The Risk Does Not End at Collection

The public-web-to-model pipeline needs safeguards after a collection has been judged potentially defensible. The relevant question is not whether an organisation has a notice, an opt-out form, or a filter somewhere in the system. It is whether each measure addresses a particular failure surface: unnecessary source material, a person’s request, direct identification, memorisation, harmful output, or sensitive information that entered despite the project’s intentions. Readers should be able to match safeguards to the stage where they can work and understand why special-category data require an especially careful response.

The EDPB describes mitigation as tailored to the circumstances. Its examples range from excluding risky sources and publishing information about collection to facilitating rights, deleting unnecessary data, pseudonymising records, deduplicating material, and limiting memorisation or regurgitation. These measures are not an exhaustive checklist. A control is meaningful only in relation to the risk it is intended to reduce and the evidence that it works well enough for the project’s situation.

One control cannot cover the whole pipeline

Controls begin with source selection. A project can exclude content likely to contain personal data that is unnecessary for the purpose, avoid sources that are particularly intrusive, and limit the collection to material that is freely accessible and reasonably expected to be available. The EDPB also points to excluding certain categories of data or sources by default and to imposing time limits or other collection limits. These controls act before the dataset grows, so they reduce the amount that later stages must inspect and govern.

Transparency works at a different point. A public privacy policy or specific notice can explain the categories of personal data, the purpose and legal basis, the sources, whether they were publicly accessible, and characteristics of the crawler. Where possible, the organisation can make domains or URLs searchable and state the collection date or period. It can explain rights and provide a route for people to contact the responsible organisation. Updated lists of scraped sites can make the account more useful over time.

Transparency does not replace source exclusion. A clear notice can tell people that a broad collection happened, but it does not make an unnecessary category necessary or make an unexpected use expected. Nor does it replace an opt-out or objection mechanism. The EDPB describes facilitating rights as a separate mitigation, including a discretionary prior right to object and an opt-out list that allows people to object before collection by providing information that identifies them on particular sites or platforms.

Dataset controls address yet another failure surface. Unnecessary personal data can be deleted or anonymised as soon as possible. Pseudonymisation can limit direct identification, including by replacing direct identifiers with placeholders for training in some cases. Deduplication can reduce repeated exposure and is also relevant to limiting memorisation or regurgitation. These steps can reduce risk, but their value depends on what the transformation actually achieves. A record that no longer contains a full name may still identify someone through a combination of details, and removing duplicates does not prove that the remaining material is necessary.

Model and output controls act later. The EDPB points to measures that limit the risks of memorisation, regurgitation, or attacks on AI models and systems.