Under the European GDPR, if the personal information that an organization is going to use as part of training an AI has been collected directly from individuals, then those individuals should be provided with a copy of the organization’s privacy notice “at the time when personal data are obtained.”[1] If the personal information that the organization is going to use as part of training an AI has been collected from a third-party source (e.g., scraped from the internet or received from another controller), then the GDPR generally permits the controller (with a few exceptions) to provide a copy of its privacy notice “within a reasonable period, but at latest within one month” after the data is collected.[2] The latter requirement is memorialized within GDPR Article 14.
