Lawfulness of mass processing personal data to train large language models in China

Abstract

With the rapid rise of large language models (LLMs), the lawfulness of training them on massive datasets has come under increasing scrutiny. This article examines the issue under Personal Information Protection law (PIPL) of China, focusing on whether a valid legal basis exists for such processing. In particular, it analyzes Article 13(1), which permits the use of publicly available personal data or nonpublic data with the consent of the subject of data. This work asserts that, in practice, LLMs developers face challenges in meeting the consent and purpose limitation requirements of the PIPL leaving limited room for lawful data use. To address this gap, it proposes a “broad input, strict output” approach, easing restrictions during the training stage while enforcing stricter controls at the application phase, and it calls for a more precise allocation of roles among stakeholders to ensure responsible AI development.