Access to Data Is Not Permission to Train AI
A private message is written for an audience and a purpose. Using it to train artificial intelligence changes that relationship. The information may already sit on a company’s servers, but technical access does not establish a lawful basis for another use.
Ireland’s Data Protection Commission (DPC) addresses this distinction in its September 2026 report, Responsible Artificial Intelligence Innovation. It explains that private communications carry an inherent expectation of privacy. Relying on legitimate interests to use those messages for AI training would require a substantially higher justification than using publicly available information, a threshold the DPC considers very difficult to meet (DPC, 2026, p. 51).
Under the General Data Protection Regulation, consent is one possible lawful basis, alongside others such as legitimate interests. That latter basis requires consideration of necessity and the individual’s interests and fundamental rights. Possession of personal data is not itself a lawful basis for processing it (European Parliament & Council of the European Union, 2016, art. 6).
The DPC also emphasizes that simply telling people their messages might be used for training may not establish that they reasonably expect that use. To rely on legitimate interests, organizations must justify why private messages are needed for the particular AI training purpose and why suitable alternatives, such as synthetic or publicly available data, would not meet that need (DPC, 2026, p. 51).
The broader philosophical question concerns the boundaries of disclosure. Sharing information in one setting does not necessarily express willingness to share it in every setting. A conversation with a friend, a request for assistance, and a contribution to a training dataset serve different purposes. Treating them as interchangeable reduces communication to a resource while overlooking the relationship that made disclosure possible.
History matters here, too. The DPC’s discussion of older datasets stresses that expectations must be assessed against the circumstances and information provided when the data was collected (DPC, 2026, pp. 49–50).
Responsible AI development begins with examining those boundaries. Before asking what a dataset can teach a model, organizations should ask what justified collecting it and what justifies the proposed use.
References
Data Protection Commission. (2026). Responsible artificial intelligence innovation: Insights from the Data Protection Commission’s supervision of AI (2021–2025).
European Parliament & Council of the European Union. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation).