1. Home
  2. News
  3. Lote Notes July 2024
  4. Data Privacy and AI
 

Data Privacy and AI

Introduction

The advent of Generative AI (GenAI) has introduced immensely powerful tools capable of ingesting vast amounts of data, learning, and performing tasks such as generating text, writing code, or creating images and videos. These large language models are trained on extensive datasets available on the internet, including video, text, audio, and images, often with little regard to copyright, ownership, or privacy. As GenAI technologies are widely deployed through multi-modal apps on smartphones, tablets, and computers, training datasets extend to user input or accessible data, sometimes without explicit user consent. This creates significant risks for companies and consumers embracing this technology. Understanding the risks regarding data protection and privacy is critically important. Additionally, questions around ownership, copyright, and ethical use of information, as well as child protection, must be addressed. As this technology accelerates beyond the reach of regulation, it is crucial to pause and consider the ramifications to ensure privacy and data protection are cornerstone principles in this emerging technology.

Data Collection by AI

AI can collect data through various means, depending on the platform used. Common data collection methods include:

  • Biometrics: Gathering facial recognition or fingerprint data.
  • Real-time Data: Capturing information from public places or homes.
  • Social Media: Collecting data uploaded by users.

Privacy Issues Associated with AI

AI's rapid development poses various risks to organisations and their data, leading to unauthorised access and misuse. Generative AI, in particular, poses significant risks, including potential data breaches and unintended disclosures. Specific concerns include:

  • Transparency: AI algorithms lack transparency, making it unclear what information is being collected, leading to a lack of trust between businesses and customers.
  • Consent: AI platforms can collect personal data without user consent, posing significant privacy threats.
  • Reputation: Unauthorised use of personal data can damage a business's reputation.
  • Biometrics: AI can invade user privacy by stealing biometric data like facial recognition.
  • Data Accuracy: AI relies on algorithms that may have bugs, leading to inaccurate data.
  • Data Security: AI data collection can lead to breaches.
  • Predictive Analytics: AI can track and predict user actions based on past behaviours.
  • Decision-Making: AI can use user data in ways that harm reputations without consent.
  • Copyright Issues: AI often uses large datasets that may include unauthorised copyrighted material.

AI and Privacy Regulation

While regulation is always catching up to technology, important regulatory instruments worldwide guide AI use and address data privacy concerns. These regulations aim to protect individuals' personal data and ensure AI technologies are developed and used responsibly. The General Data Protection Regulation (GDPR) is the gold standard in privacy protection. Another regulation of note is the California Consumer Privacy Act (CCPA), which is crucial given California's role as the home base of many big software service providers. Although still in its nascent form, the AI Intelligence Act is the leading legislative instrument available today. In Australia, the Privacy Act 1988 (Cth) governs the handling of personal information by organisations and is more relevant than ever in an AI era. Frameworks for the ethical use of AI technology, such as Australia’s AI Ethics Principles by the Department of Industry, Science and Resources, have been proposed.

General Data Protection Regulation (GDPR) - European Union

The GDPR is one of the most comprehensive data protection regulations globally, applying to any organisation that processes the personal data of EU residents, regardless of where the organisation is based. Key provisions related to AI and privacy include:

  • Data Minimisation: Only the necessary data should be collected and processed.
  • Consent: Individuals must give explicit consent for their data to be processed.
  • Transparency: Organisations must be clear about how data is used.
  • Right to Access and Erasure: Individuals have the right to access their data and request its deletion.
  • Data Protection Impact Assessments (DPIAs): Required for processing operations likely to result in elevated risk to the rights and freedoms of individuals, including the use of AI.

California Consumer Privacy Act (CCPA) - United States

The CCPA gives California residents more control over their personal information held by businesses. Key provisions include:

  • Right to Know: Consumers have the right to know what personal data is being collected and how it is used.
  • Right to Delete: Consumers can request the deletion of their personal data.
  • Right to Opt-Out: Consumers can opt-out of the sale of their personal data.
  • Non-Discrimination: Consumers must not be discriminated against for exercising their privacy rights.

Artificial Intelligence Act - European Union

The AI Act, proposed by the European Commission, aims to regulate AI systems to ensure they are safe and respect fundamental rights. Key aspects include:

  • Risk-Based Approach: AI systems are categorised into unacceptable risk, high risk, and limited risk, with corresponding regulatory requirements.
  • High-Risk AI Systems: Subject to strict requirements, including risk management, data governance, and transparency.
  • Transparency: Users must be informed when they are interacting with an AI system.

Privacy, Data Protection, and AI – The Australian Legislative and Regulatory Landscape

Privacy Act 1988 (Cth)

The Privacy Act 1988 (Cth) is a key piece of legislation in Australia that governs the handling of personal information by organisations. It aims to protect individuals' privacy by ensuring their personal information is managed appropriately. The Act includes the Australian Privacy Principles (APPs), which outline how organisations must handle personal information, covering transparency, data quality, security, and access. The Office of the Australian Information Commissioner (OAIC) oversees the implementation and enforcement of the Privacy Act, handling complaints and investigations.

Framework for AI

Australia’s AI Ethics Principles, is a voluntary framework for the ethical use of Artificial Intelligence developed by the Department of Industry, Science and Resources. These principles aim to promote responsible innovation and trust in AI systems while safeguarding the rights and well-being of individuals and society.

Regulations needed to keep pace with technology

Enforceable regulations around AI technologies and the data they collect are essential for protecting user privacy. Sensitive data from businesses should be encrypted to add an extra layer of protection, safeguarding against data loss in potential breaches. Consumers should be vigilant and take necessary steps to protect their data and personal information. Compliance with privacy regulations is key to ensuring that privacy is not breached. Employees should be trained on their responsibilities when using AI, being aware of the risks associated with mishandling data, and ensuring cautious AI usage.

Reducing the risks of AI and Data Privacy

To reduce privacy risks, developing custom private AI systems can help businesses maintain control over their data and reduce breaches. Organisations should ethically source information and verify data collected by AI to prevent copyright issues. Compliance with privacy regulations is key to ensuring data protection.

Conclusion

As AI rapidly evolves, it poses various challenges for organisations, including unauthorised data access and misuse. The diverse ways in which AI collects data, from biometrics to social media uploads, amplify these risks. Businesses face additional concerns due to AI's lack of transparency, which can reduce trust with customers and lead to unauthorised data collection without consent. The invasion of user privacy, inaccuracies in data, security breaches, and copyright issues further complicate the landscape. To mitigate these risks, enforceable regulations and ethical practices around AI technologies and data collection are essential. Encryption of sensitive data and vigilant consumer practices can provide additional layers of protection. Training employees on responsible AI usage and shifting the focus from mere data collection to ethical practices are crucial steps.

References