The paper examines how the EU General Data Protection Regulation (GDPR) is applied to the development of AI products and services, drawing attention to the differences between academic and commercial research. The GDPR aims to encourage innovation by providing several exemptions from its strict rules for scientific research. Still, the GDPR defines scientific research in a broad manner, which includes academic and commercial research. However, corporations conducting commercial research might not have in place a similar level of ethical and institutional safeguards as academic researchers. Furthermore, corporate secrecy and opaque algorithms in AI research might pose barriers to oversight. The aim of this paper is to stress the limits of the GDPR research exemption and to find the proper balance between privacy and innovation. The paper argues that commercial AI research should not benefit from the GDPR research exemption unless there is a public interest and has similar safeguards to academic research, such as review by research ethics committees. Since the GDPR provides this broad exemption, it is crucial to clarify the limits and requirements of scientific research, before the application of AI drastically transforms this field.

本文探讨了如何将欧盟通用数据保护条例（GDPR）应用于AI产品和服务的开发，并提请注意学术研究与商业研究之间的差异。GDPR旨在通过对科学研究的严格规定提供一些豁免，以鼓励创新。GDPR仍然以广泛的方式定义了科学研究，包括学术研究和商业研究。但是，进行商业研究的公司可能没有与学术研究人员类似的道德和制度保障水平。此外，人工智能研究中的公司保密性和不透明算法可能会给监督带来障碍。本文的目的是强调GDPR研究豁免的局限性，并在隐私与创新之间找到适当的平衡。该论文认为，除非有公共利益并且与学术研究具有类似的保护措施，例如由研究伦理委员会进行审查，否则商业AI研究不应从GDPR研究豁免中受益。由于GDPR提供了广泛的豁免，因此在AI的应用彻底改变这一领域之前，弄清科学研究的局限性和要求至关重要。