EU privacy rights: GDPR and the AI Act

The GDPR protects natural persons whose personal data is processed. Under Article 3 it applies to organisations established in the EU, and to organisations elsewhere that offer goods or services to people in the EU or monitor their behaviour there. The authorities of Iceland, Liechtenstein and Norway also sit on the European Data Protection Board.

Facial images become biometric data when specific technical processing allows or confirms unique identification (Article 4). Processing biometric data to uniquely identify a person is prohibited unless an exception such as explicit consent applies (Article 9).

• Access (Article 15). Confirmation that your data is processed, a copy, and details such as purposes, recipients, storage period and source.
• Erasure (Article 17). Deletion where a listed ground applies, for example the data is no longer necessary, you withdraw consent, your objection succeeds, or the processing was unlawful.
• Objection (Article 21). You may object to processing based on legitimate interests or a public task. The controller must stop unless it shows compelling legitimate grounds. An objection to direct marketing must always be honoured.

Erasure does not apply where processing is necessary for freedom of expression and information, a legal obligation, public health, archiving or research, or legal claims.

1. 1.Find the organisation's privacy contact or data protection officer in its privacy policy.
2. 2.Write a request naming the right, the article and the data concerned. No particular form is prescribed.
3. 3.Be ready to confirm your identity if the controller has reasonable doubts.

Article 80 lets you mandate certain not-for-profit bodies to complain for you. For other representatives, a controller may ask for evidence of authority.

Under Article 12(3) the controller must tell you what action it has taken without undue delay and within one month of receipt. It may extend by two further months because of the complexity and number of requests, and must tell you so within the first month. If it will not act, it must give reasons within one month and tell you that you can complain. Requests are free unless manifestly unfounded or excessive.

Under Article 77 you can complain to a supervisory authority, in particular where you live, where you work or where the infringement took place. Article 79 adds a right to a judicial remedy. Fines for infringing these rights can reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Article 83).

In Opinion 28/2024 the European Data Protection Board said AI models trained on personal data cannot in all cases be considered anonymous. Where a model was developed with unlawfully processed data, an authority may impose corrective measures which, depending on the facts and proportionality, could include ordering erasure of the dataset or of the model itself. People can also request deletion of unlawfully processed data, subject to Article 17.

Those are regulators' powers in specific cases. The opinion does not say a person can be taken out of a trained model on request. A request is clearest when it targets identifiable stored data: source images, dataset entries, profiles and outputs.

Since 2 February 2025 the AI Act has banned AI systems that create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage. Deepfakes must be disclosed as artificially generated or manipulated (Article 50). An amendment in force since July 2026 adds a ban, applying from December 2026, on AI systems that generate sexually explicit or intimate content of identifiable people without consent.

Anyone may complain to a market surveillance authority under Article 85. The AI Act creates no personal right to deletion.