General legal issues in dealing with generative AI

Questions of copyright and the use of AI-generated materials are probably the most important aspect of the use of generative AI services at universities. Key questions are presented below and answered according to the current state of knowledge.

Irrespective of specific legal issues, the use of generative AI services requires conscious use and responsible practices.

These include

1. Legally compliant use of sources: Ensure that you have the appropriate rights or licences to use the content in question before entering it as input into the AI service .
2. Compliance with terms of use: Make sure that you understand and comply with the terms of use of the provider of the respective AI service. In the case of GPT, these are in particular the terms of use for the service.
3. Legal advice: If you have any doubts as to whether a particular use of an AI service could infringe copyright or other areas of law, please contact the relevant university organisations. Contact information is linked in the info box at the beginning of this document.

Brief assessment: German law applies the provisions of the German Copyright and Related Rights Act (UrhG) to the question of copyright protection for training data from AI services. Comprehensive legal clarifications on the lawful use of training data for AI services and the possible implications for users of the services are still pending. However, until relevant court judgements or framework regulations are available, it can be assumed that the use of generative AI services does not fundamentally violate the provisions of the UrhG. Further information is provided below.

Further information: Firstly, any output provided by generative AI services is based on prior training with a given corpus of data. The existence of legal infringements in the use of the data contained in the corpus by the manufacturers of the AI services can only be clarified on a case-by-case basis. The same applies to any resulting legal infringements on the part of the users. Nevertheless, in order to provide some guidance, the AI service "ChatGPT", which is offered by the company OpenAI LP, hereinafter referred to as "OpenAI", is used as an example below.

In its current implementation, the GPT service is a version of ChatGPT from OpenAI LP that has been adapted for the university and is offered as a Microsoft Azure OpenAI service. All information available for the training of ChatGPT therefore also applies to the university's own AI service.

According to OpenAI, the training of the AI service took place exclusively with the help of publicly available texts from the Internet. OpenAI has not specified which documents should be included in the training data. ChatGPT's automated training processes "read everything they could access". According to OpenAI, this included a wide range of text types from various fields, including books, journals, blogs, forums, random websites and other written materials. ChatGPT was not able to access protected databases, subscription services or confidential information.

According to OpenAI, it did not store any information about the specific texts that ChatGPT saw during training. Instead, the model learnt to recognise patterns in the data and generate new texts based on these patterns. ChatGPT therefore has no access to or knowledge of specific documents, books, academic papers or other concrete sources that it processed during training.

Due to the approach chosen by OpenAI, it is therefore not possible to determine with certainty whether any copyrighted material was used for ChatGPT's training. The manufacturer OpenAI keeps statements about copyright declarations for the training data correspondingly vague, but assures that it has used texts that are either in the public domain or for which a legal clearance has taken place or whose use falls under the US "fair use" principle.

German law does not recognise such "fair use" principles, but applies the provisions of the Copyright Act. Here, access to copyright-protected content for the purposes of text and data mining is permitted as long as the works used are accessible in accordance with the law (Section 44b (1) UrhG). However, a number of authors, including major scientific publishers, prohibit the use of the published works as a basis for data mining and AI training in their terms of use. The legal consequences of this for the training of AI services are still unclear.

According to the Copyright Act, the training data must be deleted as soon as it is no longer required. Training data is no longer required once the data analysis has been completed and the use of the results of the data analysis has begun. The EU Artificial Intelligence Act stipulates that authorities must have unrestricted access to all training, validation and test data sets used by the providers of AI services at all times (Art. 64 para. 1 EU AI Act). This requires careful and persistent archiving of all data used.

Brief assessment: In Germany, questions of authorship for AI-generated media are governed by the Copyright Act (UrhG), which takes a clear position in this regard. For the output of an AI service to be protected by copyright at all, it must be a work. Within the meaning of Section 2 (2) UrhG, works are defined as personal intellectual creations that are sufficiently creative. According to current legal opinion, this implies that a work can only be created by a human being. AI services are not human and therefore their generated content cannot be a personal intellectual creation. This rules out the existence of a work within the meaning of the Copyright Act and German copyright law does not initially apply to outputs generated by AI services.

Further information: Nevertheless, there are significant constellations in which copyrights may very well exist in the output of an AI service. The utilisation of AI-generated media also raises questions that go beyond copyright law. The following two sections provide more information.

Section 3.2.1 is dedicated to cases in which the AI generates an output containing copyrighted material without the user's intervention. Section 3.2.2 explains cases in which copyright infringements occur because the users themselves enter protected works into the AI service and the output therefore also contains copyrighted material.

Although AI services have no copyright in the media they generate, copyrights may very well exist in the output of an AI service, including in the constellations described below. Because the copyrights of third parties may be infringed in two of the three cases described, special care is required here.

1. Direct copies of existing works: The basic technical operating principle of generative AI services ensures that no direct copies or "transcripts" of existing works can be created. This is changed by the ability of modern AI services to carry out internet research or access their own knowledge databases when generating their answers. In this case, direct quotations and copies of copyright-protected works can be included in the output of the AI service to any extent, the further use of which is then subject to German copyright law.
2. Accidental similarities: The output may be a pre-existing work by mere coincidence if the AI service "unintentionally" generates content that is very similar or identical to copyrighted material. In this respect, the AI service is no different from human authors. The probability of unintentional reproduction is potentially even higher for humans than for AI services, as passages that have been read once remain stored verbatim in human memory.

In the case of coincidental similarities, the question naturally arises: how similar is too similar? According to the case law of the European Court of Justice (ECJ), even eleven consecutive words can constitute an intellectual creation (ECJ GRUR 2009, 1041 para. 48 - Infopaq). This would then constitute a reproduction (Section 16 UrhG). If the text is subsequently published, for example as part of a website, this would constitute making available to the public (Section 19a UrhG). If the rights holder has not given their consent, this constitutes an infringement of copyright. For users, this means that they should take measures to avoid copyright infringement caused by mere coincidence (see question 3.6).

1. Authorship by the users themselves: If the aforementioned cases do not apply, the users themselves can also claim authorship of the output of an AI service. This can be assumed if the input was originally produced by the users and has reached a sufficient level of creativity. In such cases, the input is already to be considered a work within the meaning of Section 2 (2) UrhG. This means that the copyright to the output also lies with the user because the output is merely a technical processing of the input. To put it succinctly: Anyone who prompts cleverly enough can become the author of the output.

Incidentally, copyright law protects certain art forms and technologies in a special way. In the case of (i) the filming of a work, (ii) the execution of plans and designs of a work of fine art, (iii) the reproduction of a work of architecture or (iv) the adaptation or redesign of a database work, even the production of the adaptation or redesign requires the author's consent (Section 23 (2) UrhG). Here too, the boundaries between art and science are fluid and require clarification on a case-by-case basis.

The output can therefore be a work because the input was already protected by copyright. If a copyright-protected work or parts thereof are entered into an AI service as a prompt, this constitutes a reproduction (Section 16 UrhG). If users have not acquired a corresponding right of use for the work, this reproduction may constitute an infringement.

This is the case if there are third-party rights to the input. A typical example is the copying of text passages from a pre-existing work for the purpose of having this work modified by the AI service, e.g. by translating, summarising or shortening it. This generally constitutes an adaptation or alteration of the work (Section 23 (1) sentence 1 UrhG). The utilisation of the adapted or rearranged work requires the author's consent. In the directly following sentence, however, the UrhG restricts that such an exploitation requiring consent no longer exists if the newly created work is sufficiently distant from the used work. A sufficient distance can exist if the older work serves as a mere inspiration for an independent work, behind whose individuality the features of the third-party work fade. In this case, the work may be used freely (Section 23 (1) sentence 2 UrhG), but this can only be clarified on a case-by-case basis. Free use would then mean that the author of the third-party work is not entitled to any copyright to the new work.

The boundaries between unauthorised adaptation or alteration and free use are fluid. In the case of a pure translation, free use is generally not to be assumed, whereas a keyword-like summary of the pre-existing work is more likely. In case of doubt, it is strongly recommended that you consult the relevant university institutions. Contact information is linked in the info box at the beginning of this document.

Exceptions to the author's consent requirement may exist if the requirements for freedom of citation are met (Section 51 UrhG) or if the output of the AI service falls under the permissions in favour of teaching and learning or the media used therein or scientific research including text and data mining (Section 60a-d UrhG). Further information can be found in the information provided by the university on good scientific practice and scientific integrity.

A further exception may be temporary or transient reproduction, which must occur as an essential part of a technical process in order to enable a work or other protected subject matter to be transferred at all (Section 44a GDPR). Therefore, if the uploaded work is deleted immediately after processing by the AI service and the processing is also a free use (see above), such use is legally compliant. However, immediate deletion cannot usually be guaranteed for externally provided AI services. On the contrary, many providers of such services reserve the right to reuse uploaded data for later training.

There are further restrictions that enable the permanent reproduction of copyrighted material in compliance with the law, e.g. for people with disabilities or for the purposes of text and data mining. However, these are unlikely to apply to many purposes of use in the university context, so that a faithful and non-volatile use of a protected work or part of a work as input infringes copyright unless the right to reproduce the work or part of the work exists.

Brief assessment: There is currently little case law on this issue. Nevertheless, a legal opinion can be derived from German copyright law: A style is not protectable. There is much to suggest that it is permissible to use an AI service to create and publish a work that follows the style of existing artists or authors.

Further information: Under German copyright law, authors of pre-existing works do not enjoy any protective rights if an AI service creates works in their style on the basis of a prompt and these are reused. In 2021, the legislator further strengthened this position. Permitted uses can be based on the regulation on caricature, parody and pastiche, which was added to German copyright law in 2021 (Section 51a UrhG). This allows reproduction for the purpose of imitating a style or idea, even if the pre-existing work itself is protected by copyright or a related right. Similar to the right to quote, however, there must be a substantive or artistic examination of the pre-existing work.

Here, however, the boundaries to the reproduction of a copyright-protected work are fluid. Through appropriate prompts, an AI service can generate an output that is as close as desired to known and copyrighted works. Accordingly, the assessment would be different if the output were a perfect copy or at most a slight modification of an original and this were used.

Short assessment: Uploading personal photos, videos, audio recordings or entering sensitive data or information about persons with detailed biographical details that are not already lawfully made publicly available is not permitted without the consent of the persons concerned.

Further information: A concrete definition of personal data can be found in the General Data Protection Regulation (GDPR). The GDPR distinguishes between two categories, the designation of which is not entirely clear. On the one hand, there is personal data (Art. 4 Para. 1 GDPR) and on the other, special personal data (Art. 9 Para. 1 GDPR), for which there are even stricter protection requirements than for personal data.

Personal data (Art. 4 para. 1 GDPR) includes, among other things

• Real name
• Contact details, private address or location data
• e-mail address
• nationality
• age
• Marital status
• IP address or cookie identifiers
• Photo, audio or video recordings

Special personal data (Art. 9 para. 1 GDPR) includes, among other things

• Ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic or biometric data for the purpose of uniquely identifying a natural person
• Health data
• Data on sexual life or sexual orientation .

The protection of personal information is not only based on the GDPR. It has its origins in Article 8(1) of the European Convention on Human Rights, which enshrines the right to respect for private and family life. The German constitution also defines the so-called general right of personality, which is derived from human dignity (Article 1 (1) of the Basic Law) and the freedom to develop one's personality (Article 2 (1) of the Basic Law). This gives rise to the right to informational self-determination, which guarantees the protection of a person's personality. It represents the right of each individual to decide independently on the disclosure or use of their own personal data, which forms the basis for the entirety of the General Data Protection Regulation (GDPR). The intensive and repeated protection of this right in European and German law emphasises its fundamental importance for the free development of personality and individual freedom - and the consequences of violating it.

If a photo, video or audio recording or biographical data of a third party is to be used as input for an AI service, the data subject must consent to its use, unless this data is already freely and publicly available. If the person's consent has not been obtained, the right to one's own word, which is a special case of the right to informational self-determination, and the right to one's own image, for which the Art Copyright Act even defines a separate individual standard (Section 22 KunstUrhG), may be violated.

Only in individual cases can exceptions apply, which are defined in various places in the Art Copyright Act (KunstUrhG) and in the General Data Protection Regulation (GDPR). An exception may apply to portraits or video recordings in which people appear more as an accessory. Documents of contemporary history are also often excluded, e.g. video recordings of well-known artists during performances or photos of public officials performing their official duties.

When compiling prompts, all personal and special personal data must be removed from the prompts or suitably anonymised. A mere pseudonymisation is not permitted at the university, as pseudonymous data allows the data to be traced back to the person behind it and is therefore again subject to the provisions of the GDPR.

Brief assessment: AI services may not be used at the university to create undeclared counterfeits. Furthermore, AI services may not be used to imitate other people or their characteristics, such as their voice or biometric data.

Further information: AI services can technically be used to imitate existing people or characteristics (e.g. voice or a signature). There is currently very little applicable case law, but there is much to suggest that cases that have become known to date, such as the AI-generated photo of Pope Francis in a white down jacket and the interview with former racing driver Michael Schumacher generated by ChatGPT, are largely within the scope of freedom of art within the meaning of Art. 5 para. 3 sentence 1 GG and are therefore to be considered permissible.

Nevertheless, the output of an AI service can be used by users for purposes that constitute almost any legal offence. The frequently discussed offences here include forgery in all conceivable forms relevant under civil and criminal law. For example, a person is liable to prosecution for false suspicion under Section 164 of the German Criminal Code (StGB) by committing a legal offence under a different name. Forgery of documents according to Section 267 StGB or falsification of technical records according to Section 268 StGB can also be considered, along with many other legal offences, for the misuse of AI expenses.

Short evaluation: When providing the AI service GPT, the university has paid strict attention to the data protection of its members in the context of its use and has endeavoured to minimise the personal data transferred during registration and login. The specific personal data transferred can be found in the privacy policy for the service.

Further information: When dealing with AI services, a distinction must be made between services that are provided by the university itself and those that are to be procured externally. Information on external AI services can be found in the answer to question 5.2.

Services provided by the university generate two categories of data. On the one hand, this is the personal data of users transmitted during registration or login. On the other hand, these are the data transmitted by the users themselves as part of their input to the AI service.

To protect the processing of input to the AI service, the terms of use for the service contain provisions on the handling of personal data as part of prompts. We strongly recommend that you read these terms of use carefully. Part of the terms of use is, among other things, the advice to use the AI services from outside the university's IT networks only via an active university VPN connection. Help on this can be found on the help pages. Further information on data processing and data protection can also be found in the record of processing activities and in the data protection impact assessment for the service.

Brief assessment: If external AI services are to be used or procured, this requires a data protection declaration with particular attention to the transparency requirement, purpose limitation and data minimisation in accordance with Art. 5 GDPR, c) a data protection impact assessment and d) further legal declarations, including (i) the existence of commissioned data processing or joint responsibility going beyond this, (ii) the transparency of the information provided to data subjects and (iii) the transparency of storage and deletion periods. If services are to be used for employees of the university, their use is regularly subject to co-determination. It is therefore essential that you contact the relevant specialist departments when procuring external services.

Further information: If AI services are used that are not provided by the university, data protection issues would only be answered on a case-by-case basis. Recitals include the following aspects.

The type and scope of the data transmitted varies considerably depending on the AI service and in many cases also depends on whether the basic version is used free of charge or the paid version. When registering for free use of certain services, the user's email address or even mobile phone number is usually collected, while additional information, including payment information, is requested for the paid version. In addition to the registration and login data, log files stored during the use of the service and the content of the inputs sent by the user (e.g. data, text, images) are processed. The media entered can be used by the providers for the further development of their services and for security purposes. In the terms of use of some providers, there are also distinctions with regard to data processing, depending on whether a dedicated web interface or an application programming interface (API) is used for inputs. For further information on data processing, please consult the data protection guidelines of the relevant service.

Brief assessment: According to the General Data Protection Regulation, personal data is "any information relating to an identified or identifiable natural person (...)" (Art. 4 GDPR). The disclosure of personal data of third parties and thus also their transfer to an AI service is generally not permitted without the consent of the data subjects (Art. 5 para. 1 lit. a GDPR).

Further information: The relevant definition of personal data under the General Data Protection Regulation (GDPR) can be found in detail in the answer to question 4.2. When creating prompts, all personal data of other persons must be removed from the prompts or suitably anonymised. Mere pseudonymisation is not permitted at the university, as pseudonymous data allows the data to be traced back to the person behind it and is therefore again subject to the provisions of the GDPR.

When using AI services provided by the university, it is essential to observe the respective terms of use, e.g. the terms of use for the service.

In addition, when using AI services, careful attention must be paid to compliance with German copyright law, data protection, examination law, personal rights and other requirements such as confidentiality provisions. The checklist on legally compliant use of AI services provides good guidance.

Short assessment: There is no reason why AI services should not be used to perform official tasks, provided that careful attention is paid to compliance with German copyright law, data protection law, audit law, personal rights and other requirements such as confidentiality provisions, as well as to the proper examination of each output.

Further information: Specific requirements for the use of AI services in a business context are listed, for example, in the terms of use for the service. The university also provides a checklist for the legally compliant use of AI services for easy orientation.

As soon as labour law decisions are to be made with the help of AI services, the existence of an automated decision in individual cases comes into consideration. According to Art. 22 para. 1 GDPR, a decision based solely on automated processing is inadmissible if it produces legal effects concerning the data subject or similarly significantly affects the data subject. Therefore, although decision-making may be supported by AI services, the final decision-making authority must lie with a natural person.

The ECJ has further strengthened the rights of data subjects and stipulated that automated processing may not significantly predetermine the final judgement of a natural person(Case C-634/21 ECJ). This judgement is currently understood to mean that the person making the judgement should have reached a comparable judgement even without the involvement of the AI service, meaning that the contribution of the AI only supported the judgement but did not significantly influence it. It is recommended that the process of reaching a judgement be documented in a comprehensible manner and, in particular, that the role of AI services, if any, be clearly presented.

Short evaluation: The use of the GPT service can be authorised by the company. A corresponding order can be issued by persons authorised to issue instructions.

Further information: Detailed information on the associated legal basis for data processing can be found in the privacy policy for the service. It is important to note that the competent operation of AI services requires thorough familiarisation and the development of experience in how the services work. This goes far beyond simply ensuring that employees have understood the terms of use of the service and do not, for example, enter copyrighted material or personal data of third parties. Employees must therefore be given the opportunity for training and further education in the area of the services used during their working hours. You are welcome to use the programmes provided by the university for this purpose.

Firstly, information on the authorised use of AI services can be found in the terms of use of the respective service. At the university, these include the terms of use for the service. Further questions of liability can only be clarified on a case-by-case basis.

In principle, users are required to exercise due care and diligence when using AI-generated content. With the exception of the EU Artificial Intelligence Act, there are currently no legally binding regulations. However, various players in the German science system have positioned themselves and offer guidance on how to deal with AI services in the science sector. These include publications such as

• the statement by the Executive Committee of the German Research Foundation (DFG ) on the influence of generative models for text and image creation on the sciences and the DFG's funding activities,
• the study by the Office of Technology Assessment at the German Bundestag on the fundamentals, application potential and possible effects of generative AI services,
• the study on didactic and legal perspectives on AI-supported writing in higher education from the KI:edu.nrw project.

It is strongly recommended that you take a critical look at these publications.

Information on legal issues in the area of studying and teaching can be found in the recommendations for dealing with (generative) AI in studying and teaching at the BUW.