Gains:
- Distinguishing six legal bases for data processing with AI and choosing the right one
- Evaluating the conditions of explicit consent and the drawbacks of relying on consent
- Drafting a white paper covering the use of AI
In the previous unit, we said, “Entering data into AI is a processing and requires a valid legal basis.” So what is this legal basis and how is it chosen? The most common mistake compliance officers make is trying to solve everything with "explicit consent". However, consent is often the weakest and most fragile basis. In this unit, we will learn the legal basis offered by KVKK, choosing the right one among them, the obligation to inform, and the real place of explicit consent in the context of AI use.
What is the legal basis?
Legal basis (condition for processing) is the justification that makes processing personal data lawful. According to KVKK, personal data is processed with explicit consent as a rule; However, the law enumerates six exceptions for which express consent is not required. A transaction must sit on at least one of these bases. Processing without justification is unlawful.
Legal basis
briefly
AI usage example
Not clearly provided for in law
If required by legislation
Record that is legally required to be kept
Performance of the contract
If it is mandatory for the contract
Preparing the order summary to the customer with AI
legal obligation
For the legal duty of the institution
Producing tax/audit records
publicization
If the person has made the data public himself
Analyzing one's public writing
legitimate interest
Without harming the person concerned
Theme analysis of complaint texts with AI
Establishment/protection of a right
For lawsuit/right defense
Summarizing the dispute file with AI
Explicit consent
Free, informed consent of the individual
If none of the above apply
Caution: Explicit consent is at the end of the list because it is the most fragile basis: a person can withdraw at any time, and once withdrawn the processing must be stopped. If possible, one of the other bases (in particular the performance of the contract or legitimate interest) is evaluated first.
Balance of legitimate interests
Legitimate interest is a flexible basis that can be used if the institution has a reasonable interest and this interest does not harm the rights and freedoms of the person concerned. But it requires a balancing test: does the interest of the institution or the right of the individual prevail? In the use of AI, this testing is done like this:
- Is the interest real and legitimate? (E.g. resolving complaints quickly.)
- Is the use of AI necessary for this benefit? Is there a less intrusive way?
- Are the person's rights violated? If there is sensitive data, profiling, or unexpected use, the balance shifts in favor of the individual.
Legitimate interest cannot be relied upon if the balance weighs in favor of the individual; another basis (usually explicit consent) or opt-out from processing is required.
three mini cases
Case 1 — Consent trap. An HR team collects “explicit consent” from employees to analyze employee performance ratings with AI. However, there is an imbalance of power between employee and employer; The outcome of saying “no” is uncertain, so consent may not be considered free. The right way: to base this processing not on consent but on legitimate interests arising from the business relationship or on contract, and document the balancing test.
Case 2 — Correct basis, unnecessary consent. An e-commerce company generates invoice statements with AI when preparing the order. This processing is directly within the scope of the performance of the contract; There is no need to obtain additional consent. The team adds an unnecessary consent box, the customer abandons the transaction. Choosing the right basis improves both the law and the customer experience.
Case 3 — The balance test is in favor of the person. A company wants to "personality analyze" and score candidates' social media profiles with AI. This is a procedure that the candidate does not expect and that deeply touches his privacy; The balance test clearly ends in one's favor. Legitimate interest cannot be used; The company abandons this practice.
Four conditions for valid express consent
If explicit consent is truly necessary, it must meet all four conditions to be valid; If one is missing, consent is legally invalid:
- Regarding a specific subject: General consent such as "I consent to any processing" is invalid; Consent must be specific to individual purposes.
- Information-based: The person must clearly know what he or she is consenting to (which data, which purpose, which AI, overseas transfer).
- Explained by free will: Consent is not considered free if there is pressure, imposition or "no service if you do not consent" condition.
- Revocable: The person must be able to withdraw his/her consent at any time and the processing must stop when he/she withdraws it.
In the context of AI, the most frequently broken condition is the latter: the person is not told that their data will be entered into an AI and possibly processed abroad. This omission can invalidate even a consent that technically appears to have been obtained.
Caution: Making consent a prerequisite for a service ("accept or you can't continue") invalidates consent in most cases. Consent should be a choice where the person can actually say “no”; Otherwise, it is necessary to seek another legal basis.
Obligation to inform
Regardless of the legal basis, KVKK imposes an obligation to inform: the data subject must be clearly explained who you are, for what purpose and on what basis you process the data, to whom you transfer it and what their rights are. When AI comes into play, the disclosure text should also be updated — in particular, the phrases “your data may be analyzed by automated systems/artificial intelligence” and “may be transferred to overseas servers” should be added.
Hint: "Can one person read the clarification text in 2 minutes and understand what it is?" pass the test. Stating the use of AI in a simple sentence, rather than hiding it, is both a legal obligation and a building of trust.
Copiable templates
TEMPLATE 1 - Selection of legal basis: "I will perform the following processing: [describe the processing]. List which of the 6 legal bases of KVKK may be APPROPRIATE and which are NOT, with justification. Consider explicit consent only as a last resort. Final legal decision-making; list the options to be submitted for legal approval."
TEMPLATE 2 — Legitimate interest balancing test: "Draft the legitimate interest balancing test for the following use of AI: [describe the use]. Three headings: (1) is the organization's interest genuine, (2) are there less intrusive alternatives, (3) are the individual's rights harmed? Write separate pro/con arguments under each heading."
TEMPLATE 3 — AI addition to the clarification text: "Suggest a paragraph reflecting the use of AI in our current clarification text. State in plain language: that the data can be analyzed by automatic/AI systems, the possibility of transfer abroad, that human control is preserved and the data subject's right to object. Maximum 120 words."
TEMPLATE 4 — Consent requirement check: "Evaluate these 5 processes one by one and state for each one whether 'explicit consent is REQUIRED' or 'other basis is sufficient': [List 5 processes]. Remind each line of the drawback of unnecessary consent collection."
Weak prompt / Strong prompt
WEAK: "Write a consent text for this data processing."-> Perhaps locks the institution into an unnecessary or invalid consent, without questioning whether consent is the correct basis. STRONG: "First evaluate which legal basis is appropriate for this processing; is consent really necessary? If necessary, draft a free, informed and revocable consent; if unnecessary, suggest on which basis to sit and what to add to the information text."-> The model first questions the correct basis, then produces the appropriate text.
Common mistakes
- Trying to automatically resolve every processing with "explicit consent".
- Considering consent as "free" in relationships with power imbalance, such as employee-employer.
- Gathering unnecessary consent when there is a correct basis (contract, legitimate interest).
- Failure to test or document balance when relying on legitimate interest.
- Not reflecting the use of AI in the lighting text at all.
- Concealing international transfer in lighting.
- Not establishing a mechanism to stop processing when consent is withdrawn.
In summary
- Every AI-based processing must sit on at least one of the six legal bases of KVKK.
- Explicit consent is the most fragile basis; may be withdrawn and voided in case of imbalance of power.
- Legitimate interest is flexible but requires a balancing test; It cannot be used if the person's rights outweigh it.
- Regardless of the legal basis, there is an obligation to enlighten; AI and overseas transfer are reflected in the text.
- Choosing the right basis improves both the law and the customer/employee experience.
Application task
Identify three different processing scenarios that will be done with AI in your organization (for example: customer complaint analysis, candidate evaluation support, invoice summary). For each scenario, choose the most appropriate legal basis with justification and explain why explicit consent is not required (or why it is). Write your three-step balancing test for at least one scenario where you base legitimate interest. Finally, draft a paragraph to include in the disclosure text covering these scenarios and include information about AI automated processing and overseas transfer.
checklist
- [ ] I have chosen the correct legal basis for each processing.
- [ ] I used express consent only where it was truly necessary.
- [ ] I have carried out and documented the balancing test in the legitimate interest scenario.
- [ ] I questioned the validity of consent in relationships with an imbalance of power.
- [ ] I added AI and auto-processing information to the lighting text.
- [ ] I have clearly stated the transfer abroad.
- [ ] I planned the consent withdrawal mechanism.