Getty v Stability AI: implications for personal data and model training

These excerpts from the Getty v Stability judgment will be interesting for data protection professionals to look at, not just copyright professionals:

– Judge: “Stable Diffusion does not itself store the data on which it was trained” [para. 552 of the judgment]

– Expert report: “Rather than storing their training data, diffusion models learn the statistics of patterns which are associated with certain concepts found in the text labels applied to their training data, i.e. they learn a probability distribution associated with certain concepts.” [quoted in para. 554]

– The issue of memorisation is discussed in detail, but the judge notes that “There is no evidence of any Copyright Work having been “memorized” by the Model by reason of the Model having been over-exposed to that work and no evidence of any image having been derived from a Copyright Work.” [para. 559]

– Paras. 599-601 are really worth reading, and also work well if you substitute “copy” or “Copyright Works” with “personal data”. The following sentence in particular: “While it is true that the model weights are altered during training by exposure to Copyright Works, by the end of that process the Model itself does not store any of those Copyright Works; the model weights are not themselves an infringing copy and they do not store an infringing copy” – and in the case of personal data, you still have Breyer+SRB to take into account, which make the issue even less obvious regarding training data (as I have repeatedly highlighted).

All in all, many GDPR parallels to be made – and the emphasis in para. 559 on evidence is equally relevant. The GDPR only applies to *personal data*, not to *assumed* personal data.

Sure, some will allege the standards and thresholds are different, but I still haven’t seen evidence of actual processing of personal data within AI models – and even with AI model training, the issue is far less straightforward than simply claiming “all training involves processing of personal data” (again, as SRB shows us).

Even memorisation is an odd one, because the (near?) 100% correctness of Donald Trump’s birthday or Emmanuel Macron’s role as French president relates to output, not the AI system. The true controller for actual processing might still be the user, not the provider. As I say (& this judgment seems to confirm), everything is *synthetic* data from the perspective of the AI model provider at an output level.

Looking forward to further developments in this space!

The judgment: https://lnkd.in/eJX8QU94
Some previous writings on personal data & AI model training/usage:
– Good & bad in judgment on Meta AI training & personal data (legitimate interests, sensitive data) + new FR & DE guidance: https://lnkd.in/eY7XeUuz
– AI training data = (non-)personal data? And is consent really relevant? – https://lnkd.in/eYXabSfs
– AI training & legitimate interest as GDPR legal ground: https://lnkd.in/eQRFZxCi

Plus on music, AI & AI detection: https://lnkd.in/eRfMThJf