The intersection of Artificial Intelligence (AI) and privacy law is a topic that has rocketed to the top of search engine queries, graced major media news sites and social media alike, and has come under scrutiny lately from the public and the courts.
While there’s no doubt about AI’s usefulness and potential, entities must take the necessary steps to understand and comply with privacy laws from the beginning of their AI journeys to avoid eventual litigation and negative public opinions.
Before we can determine how to strike a balance between privacy compliance and responsible use of AI, we have to understand liability exposure for individual privacy and security requirements in general, as well as AI’s use and impact on entities’ growth and improvement.
U.S. state and federal (sector-specific) law dictates several types of rules and guidelines establishing companies’ responsibility to maintain their customers’ and users’ privacy in personal information handled by the company.
Privacy law refers to a legal framework that governs the collection, use and disclosure of personal information.
Privacy laws vary by country and region, but the laws generally spell out how companies must handle personal data, notify users about their rights, what they can and cannot do with it, and how they must safeguard it against unauthorized access or misuse.
The Federal Trade Commission (FTC) is the main body that enforces and takes action against privacy and data security law violators. Even though these laws and guidelines often change alongside fast-paced internet and technology advancements, organizations are still responsible—and liable—for maintaining compliance with data security and individual privacy laws.
Learn more about privacy laws here.
In its most basic form, AI is a machine’s ability to utilize datasets to perform problem-solving tasks. AI simulates human intelligence with machines that are programmed to think and learn like humans. It involves the development of computer algorithms that can analyze data, learn from it and make predictions or decisions based on that data.
John McCarthy, one of the scientists who coined the term “AI”, stated in his 2004 paper that “[AI] is the science and engineering of making intelligent machines”.
AI encompasses several subfields, including machine learning, natural language processing and robotics. It is used in a wide range of applications, including tools you may use every day, like Siri and Alexa.
But how do businesses benefit from the use of AI?
AI has become integral to many businesses, allowing them to run more productively and efficiently.
Here are just a few of the many possible uses of AI today:
From inventory and process management to data input and brand perception monitoring, AI tools and areas of focus are expanding rapidly.
As we’ve learned from recent court cases involving information tech giants Google and Facebook, the public is concerned with information misuse.
As AI is increasingly used for data collection, organization and analysis, internet users worry about the vulnerability of their sensitive information. Moreover, there is a growing concern that some AI engines store the prompts and data users input into the program. Users are beginning to question how this data is stored and if it can be accessible to others. While some generative AI tools are designed to comply with existing privacy laws, like GDPR, the nature of AI and the unsupervised learning models could pose an issue.
While there is currently no consensus on rules, regulations or required protections for consumers, lawmakers are updating privacy laws to address these issues and ensure that the use of AI technology does not infringe on individuals' fundamental rights to privacy and data protection. In the first half of 2023, 5 U.S. states (Connecticut, Colorado, Maryland, Montana and New York) passed regulations prohibiting employers from making employment-related decisions on the basis of AI. This is because AI-based hiring algorithms are not designed with a focus on equitable hiring outcomes. Subjective measures of success might adversely shape a tool’s predictions and, unknowingly to hiring managers, reinforce gender and racial stereotypes.
Privacy law protects sensitive and identifiable information about people, requiring businesses to understand what information is OK to collect and when to give customers and users the choice to opt out of information sharing.
We can only assume that AI-specific rules will continually be passed in the near future, supplementing the existing industry-specific laws and guidelines around data storage, access, sharing and terms/conditions. In fact, recently, the European Parliament’s Internal Market Committee and the Civil Liberties Committee adopted a draft negotiating mandate on the first-ever rules for Artificial Intelligence.
Not all data misuse occurs with targeted data theft by a malicious actor. Plenty of data misuse occurs due to negligent use of data outside of an acceptable privacy policy and the impact can be devastating to a company.
Data misuse can wreak havoc; it can lead to data leakage, unintentional data breaches and damage to a company’s reputation. Companies must be aware of their data vulnerabilities and build a policy and education program to mitigate potential data misuse.
Non-compliance with privacy law has significant consequences. While the implications to the company and brand reputation should not be overlooked, companies can also face hefty fines, consumer claims, regulatory enforcement actions and costly settlements from claims or enforcement actions. For example, Facebook recently settled a $650 million lawsuit in Illinois due to a violation of the Illinois Biometric Information Privacy Act.
Ideally, AI should be free of human subjectivity and discrimination. However, companies should be aware that intelligence based on AI training datasets may still be – almost certainly are – subject to implicit or unconscious bias, bringing about concerns of fairness and creating legal risk.
Machine learning bias, or algorithm bias, occurs when the data given to fuel the algorithm reflects human biases.
Data bias occurs when the data used to train the AI isn’t representative of the population it’s intended to serve.
Furthermore, because AI depends on collecting information from users to create these datasets and personalize user experience, breaches in privacy may highlight problematic biases, leaving companies facing privacy and anti-discrimination lawsuits.
The best way to avoid making a drastic AI error is to be proactive.
Define your organization's AI policy and be clear about how you plan to use AI in processes and outline the safeguards you have in place to maintain data privacy. You should also develop internal responsible AI best practices for development, use, decision-making and even incident response.
Responsible AI keeps ethics at the center of AI design, focusing on ethical considerations, transparency, fairness, accountability and human values. It aims to ensure that AI systems are designed and used in ways that respect individual rights, promote diversity and inclusion and mitigate any potential negative consequences or biases.
Responsible AI should involve a range of stakeholders, including policymakers, researchers, developers and end-users, and requires multi-disciplinary collaboration and ongoing evaluation.
As AI technology continues to advance and become more integrated into our lives, responsible AI will play a critical role in ensuring that it serves human interests and promotes social, economic and environmental well-being.
As AI technology advances exponentially, businesses are left to wonder about AI’s future impact while carefully considering the ramifications of its use against their public image and continuously changing privacy laws.
Questions about privacy law and AI?
Contact us to learn more and see how we can help define or refine your privacy and responsible AI policy.