Personal Data Protection and AI Models: When Privacy Law Meets Model-Based Systems

This article examines the fundamental mismatch between modern generative AI systems and traditional, record-based data protection frameworks, such as the EU GDPR and Thailand's Personal Data Protection Act (PDPA). Conventional privacy laws rely on traceable data flows, distinct records, and linear purposes. In contrast, generative AI transforms personal data into abstract mathematical parameters within neural networks. This architectural shift severely undermines core legal principles: Lawful Bases & Transparency: Meaningful consent and legitimate interest balancing tests become impractical when developers cannot accurately trace how specific training points influence downstream outputs. Rectification and Erasure: Substantive rights to correct or delete data are technically unfeasible when personal details are distributed across billions of model weights, reducing legal safeguards to procedural compliance audits. Regulatory Approaches: While the EU combines the GDPR with the AI Act, jurisdictions like Thailand rely on general statutes and evolving guidelines, exposing underlying statutory gaps. The author concludes that incremental guidelines are insufficient; targeted legislative reform is vital to prevent privacy laws from degenerating into empty procedural formalities.