training data and to detect security-relevant activities through the work of the AI” (para. 83).

Finally, the Cologne HRC stresses that the six-week period given by Meta to Facebook and Instagram users between April and May 2025 to object “to the inclusion of the data in the training data set” was “sufficiently long” (para. 86) and an “effective way of preventing their personal data from being included in the training data set” (para. 84), with no “relevant technical hurdles in exercising the right to object” (para. 85). It also states that Meta “has credibly demonstrated that it has explained the intended use of data in a way that is transparent and comprehensible to the average user and has clarified the need for action” (para. 89).

While the Cologne HRC has some reservations regarding the data of third parties (i.e. individuals whose data is made public on Facebook or Instagram by someone else), it still stresses that it is possible to revoke the public nature of the data concerned, which also is an effective means of objecting to the use of the data for AI training purposes.

3.d) Balancing test, second part: reasonable expectations (historical data, sensitive data?), and balance in favour of Meta

When it then looks at reasonable expectations of data subjects, the Cologne HRC first stresses that an announcement of 2024 is relevant: “the use of data provided to [Meta] for the training of AI could and must ‘reasonably’ be expected at least from its public announcement of 10 June 2024 that it intended to use user data for the purpose of training its AI from 26 June 2024. Although [Meta] initially withdrew this announcement later, its fundamental intention to use the data was clear” (para. 94).

As for “historical” data, in this case data on Facebook or Instagram since before 26 June 2024, the Cologne HRC “is unable to establish such an expectation in the context of a summary examination”, considering that the use of data for AI training purposes “goes far beyond the presumed expectation that data provided to [Meta] in the injunction could be used in the context of general product improvements” (para. 95).

Yet still the Cologne HRC considers that “the interests of the data subjects cannot outweigh the mere individual interests of [Meta] in view of the expectability of the corresponding use of the data provided to [Meta]” (para. 97), and this is the same as regards “own data posted before [26 June 2024] and for data of data subjects posted in third-party accounts” (para. 98), for the following reasons:

• Regarding historical data, i.e. “own data posted before 26 June 2024”: “interested users have the option of preventing the processing of the data posted “publicly” on their user accounts by withdrawing the public status of the data or, in any case, by filing an objection. In this respect, these users have an effective instrument at their disposal – after a summary examination – to prevent an impairment of their rights in a reasonable manner.” (para. 100);
• Regarding third-party data (which the Cologne HRC highlights “may also include children, whose interests are in particular need of protection” – para. 102), the Cologne HRC considers that there is a “rather low intensity of the intrusion as a result” (para. 102), especially as a result of the mitigation measures taken by Meta.

The reasoning of the Cologne HRC in this respect is important, so it is worth quoting large excerpts of paragraph 103:

“It is unlikely that a specific disadvantage – beyond the fundamental right to determine the use of one’s own data – can arise from the processing. As the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg points out, the development of large language models based on very large training data sets – which is the issue here – does not regularly involve the targeted processing of personal data or the identification of a specific person. In this respect, it does not depend on the information of the individual, as is the case with intrusive profiling […]

“Ultimately, any disadvantages for the individual beyond the impaired interest in self-determination over their own data can essentially only arise from the subsequent reproduction of the data by the AI. As explained above, this risk is not negligible in legal terms. In this respect, however, [Meta] has made it credible […] that this risk is to be assessed as low. In addition, [Meta] has taken measures to de-identify the data included in the training data set, albeit not completely. Overall, [Meta]’s submission is also confirmed by a statement from the Baden-Württemberg State Commissioner for Data Protection and Freedom of Information, which points out that the fact that the size of the training data sets for the development of a language model means that there is only a low probability of identification of individuals should be included in the balancing of interests. If information in data sets is only available individually and AI models are not repeatedly trained with this information, there is a high probability that information about individuals will be lost in the mass of data from AI models, i.e. will not appear unchanged in an output of an AI system […]

“With regard to the limited possibility of deleting data once it has been entered into the AI, a central data subject right is clearly called into question. However, at the hearing on 22 May 2025, [Meta] agreed not to use such data in future training processes, which would in any case cause the corresponding information to fade away. The plaintiff in the injunction has not substantiated his objection to this. In this respect, the risk of irreversible damage is in any case mitigated”

In other words, (i) the nature of AI model training makes the risk of data reproduction low, and mitigation measures make it lower still; (ii) the more data is included, the higher the probability that “information about individuals will be lost in the mass of data” and (iii) the “risk of irreversible damage” is mitigated notably by virtue of the fact that objections can be taken into account for future training processes.

While I would have appreciated a slightly more detailed technical explanation in the judgment in support of these positions, they are more consistent with the technical working of AI systems than some previous positions (e.g. that of the EDPB in its aforementioned Opinion on AI models & personal data) – and this is again a judgment in summary proceedings, not proceedings on the merits.

4. What about sensitive data? Processing not prohibited under Art. 9(1) GDPR

Finally, the Cologne HRC turns to another fundamental question: what of the processing of special categories of data under Article 9(1) of the GDPR?

4.a) CJEU evolutions regarding special categories of personal data – and points of criticism

Over the past few years, the CJEU has on two occasions taken a broad view of what constitutes personal data covered by Article 9(1) GDPR, i.e. “special categories” of personal data (more commonly known as “sensitive data”).

In OT v Vyriausioji tarnybinės etikos komisija (C-184/20, judgment of 1 August 2022), the CJEU held that a name of a spouse was “liable to disclose indirectly the sexual orientation of a natural person” and thus that a publication of a spouse’s name on a website “constitutes processing of special categories of personal data” (see paragraphs 124-128 of that CJEU judgment). This judgment is difficult to reconcile with common practices that few question and that have nothing to do with the identification of sexual orientation (for instance, under which Art. 9(2) GDPR legal ground is an employer permitted to process in a personnel file the name of an employee’s spouse? Is that truly only ever permitted for emergency reasons under Art. 9(2)(c) GDPR? Is “explicit consent” truly required before an invitation can be issued to a person & their spouse to a company-paid dinner with plus ones?).

In a similar vein, in Lindenapotheke (C-21/23, judgment of 4 October 2024), the CJEU considered that if a person orders medicinal products not requiring a prescription, the linking of the order itself with the identity of the person constitutes processing of “data concerning health”, “even where it is only with a certain degree of probability, and not with absolute certainty, that those medicinal products are intended for those customers” (para. 90 of Lindenapotheke). The reason? “The data which a customer enters on an online platform when ordering pharmacy-only medicinal products are capable of revealing, by means of an intellectual operation involving collation or deduction, information on the health status of the data subject, […] in so far as that order entails establishing a link between a medicinal product, its therapeutic indications or uses, and a natural person identified or identifiable by factors such as that person’s name or the delivery address” (para. 84 of Lindenapotheke).

I have my qualms about these judgments, as they raise doubts as to the lawfulness of processing activities that appear to be common sense. Does a supermarket need explicit consent to be able to process the fact that a customer has bought vitamin supplements or menstrual pads, even if it does not actually try to infer anything regarding the health of an individual? Is that same supermarket prevented from processing information regarding condom purchases, just on the off chance that a pause in purchases could reveal (attempts to lead to) pregnancy of a sexual partner? Is a book store prevented from keeping in a list of purchases the purchase of religious texts such as the Bible, Quran or Tanakh, even though a purchase might be more based on intellectual curiosity than actual religious beliefs and though the book store itself has no interest in identifying religious beliefs?

I have previously argued (see section VII.3 in the linked article) for taking the actual nature and intent of processing more into account, and the current regulatory and judicial interpretation of Article 9 GDPR is a prime example of stretching of notions to the extent that compliance becomes limiting. The CJEU has previously rejected such a purpose-related approach in the Bundeskartellamt judgment (para. 69) and in Lindenapotheke (para. 87), but I fear that this interpretation will prove unworkable in the long run.

In any event, this is the state of case law that must be taken into account – and the Cologne HRC builds its reasoning on that basis.

4.b) Cologne HRC: permitting AI model training with sensitive data

After repeating in paragraph 108 of its judgment that health data includes any information from which it is “possible to infer the state of health of the data subject […] by means of a mental combination or deduction” (by reference to paragraph 83 of Lindenapotheke) and that “[t]he fundamental prohibition provided for in Art. 9 para. 1 GDPR applies regardless of whether the information disclosed by the processing is correct or not” (by reference to paragraph 69 of Bundeskartellamt), the Cologne HRC stresses that where sensitive data and non-sensitive data are inseparable in a dataset, the processing of that entire dataset is subject to the restrictions under Article 9 GDPR (para. 109-110 of Cologne HRC judgment, by reference to para. 89 of Bundeskartellamt).

Yet as the data here has been made public by the data subject (in the event of own data posted online), the exception under Art. 9(2)(e) GDPR (regarding personal data which are manifestly made public by the data subject) can apply, says the Cologne HRC.

The Cologne HRC then embarks on an analysis of whether any of the legal grounds under Art. 9(2) GDPR might apply to the processing of health data regarding people other than those who post it themselves, musing that a referral to the CJEU might be needed.

My concern in this respect is that this should be irrelevant. If sensitive data has been made public by someone other than the data subject concerned, any processing of that data through social media would normally be problematic. If that is an accepted position, do authorities and courts then wish to require the social media provider to police users and ensure that there is never any unlawful processing of personal data as a result of users’ own actions? Yet if a social media provider is deemed to be processing sensitive categories of data regarding one person because another has published such data, requiring a separate assessment of legal grounds to process the data published by such other person but relating to the initial person is precisely that: a requirement to police users.

Given the statutory regimes developed in the EU and other jurisdictions to protect online intermediaries such as providers of platforms featuring user-generated content, and the general assumption that a provider can make that content is lawful until proven otherwise (see the E-Commerce Directive 2000/31/EC for an early example), a social media provider should equally be permitted to assume that processing is permitted as if it were “own data” of the user him-/herself and not have to systematically approve each piece of content.

This presumption could be refuted, but that would be through means that are already available for persons to “take down” content that should not be there (whether by asking the poster nicely, by reaching out to the moderation team of the relevant social media provider or even by going before the courts – but be mindful of the “Streisand effect” in that case).

In any event, the Cologne HRC draws an analogy with search engines and in particular the CJEU’s judgment of 24 September 2019 in GC et al. (C-136/17, see para. 118 of the Cologne HRC judgment) to show that incidental processing of sensitive data can be permitted. After then highlighting the tension between a strict interpretation of the GDPR and the free movement of data (para. 119), the Cologne HRC ends up quoting the AI Act to justify its conclusion, namely that the EU legislator “did not assume a corresponding impossibility or fundamental unlawfulness” in relation to AI model training (para. 120). In addition, the Cologne HRC highlights the “established low risk of concrete harm to the data subjects through the further processing of the already public data” (para. 121). [The CNIL’s passage on this is more convincing in my view – see below.]

The conclusion? “There is therefore no prohibition on processing” (para. 123).

5. French CNIL & German DSK guidance on AI systems

On 19 June 2025, the French data protection authority, the CNIL, published updated guidance on legitimate interest as a legal ground for AI system development purposes. The CNIL’s guidance is highly relevant, and echoes many of the considerations of the Cologne HRC.

For instance, on synthetic data, it writes the following:

“When it does not adversely affect the performance of the model developed, favour the use of synthetic data. This can also have certain advantages, such as making certain data available or accessible and modelling specific situations, avoiding the use of real data, particularly sensitive data, increasing the volume of data for training, or minimising risks related to data confidentiality, etc. It should be borne in mind that synthetic data is not always anonymous.

Example: if a supplier wishes to develop an image classification system to automatically detect the carrying or use of a weapon, the use of synthetic images makes it possible, for example, to avoid collecting data that could suggest the commission of an offence, to vary the possible configurations more easily, or to improve the representativeness of the database, in particular because of the possibility of varying the characteristics of the synthetic image of the person (height, weight, skin colour, etc.) and of the weapon to be detected (shape, colour, etc.). etc.) and the weapon to be detected (shape, colour, etc.).”

In other words, performance of the model is a relevant argument to consider that personal data is necessary.

The other mitigation measures echo many of the EDPB’s suggested mitigation measures, and several have to do with de-identification and measures to manage objections.

The CNIL also published guidance on scraping that includes an important section on sensitive data:

“If, despite the measures taken, the organisation incidentally and residually processes sensitive data that it did not seek to collect, this is not considered illegal. This was the view taken by the Court of Justice of the European Union, which pointed out that this prohibition applies to search engine operators ‘within the limits of their responsibilities, competences and capabilities’ (CJEU, Grand Chamber, 24 September 2019, GC e.a, C-136/17). However, if the organisation becomes aware that it is processing sensitive data, in particular through the data subject, it is required to proceed, as far as possible, to its immediate and automated erasure.”

In other words, incidental processing of sensitive data is permitted as long as there is no knowledge that there is processing of sensitive data.

The guidance of the DSK, the conference of German supervisory authorities, published in June 2025 and concerning AI systems also echoes many of the considerations of the Cologne HRC, with a particular focus on “non-linking” guarantees that echo the broader considerations of the Cologne HRC regarding the DMA and the merging of datasets.

The following excerpt regarding the right to erasure is also important, though whether it is actually workable is another matter:

“Erasure: If erasure is required in accordance with Art. 17 para. 1 GDPR, it is technically necessary to completely erase the data in question. This includes inputs and outputs, especially if they are reused as training data, but also the AI model if it “contains” the- information to be erased. This can generally be assumed at least if the information was contained in the training data used and an output of the AI model. In this case, a new AI model must be trained regularly, whereby the data to be deleted must no longer be contained in the training data, or the existing AI model must be retrained appropriately (machine unlearning). The success of machine unlearning must be proven by ensuring that the data in question can no longer be identified as contained in the training data based on the AI model. Suitable technical and organisational measures, e.g. input and output filters, must be used as an interim solution. However, such mitigating measures, especially filters, do not in themselves constitute deletion. There is not necessarily a right to erasure of personal data in every case, but restrictions and exceptions are formulated in Art. 17 para. 2 and 3 GDPR.”

In this respect, I think a broader discussion could take place: could we not foresee a situation where the CJEU’s interpretation of what constitutes “erasure” in the context of phone directories (= not an actual deletion but a change of parameters to prevent the visibility of contact details at an output level) can be used to support output filters as a strong measure equivalent to erasure?

See paragraphs 69 & 70 of the Proximus judgment (C-129/21, 27 October 2022):

“69      However, in the present case, a request for withdrawal of a subscriber’s data contained in a directory does not seek to replace inaccurate data with correct data or to complete incomplete data, but to withdraw the publication of correct data.

70      The fact that such a withdrawal takes the form, in the present case, of the mere adjustment of the code assigned to the subscriber concerned in Proximus’ database – from which that subscriber’s personal data are published in the directories – cannot prevent a request for withdrawal of personal data contained in those directories from being regarded as a ‘request for erasure’ within the meaning of Article 17 of the GDPR. As is apparent from the documents before the Court, the method of withdrawal provided for by the operator in question constitutes a purely technical or organisational measure which proves necessary to respond to the request for erasure of the data subject’s personal data and to prevent the disclosure of those data.”

This approach was validated by the CJEU – so perhaps it can serve as inspiration for other areas?

---

In conclusion, the Cologne HRC is an important, carefully considered judgment, and it finds echoes in recent publications by supervisory authorities in Germany and France. It has its flaws, but much points towards greater acceptance of AI model training – provided certain safeguards are taken into account, notably at the level of data selection, filters and transparency.