In episode 5 of AIPA Tomorrow Talks (25 September 2022), Vircon Legal co-founder Erdem Mümtaz Hacıpaşaoğlu discussed AI and law: personal data protection, entrepreneurship and Web 3.0.
Where AI and personal data meet
Every model that touches people runs on personal data twice over: once when it is trained and again each time it is used. Those are separate processing activities needing separate lawful bases under the KVKK, and the second one is where organisations most often have nothing written down. Profiling and automated decision-making attract specific protections when the output significantly affects someone, including a route to genuine human review.
For an early-stage company the practical consequence is that data questions are product questions. What the training set contains, whether users were told, how long outputs are retained and what the vendor may do with prompts all shape what the product can lawfully become — and a DPIA written before launch is cheaper than one written after a complaint. Current framework: our AI Compliance Hub and Generative AI at Work and KVKK.
Author
If this is on your desk
Templates and checklists are free in the Founder Academy; for a specific situation, book a 30-minute intro call.
Founder AcademyBook an intro call