De-Anonymization Of Personal Data In The Process Of Using Ai Models. Issues Of Responsibility In The Ai Value Chain

This article examines the issues and risks related to the de-anonymization of personal data and the responsibility across the value chain in the development and deployment of artificial intelligence (AI) systems. Four hypotheses of potential de-anonymization of personal data during the use of AI systems are explored:(1) when the goal and intended purpose of the AI system are preserved;(2) when the goal and intended purpose of the AI system are changed;(3) when the system’s goal and purpose are preserved, but the processing purpose changes;(4) when the goal of the system and data processing remains the same, but de-anonymization occurs due to technical or behavioral evolution of the system .Each hypothesis is analyzed through the lens of the requirements of the General Data Protection Regulation (GDPR, EU 2016), the Artificial Intelligence Act (EU 2024), and Opinion 28/2024 (EDPB, 2024). Based on the analysis of four regulatory and technical scenarios related to the purpose, intended use, and behavior of AI systems, the article discusses technological vulnerabilities such as behavioral identification, automated self-learning, and correlation with external sources. The goal is to clarify the conditions under which de-anonymization can occur despite formal compliance, and to specify the responsibility of actors in the supplier–implementer chain, including in cases of autonomous adaptation of AI models.