compliance (gdpr ccpa)

**Compliance with GDPR and CCPA** in the context of AI and machine learning requires that organizations meet specific **data protection obligations** when collecting, processing, and using personal data for model training, inference, and deployment. **GDPR (General Data Protection Regulation) — EU** - **Lawful Basis**: Must have a legal basis for processing personal data — typically **legitimate interest** or **consent** for ML training. - **Purpose Limitation**: Data collected for one purpose cannot be repurposed for model training without additional justification. - **Data Minimization**: Only collect and process the minimum data necessary for the intended purpose. - **Right to Erasure ("Right to be Forgotten")**: Individuals can request deletion of their data — this may require **model retraining** or **machine unlearning** if their data was used for training. - **Right to Explanation**: Automated decisions that significantly affect individuals require meaningful information about the logic involved. - **Data Protection Impact Assessment (DPIA)**: Required for high-risk processing activities, including large-scale profiling and automated decision-making. - **Fines**: Up to **€20 million** or **4% of global annual revenue**, whichever is higher. **CCPA/CPRA (California Consumer Privacy Act) — US** - **Right to Know**: Consumers can request what personal information is collected and how it's used. - **Right to Delete**: Consumers can request deletion of their personal information. - **Right to Opt-Out**: Consumers can opt out of the **sale or sharing** of their personal information. - **Non-Discrimination**: Cannot discriminate against consumers who exercise their privacy rights. - **Fines**: Up to **$7,500 per intentional violation**. **AI-Specific Compliance Challenges** - **Training Data Provenance**: Maintaining records of what data was used to train which models. - **Model Unlearning**: Efficiently removing an individual's influence from a trained model without full retraining. - **Automated Decision Transparency**: Explaining how an ML model reached a specific decision. - **Cross-Border Data Transfers**: GDPR restricts transferring EU citizens' data outside the EU. Compliance is not optional — organizations deploying AI systems that process personal data must integrate privacy-by-design principles throughout their ML pipelines.