Natural language processing (NLP) technology is actively used in digital goods and services (digital products) to build human-computer communication (Hirschberg & Manning, 2015; Truyens & Van Eecke, 2014). Voice assistants, spell-checking services, text translation and voicing, voice biometrics, and interactive voice response systems are all examples of products using this technology.

The use of language and speech in information technologies opens up new prospects in artificial intelligence development, creates opportunities for the development of innovative digital products that contribute to the digital transformation of society, such as ChatGPT and its analogs, and determines the LegalTech industry development. The high economic potential and social significance of the technology, due to the importance of language for national and cultural identity (Hobsbawn, 1996), determine the interest of society, business and government in its advancement.

In turn, despite its innovative nature and socio-economic benefits of this technology, the analysis of the current legal order indicates the existence of legal obstacles to its development.

From a technical point of view, one of the main challenges for the development of natural language processing technology is the creation and subsequent dissemination of linguistic corpora (electronic speech resources). In a broad sense, linguistic corpora can be understood as databases containing a variety of texts (books, text transcriptions, translations, etc.) and audio files (audiobooks, broadcast recordings, podcasts, other audio content), which are subsequently used in machine learning algorithms (Kelli et al., 2012; Ilin, 2019). The creation of linguistic corpora involves sequentially passing two stages: language digitization  – the collection and translation of data into a machine-readable format and their subsequent intellectual analysis (text and data mining, TDM) (Jents & Kelli, 2014; Ilin, 2019). Without massive linguistic corpora available, as well as without the stakeholders’ ability to access them, technology will not develop and work.

From a legal point of view, a linguistic corpus as it is and its individual elements may include personal or other data with a special legal regime, such as data protected by secret communication. Accordingly, the relations involving the creation and dissemination of linguistic corpora will be simultaneously influenced by the legislation on personal data protection and by special sectoral legislation.

The article objective is to conceptualize, from the viewpoint of personal data protection legislation, the development of natural language processing technology, to identify possible legal obstacles to such development, and to propose directions for further elaboration of the problem. The research result complements the academic discussion on the legal regulation of personal data processing by artificial intelligence systems (Sviridova, 2021; Konev, 2020; Egorova et al., 2021) by analyzing the problem in the context of this technology functioning. It can be used in practice to identify and assess the legal risks arising from the personal data processing by developers of digital products based on natural language processing technology.

As was outlined above, a key process for the development of natural language processing technology will be the creation of linguistic corpora and their dissemination among stakeholders. Elements of a linguistic corpus can be qualified as personal data. The modern approach to the definition of the “personal data” concept, based on para. 1, Art. 3 of the Federal Law “On Personal Data”1, provides for a broad interpretation of the term and for qualifying as personal data virtually any data that directly or indirectly allow identifying a natural person. This leads to the inevitable emergence of personal data as part of a linguistic corpus.

Personal data require a special regime of legal and technical protection. In a general sense, the special legal regime of personal data, on the one hand, is aimed at ensuring the protection of rights belonging to the data subject; on the other hand, it imposes a number of restrictions on the use of such data in the creation of a linguistic corpus (Ilin, 2020). In this regard, the task of distinguishing the personal data used from other types of data will be fundamental for the creation of a linguistic corpus. In practice, this is not always possible: the boundary between personal and other data is not always clear.

First of all, there is a problem in defining the very concept of “data”. Paragraph 1 of Art. 3 of the Federal Law “On Personal Data”2 defines data as “any information...”. In turn, Art. 2 of the Federal Law “On Information, Information Technologies and Information Protection”3 defines information as “data (messages, data)...”. In other words, from the correlation of these definitions we may conclude that data is data, i.e. the concept is defined through itself. This may create difficulties when trying to determine the form in which personal data can be expressed and, consequently, to qualify a piece of information as personal data.

Second, one of the most problematic aspects in qualifying data as personal data is that the current legislation relies on a binary approach in defining the concept of personal data. According to this approach, data can be either personal or not. In the author’s opinion, the binary approach to the definition of personal data does not sufficiently take into account the current state of digitalization of society, the level of technological development, and the socio-economic changes that have occurred over the past few years. For example, such a definition does not take into account that data science and computer science distinguish different levels of possible identifiability and attribute a certain set of risks to each level (Kolain et al., 2022). In addition, it does not take into account the fact that data may be identifiable for one subject, for example, in combination with other datasets, but not for others (Oostveen, 2016).

Third, the status of data during processing can also be dynamical and not static (Purtova, 2018). In other words, during processing, data can become personalized or, conversely, lose this status. For example, during creating a linguistic corpus and a language model based on it, the personal data used may lose identity markers and thus lose the status of personal (Kelli et al., 2021). This means that, in a practical sense, data can only be qualified as personal data at a certain point in time or stage of processing, which can make it difficult to respect the legality of the entire processing.

The dynamic nature of data is of fundamental importance to and affects, firstly, distinguishing personal data from other types of data (for example, there are fewer requirements for the processing of non-personal data); secondly, it influences the choice of the processed personal data category.

Legislation in the sphere of personal data protection identifies four main categories of personal data: “general”, “biometric”, “special” or “sensitive”, and “personal data authorized for dissemination”. Biometric data refer to the biological and physiological characteristics of an individual that can be used for identification4. The special or sensitive category of data is the data that indicate “political opinions, racial or ethnic origin, philosophical or religious views, health status, or sexual orientation”5. Personal data authorized for dissemination are the data that, with the subject’s consent, may be disseminated and made available to an unlimited number of persons6. This categorization of personal data is an initial prerequisite for data processing. For example, biometric data can be processed only after obtaining the explicit consent of the data subject. Processing of the special category of personal data is, as a general rule, prohibited. Different categories of data have different requirements to ensure the level of protection, both technical and legal (Krivogin, 2017). Hence, qualifying data as personal data poses the task of not only distinguishing personal data from other types of data, but also determining the belonging of personal data to a certain category.

In the context of creating a linguistic corpus, the use of speech data  – human voice samples  – illustrates the complexity of the task described above. Natural language processing technology relies heavily on the processing of said data. For example, they are used in voice assistants, text transcription systems, real-time translation of conversations, etc. The possibility of categorizing voice as personal data and choosing the appropriate category may cause a number of difficulties in practice.

The proposed broad approach to the definition of personal data allows assuming that voice contains enough personal identifiers to be classified as personal data. This approach can also be found in the practice of the European Court of Human Rights (ECHR)7, whose jurisdiction until recently extended to Russia. At the same time, the current Russian legislation, as well as the existing judicial practice, does not provide an unambiguous answer as to whether voice shall always be categorized as personal data. In practice, one may find cases when a recorded voice is not qualified as personal data (Arkhipov & Naumov, 2016). Indeed, it can be assumed that the voice will not always qualify as personal data, for example, due to distortion, brevity of the sample, or lack of associated identifiers.

At the same time, it seems that the probability of qualifying the voice as personal data is quite high, which raises the question of its categorization. Of particular interest is the division between the general category and the categories providing for a higher level of protection. From the viewpoint of the latter, voice can be considered as biometric or health data. For example, voice can be used as a biomarker to detect an early stage of Parkinson’s disease (Tracy et al., 2020) or to provide information about an individual’s mental state, stress level, emotional state, sleep deprivation, and other health-related data (Chang et al., 2011). Voice as a unique characteristic of an individual (biometric data) is often used to establish a person’s identity (voice biometrics) (Jain et al., 2004). Voice may also contain personal data that fall under a general category. For example, such data may appear in speech content or sample-related metadata (age, gender, etc.).

The relevant clarifications of Roskomnadzor8, now repealed9, recommended that biometric data could be distinguished from other categories of data based on the purpose of processing. If the purpose of processing is related to personal identification, such data are to be qualified and processed as biometric data, otherwise they are not. This approach seems logical; otherwise, for example, the broadcasting of any TV or radio program would mean biometric data processing and would require compliance with the relevant legal regime. It is reasonable to assume that the same approach could be applied to health data. Obviously, in most cases, health data are not required to create a linguistic corpus and operate the natural language processing technology; therefore, as long as such data are not extracted, voice processing would not require a special legal regime.

However, it should be noted that, regardless of the purpose for which the voice is processed, it still contains biometric and health data; therefore, there is always a risk that this data could be extracted from the voice. This raises a general and more conceptual question: is the presence of such a risk sufficient to place personal data in categories with a higher level of protection, such as the “special” or “biometric” category? As far as the author is aware, there is no judicial practice on this issue in Russia. If we turn to other jurisdictions, we can find a similar case in the practice of the Court of Justice of the European Union10. In the case in question, the court used a broad approach to the interpretation of the “special” data category and included data that do not directly belong to it, but could potentially be extracted. In our opinion, this approach is at least debatable. Firstly, it is not quite clear how to determine that the data used contain hidden data, which in case of extraction may change its qualification. Their presence is not always obvious. Secondly, categorizing data as “special” means that they cannot be processed, except in specific cases listed in Art. 10 of the Law on personal data or Art. 9 of the General Data Protection Regulation11. In such a situation, it is difficult to ensure that data processing complies with legal requirements; this, in turn, may make it impossible to use the data to the extent necessary and, consequently, to achieve the purposes for which the data were processed.

In addition, it is important that the risk level of potentially extracting additional information that could change the data qualification varies depending on the particular case of processing. For example, speech data in a linguistic corpus are not publicly available, and the range of persons who can access and use it to extract additional information is limited. Moreover, this requires specialized knowledge and technical means. In other words, the ordinary processing of data within a linguistic corpus has a low risk of extracting “special” or “biometric” data from the voice. Hence, it seems that, on the one hand, the broad definition of data categories increases the level of protection of the data subject rights; on the other hand, it largely limits the possibilities to use them for technological development. In this situation, in order to balance the interests of the data subject and those who process data, it is important not only to identify the risk of potential information extraction but also to technically and legally assess that risk.

The use of personal data to create a linguistic corpus and develop natural language processing technology necessitates their processing in strict compliance with the law. The Russian legislation broadly interprets the concept of personal data processing12, so there is little doubt that actions performed with data while using them as part of natural language processing technology will qualify as personal data processing (Ilin & Kelli, 2020). In turn, this poses the question of the limit to which data processing must comply with legal requirements. For example, if a language model was created using personal data, does this mean that further use of products created using this model is also subject to the personal data protection law?

The limits in ensuring the lawfulness of personal data processing as part of natural language processing technology can be defined through the material, temporal and territorial effects of the legal regulation in this field (Ilin, 2020).

In the context of natural language processing technology, the material effect can be defined through the various levels of personal data use in developing the relevant digital products. These levels include gathering material to create a dataset, compiling the dataset, annotating, creating a language model, and developing the final digital product (Kelli et al., 2021). For example, a language model consists of linguistic rules and it is currently almost impossible to extract any personal data from it, as the identifiability of data subjects is lost in the process of language model creation. Therefore, the treatment of the data used to create the model will generally not correspond to the legal treatment of the language model built on that data (Kelli et al., 2021).

The time limits for ensuring the lawfulness of data processing can be defined through the period during which the data subject’s right to their data protection is in force. However, the Russian legislation does not set a time limit for the validity of such a right, indicating the need to comply with personal data regulation, including in relation to the data of deceased persons13, and without any indication of time limits. One may agree with the opinion of some researchers that this gap should be bridged, for which it would be advisable to set the term of personal data protection equal to that of a person’s privacy protection (Vazhorova, 2012).

The limits of ensuring the lawfulness of data processing in terms of territorial validity will be determined taking into account the national jurisdictions in which the relevant digital products are created or distributed. The problem is that digital products built using natural language processing technology usually do not focus on one country, but seek to cover markets in different countries. For example, Alice the voice assistant by Yandex supports the Turkish language; the speech-to-text system by Google supports over 120 languages and can be integrated with other digital products. Therefore, the question arises about the need to comply not only with national legislation on personal data protection, but also with the relevant regulation of other countries  – for example, Turkish law  – to collect data and form a linguistic corpus in Turkish.

Russian legislation in the field of personal data protection as a general rule has no extraterritorial effect. Consequently, it does not apply to non-residents processing personal data of Russian citizens abroad. This rule has two exceptions. The first relates to the requirement of data localization, and the second relates to cases of state security.

The rule of localization of processing of the personal data of Russian citizens obliges data processors to store, collect and use personal data of Russian citizens only in databases located in the territory of the Russian Federation. This rule applies: if the information being processed contains personal data; if these data were collected (i.e., received from third parties) and processed; and if these data are related to Russian citizens (Savelyev, 2016). The latter condition raises the problem of determining citizenship within the framework of the use of information technologies.

This problem was partially resolved after Roskomnadzor provided clarifications according to which citizenship should be understood as the territory where processing takes place; if there are doubts about the data subject’s citizenship, all information processed and collected in Russia should be localized in databases located in Russia. At the same time, the issue of identification and processing of personal data of Russian citizens that are collected outside the Russian jurisdiction is still open (Ilin, 2020).

An example of cases where state security measures have an extraterritorial effect on personal data protection legislation is the requirement for organizers of information dissemination and providers of telecommunication services to store Internet traffic (voice and text messages, photos, videos, sounds, file metadata), as well as to provide encryption keys to decrypt Internet traffic if the required data are stored or processed in encrypted form14. It is important that this requirement is not limited to any territory. It should be noted, however, that compliance with these rules may be difficult for companies, as they will be forced to violate their national data protection regulation. For example, some provisions of the General Regulation on personal data protection15, which regulates legal relations in the field of personal data protection in the EU, contradict the above requirement (Ilin, 2020).

In today’s digital economy, products using natural language processing technology are widely marketed under a business model that does not involve a monetary reward from the product user. Instead, the vendor benefits from the use of data that have either been intentionally provided by the user or automatically collected or created by the vendor. The application of this business model and the payment for goods and services with data has opened a debate about the extent to which data per se can be a means of payment. First and foremost, doubts arise regarding the economic and legal characteristics of data. While one of the main concerns about the economic characteristics of data is the problem of measuring their economic potential and value, which cannot be determined either by the market or by contract (Lohsse et al., 2020), the legal discussion arises around the definition of the personal data legal regime, the relationship governing the legal rules, and the content of legal relations in this area (Helberger et al., 2017; Metzger, 2017; Svantesson, 2018).

The use of natural language processing products involves an intensive data exchange between the user and the provider (Goldberg, 2017). The data can be intentionally transmitted by the user to the provider (e.g., by voice command), collected by the provider (e.g., recording a voice sample, location data), or created by the service (e.g., the result of a text translation). In most cases, the provider uses the collected data not only to provide the user with a digital product, but also to further develop and improve it, as well as for commercial purposes not directly related to the marketed product. For example, a supplier can use the user’s voice to analyze the emotional reaction to the advertising content and use the analysis result to sell other goods and services (Sartor, 2020). The possibility of such use of data raises the question of its qualification, the applicable legal regime, and the possibility of defining data as an object of property right (Talapina, 2020). In addition, the use of personal data as a consideration raises the question of the legal concept of personal data as one of the fundamental human rights  – the right to respect for private and family life. It seems that the current legislation in the field of personal data protection does not in itself prohibit such use of data, but imposes a number of limitations, in a general sense related to the need to ensure the legality of such processing (Saveliev, 2021).

At the same time, the use of data as a consideration raises another issue concerning the recoverability of civil law contracts used for the practical application of the business model in question and, consequently, the possibility of extending the law on consumer protection to such relations. On the one hand, para. 1 Art. 423 of the Civil Code of the Russian Federation16 explicitly stipulates, as one of the characteristics of recoverability, the execution of “another consideration” for fulfillment of contractual obligations, while providing the user with additional guarantees and legal mechanisms for the consumer rights protection balances the user’s relations with the supplier, in relation to whom the user has a weaker position.

On the other hand, the use of data as a new means of payment may cause problems in law enforcement practice. For example, in order to apply consumer protection measures that directly depend on the product or service value, it is necessary to determine the monetary equivalent of the transferred data, which, given the economic and legal nature of data, seems difficult to implement.

The article objective was to conceptualize, from the viewpoint of personal data protection legislation, the development of natural language processing technology. The analysis of the existing legal framework has shown that it does not fully correspond to the technical features of the technology development, which may lead either to over-regulation or, on the contrary, to the neglect of critical areas requiring protection. In particular, problems arise in qualifying the data, involved in the technology development, as personal data and in their subsequent categorization. This problem is well illustrated by the example of the use of speech data  – samples of a person’s voice. An attempt to define the limits of ensuring the legality of data processing also causes difficulties and requires further clarification both in terms of substantive, temporal and territorial validity of legal regulation in this area. Another issue that needs further research is the possibility of using personal data as a consideration. This problem appears relevant not only for the development of natural language processing technology, but also for the development of the information and communication technology industry in general.

Further research may be aimed at analyzing and developing solutions that will contribute, on the one hand, to overcoming the revealed legal obstacles to the technology development, and, on the other hand, to improving the legal protection of critical areas that require additional protection.

1. On Personal Data. No. 152-FZ of 27.07.2006 (ed. of 06.02.2023). SPS KonsultantPlyus. https://clck.ru/gLnFq 2. Ibid. 3. On information, information technologies and information protection. No. 149-FZ of 27.07.2006. SPS KonsultantPlyus. https://clck.ru/3967pC 4. On Personal Data. No. 152-FZ of 27.07.2006 (ed. of 06.02.2023). Art. 11. SPS KonsultantPlyus. https://clck.ru/gLnFq 5. Idid. Art. 10. 6. Idid. Art. 10.1. 7. Case of S. and Marper v. the United Kingdom (App. No 30562/04, 30566/04). 04.12.2008. ECtHR. §84. https://clck.ru/3968V5 8. Roskomnadzor. (2013, 2 September). Clarifications on referring photo- and video-images, dactyloscopic data and other information to biometric personal data and features of their processing. https://clck.ru/3968ky 9. Letter of Roskomnadzor of 19.11.2021 No. 09–78548 “On irrelevance of clarifications by Roskomnadzor”. SPS KonsultantPlyus. https://clck.ru/3968n6 10. Case C-184/20 OT v Vyriausioji tarnybinės etikos komisija. EU:C:2022:601. https://clck.ru/3969Ee 11. Article 10 of Federal Law “On Personal Data”, Art. 9 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2016, April 27). https://clck.ru/3969GL 12. On Personal Data. No. 152-FZ of 27.07.2006 (ed. of 06.02.2023). Para. 3 Art. 3. SPS KonsultantPlyus. https://clck.ru/gLnFq 13. Ibid. Para. 7 Art. 9. 14. On amendments to the Federal Law “On Combating Terrorism” and certain legislative acts of the Russian Federation with regard to the introduction of additional measures to combat terrorism and ensure public security. No. 374-FZ of 06.07.2016. (2016). SPS KonsultantPlyus. https://clck.ru/3969WT; On amendments to the Criminal Code of the Russian Federation and the Criminal-Procedural Code of the Russian Federation with regard to the establishment of additional measures to counter terrorism and ensure public security. No. 375-FZ of 06.07.2016. (2016). SPS KonsultantPlyus. https://clck.ru/3969aF 15. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2016 April 27). https://clck.ru/3969dk 16. Civil Code of the Russian Federation (part 1) of 30.11.1994 No. 51-FZ, ed. of 24.07.2023. SPS KonsultantPlyus. https://clck.ru/3969nv