As data becomes the backbone of innovation and operational efficiency across industries, the demand for high-quality data for machine learning and analytics has escalated significantly. Synthetic data has emerged as a contemporary solution to mitigate the limitations posed by real-world data, particularly regarding availability, privacy, and bias. However, as with any rapidly advancing technology, the legal landscape surrounding its commercial use remains complex and evolving. The use of artificially generated data sets, especially in sectors such as healthcare, finance, and autonomous systems, introduces a range of legal considerations that must be rigorously examined.
What Constitutes Synthetic Data?
Synthetic data refers to information that’s artificially generated rather than collected from real-world events. It exhibits the same structures and statistical properties as real data but doesn’t directly map to any actual events or individuals. Generated through algorithms such as Generative Adversarial Networks (GANs), variational autoencoders, or agent-based simulations, synthetic data is increasingly being used for purposes like model training, software testing, and product development.
Proponents laud synthetic data for its ability to preserve privacy, scale efficiently, and reduce dependency on sensitive or hard-to-collect data sources. Yet, while the technical definitions of synthetic data are relatively consistent, the legal interpretations surrounding its creation, distribution, and use are beset with ambiguity.
Data Protection and Privacy Regulations
One of the key arguments in favour of synthetic data is that it purportedly circumvents traditional data privacy laws because it does not represent actual individuals. Nonetheless, this assumption is not bulletproof under existing data protection frameworks, particularly the General Data Protection Regulation (GDPR) in the EU and the UK GDPR post-Brexit.
GDPR defines personal data as any information relating to an identified or identifiable natural person. This broad definition prompts a crucial legal question: Can synthetic data ever be considered personal data?
If synthetic data is derived from real personal data, even if the final datasets are not directly traceable to a particular individual, they may still be subject to data protection regulations. For example, if the conversion from real data to synthetic form fails to entirely purge identifiable elements, or if re-identification is possible through auxiliary datasets, then regulatory compliance could be compromised.
Furthermore, data minimisation and purpose limitation principles under GDPR demand that only necessary data is processed and for specific purposes. Organisations using synthetic data must demonstrate that its generation aligns with these principles, particularly when the input real-world dataset contains personal information.
Consent and Fair Processing Obligations
Another intertwined legal concern involves obtaining valid consent and adhering to fair processing standards. When synthetic data is generated from real data, the legality of using that real data as a foundation hinges on how it was originally collected.
Were data subjects informed that their personal data might be used to create synthetic versions? Did they provide informed consent for such processing? If synthetic datasets are built from personal data collected without proper disclosures, their use could be seen as contravening data subject rights, regardless of the synthetic layer.
Beyond consent, the concept of “fairness” under GDPR is often less quantifiable but equally critical. Even if consent has been obtained, the downstream applications of synthetic data must be transparent, just, and consistent with individuals’ reasonable expectations. For example, commercial use of synthetic healthcare data for pharmaceutical marketing may be legally precarious if patients were not made aware of such potential uses.
Intellectual Property Rights
Intellectual property (IP) is another intricate area influenced by synthetic data. Questions arise around both the protection of synthetic data and the potential for IP infringement during its generation or application.
Firstly, who owns synthetic data? Since it’s generated by algorithms, its ownership could rest with the algorithm’s developer, the organisation that provided the training data, or the entity deploying the model. These questions become even murkier in multi-party collaborations where different stakeholders contribute to the synthetic data’s lifecycle.
Secondly, depending on how synthetic data is generated, it may embed characteristics of copyrighted or proprietary input data. For instance, suppose synthetic financial data is trained on proprietary datasets from a competitor, resulting in outputs with sufficiently similar patterns. In that case, accusations of IP misappropriation could ensue, even if the synthetic data is technically new.
Also noteworthy is whether synthetic datasets themselves can be protected under IP law. In the UK, databases may be protected under database rights, and datasets showing originality may attract copyright protection. Whether synthetic data qualifies depends on factors such as the originality of its structure or the creative choices in its generation. However, software-generated data without human creativity may not meet the originality threshold, limiting IP protection and complicating commercial leverage.
Liability and Accountability
As synthetic data increasingly populates models that drive critical decisions—medical diagnoses, credit scoring, or autonomous vehicle navigation—the issue of liability becomes paramount. When a machine learning model trained on synthetic data malfunctions or produces discriminatory outcomes, accountability is a legal grey zone.
If a synthetic dataset inadvertently introduces or reinforces biases, who is liable—the developer of the algorithm, the provider of the real-world seed data, or the company using the synthetic dataset? The diffuse, collaborative nature of synthetic data generation makes attributing responsibility for negative outcomes exceptionally challenging.
Moreover, tort law principles, generally premised on notions of duty of care, foreseeability, and proximate cause, are often difficult to apply to AI-laden environments grounded in synthetic data. Existing frameworks may struggle to adequately allocate accountability without legislative intervention or regulatory guidelines tailored to this new paradigm.
Cross-Border Data Transfer Issues
Multinational firms using synthetic data must also account for laws governing cross-border data flows. One assumption is that synthetic data can provide a workaround to data localisation laws, as it purportedly doesn’t contain personal information. Yet, regulators may regard synthetic data derived from citizens’ data as still subject to localisation or cross-border transfer rules.
For example, under the UK and EU’s GDPR, transferring personal data to a non-adequate third country requires additional safeguards like Standard Contractual Clauses (SCCs) or Binding Corporate Rules. If synthetic data is derived from such personal data, organisations need to assess whether these mechanisms are still required.
India’s Digital Personal Data Protection Act (DPDPA), China’s Personal Information Protection Law (PIPL), and Brazil’s LGPD also raise similar implications. Institutions must conduct transfer impact assessments considering both the risks and the ambiguous status of synthetic data under various national regimes.
Anti-discrimination and Fairness Laws
Beyond data protection and IP law, the use of synthetic data intersects with anti-discrimination legislation. Particularly in the UK, the Equality Act 2010 prohibits unjustified adverse treatment based on characteristics like race, gender, age, or disability.
If synthetic data inadvertently encodes historical biases present in the original dataset, and these biases influence algorithmic decision-making, legal implications can follow. Courts have not yet robustly adjudicated on the legality of using synthetic datasets that result in discriminatory automated decisions, but the risk remains high, especially in sensitive applications like recruitment, lending, and policing.
Preventive audits, fairness assessments, and diverse sourcing input data represent strategies to mitigate these risks. Nevertheless, as synthetic data tools become more autonomous and complex, the legal burden on organisations to ensure non-discrimination may increase, reinforcing the need for rigorous governance.
Regulatory Uncertainty and the Role of Standards
At present, no comprehensive statutory framework exists in the UK or globally to explicitly govern synthetic data. This lack of specificity creates considerable legal uncertainty. Without defined rules, organisations must operate within the bounds of broader, often ambiguous laws relating to data, human rights, and competition.
In the absence of legislation, soft law instruments like standards and codes of conduct become essential. The International Organization for Standardization (ISO) and the Institute of Electrical and Electronics Engineers (IEEE) are actively developing frameworks to guide ethical synthetic data generation. Similarly, the UK’s Information Commissioner’s Office (ICO) has issued guidance on anonymisation and data minimisation that tangentially applies.
Adhering to these voluntary standards may not provide immunity from legal challenges, but they can demonstrate procedural diligence and good faith, which could mitigate penalties or assist in regulatory investigations.
Contractual Implications
Contractual law also takes centre stage in defining rights, responsibilities, and limitations related to synthetic data. Clear clauses must outline what constitutes acceptable use, data retention policies, audit rights, and liability arrangements among parties involved in data processing.
Commercial agreements involving synthetic data should also include representations and warranties concerning compliance with applicable laws (including data protection, IP, and employment law), especially when third parties are involved. Additionally, indemnification clauses play a critical role in allocating risks associated with data breaches, civil claims, or regulatory infractions.
Open-source synthetic data generators present their own unique contractual challenges, as licences may impose obligations or restrictions on use, distribution, or modification. Organisations should thus perform thorough due diligence when incorporating such tools into commercial workflows.
Sector-Specific Legal Considerations
Different industries face unique legal implications in deploying synthetic data. Healthcare, for example, operates within a framework of stringent controls, including the UK’s Data Protection Act 2018, the Health and Social Care Act 2012, and accompanying regulatory guidance from the NHS and the Health Research Authority.
In financial services, synthetic data used in algorithms for underwriting or fraud detection could fall under scrutiny by the Financial Conduct Authority (FCA), which mandates fairness, transparency, and appropriateness in automated decision-making.
In the automotive sector, synthetic data to train self-driving vehicles could raise questions under product liability laws, particularly the Consumer Protection Act 1987 in the UK. If a model trained largely on synthetic traffic data contributes to an accident, courts may need to interrogate the quality and provenance of the training data.
Strategic Legal Recommendations for Organisations
Mitigating legal risks associated with synthetic data requires a holistic and proactive strategy. Firstly, implementing a robust data governance framework is essential. This includes ensuring transparency over the origin, processing methodology, and intended use of synthetic data.
Impact assessments that include both data protection and ethical dimensions should be conducted, especially when real-world data informs the synthetic generation process. Organisations must monitor re-identification risks using technical benchmarks such as privacy risk scores or statistical fidelity thresholds.
Legal teams should be integrally involved in procuring synthetic data tools, crafting contracts, and ensuring that the deployment of synthetic datasets aligns with broader corporate compliance goals. Establishing cross-functional governance bodies involving legal, technical, and business stakeholders ensures cohesive oversight.
The Future Legal Landscape
As synthetic data becomes entwined with critical innovations, regulators are likely to become more active. Future legislation could impose formal requirements for provenance tracking, bias testing, and individual rights in relation to synthetic representations.
Considering the trajectory of AI regulation, such as the EU AI Act, synthetic data is expected to be directly addressed within risk-based regulatory tiers. High-risk AI systems may be mandated to document and justify the data sources used for training, including synthetic components.
Judicial precedents around data rights, discrimination, and liability are gradually beginning to influence how synthetic data is treated in courts. The coming years will likely see legal doctrine catch up with technological sophistication, setting clearer boundaries and protections.
Conclusion
Synthetic data holds exceptional promise for innovation, but its commercial use must navigate a labyrinth of legal issues. From privacy law to intellectual property, discrimination, and liability, the implications are manifold and interlinked. Organisations embracing synthetic data must do so with a deep understanding of both the current legal landscape and its likely evolution. Thoughtful legal integration, combined with ethical foresight and technical diligence, will be key to harnessing the full potential of synthetic data in a lawful and responsible manner.