There is no doubt that AI systems, and the large-scale processing of personal data that often accompanies their development and use, has put a strain on individuals’ fundamental rights and freedoms. Against that background, this chapter aims to walk the reader through a selection of key concerns arising from the application of the GDPR to the training and use of such systems. First, it clarifies the position and role of the GDPR within the broader European data protection regulatory framework. Next, it delineates its scope of application by delving into the pivotal notions of “personal data,” “controller,” and “processor.” Lastly, it highlights some friction points between the characteristics inherent to most AI systems and the general principles outlined in Article 5 GDPR, including lawfulness, transparency, purpose limitation, data minimization, and accountability.

Importantly, and in contrast with Article 10(2) and Article 10bis(2), the language of Article 10(1) Berne is not limited by purpose. It simply states ‘it shall be permissible to make quotations’. There is no limitation, even illustrative, such as ‘for purposes such as criticism or review’. Given that the provision is mandatory, it would thus be inappropriate for a Member to introduce any limiting purpose (or at least one which operates inflexibly). Quotation is permitted, if it complies with the remaining condition, whatever its purpose.