arbiter
JournalsAccount

Processing of synthetic data in AI development for healthcare and the definition of personal data in EU law

Vibeke Binz Vallevik et al.

International Journal of Law and Information Technology2026https://doi.org/10.1093/ijlit/eaag002article
ABDC A
Weight
0.50

Abstract

Artificial intelligence (AI) has the potential to transform healthcare, but this requires access to health data. Synthetic data generated through training machine learning models on real data offers a way to balance innovation and privacy protection. However, uncertainties in the practical classification of synthetic health data under the General Data Protection Regulation (GDPR) currently limits the possible benefits of synthetic data. Through a systematic analysis of relevant legal sources and an empirical study, this article explores whether synthetic data should be classified as personal data under the GDPR. The study investigates the residual identification risk through generating synthetic data and simulating inference attacks, challenging common perceptions of technical identification risk. The risk of identification depends on several factors. The findings suggest synthetic data are often likely anonymous since results of an attack cannot easily be verified. The legal analysis highlights uncertainties about what constitutes a ‘reasonably likely’ risk and a need to further investigate a threshold for accepted risk. To promote innovation, the study calls for clearer regulations to balance privacy protection with the advancement of AI in healthcare.

Open via your library →

Cite this paper

https://doi.org/https://doi.org/10.1093/ijlit/eaag002

Or copy a formatted citation

@article{vibeke2026,
  title        = {{Processing of synthetic data in AI development for healthcare and the definition of personal data in EU law}},
  author       = {Vibeke Binz Vallevik et al.},
  journal      = {International Journal of Law and Information Technology},
  year         = {2026},
  doi          = {https://doi.org/https://doi.org/10.1093/ijlit/eaag002},
}

Paste directly into BibTeX, Zotero, or your reference manager.

Flag this paper

Processing of synthetic data in AI development for healthcare and the definition of personal data in EU law

Flags are reviewed by the Arbiter methodology team within 5 business days.

Evidence weight

0.50

Balanced mode · F 0.40 / M 0.15 / V 0.05 / R 0.40

F · citation impact0.50 × 0.4 = 0.20
M · momentum0.50 × 0.15 = 0.07
V · venue signal0.50 × 0.05 = 0.03
R · text relevance †0.50 × 0.4 = 0.20

† Text relevance is estimated at 0.50 on the detail page — for your query’s actual relevance score, open this paper from a search result.