Management > Identity

Denham says AI developments must consider privacy impact

David Bicknell Published 23 March 2018

ICO tells Alan Turing Institute: “AI offers a world of pure imagination. But we can’t afford to go crazy like a kid in a candy store”


The Information Commissioner Elizabeth Denham has warned that the implications for privacy and data protection must not be forgotten in any rush to embrace artificial intelligence (AI).

In a speech today to the Alan Turing Institute as part of its event, “The GDPR and Beyond: Privacy, Transparency and the Law,” Denham looked at how AI developments must take privacy into account. 

Paying tribute to Turing, who lived in a “five bed Victorian semi” a mile from Denham’s Information Commissioner Office (ICO) in Wilmslow in Cheshire, Denham said, “In his day, Turing was one of few futurists. He had the ability to look beyond what was probable and into what might one day be possible. He had the power to identify potential and apply it in ways his contemporaries couldn’t begin to imagine.”

Denham continued, “We’ve come so far in such a short space of time. In the Manchester Museum of Science and Industry there’s a replica of Baby – developed in 1948 it was the first computer to store and run a programme. This is a machine that would fill my living room, yet is has less power and capability than the iPhone in my pocket.

“So what does all this have to do with me? The UK’s Information Commissioner charged with upholding the rights of individuals to keep control of their personal information.

“Well, the most significant risks to individuals’ personal information are now driven by the use of new technologies. The revelations over the last few days involving Cambridge Analytica and Facebook and political campaigns is a dramatic case in point.”

She added that we are now dealing with a rise in cyber-attacks as well as web and cross device tracking and, of course, the rise of Artificial Intelligence, big data and machine learning.

Denham continued, “These technologies use high volumes of personal data from a wide range of sources making decisions and providing new insights about individuals. And cloud computing platforms enable the storage and processing power to be used at scale.

“AI is not the future. It is the now. New facial recognition tools are being used in law enforcement – I’ll be blogging soon about this – and the credit and finance sectors are already using social scoring techniques.”

Denham warned that the ability of AI “to intrude into private life and effect human behaviour by manipulating personal data” makes highlighting the importance of this topic a priority for the ICO."

She said, “So, my office has a significant role to play. I have often spoken about how innovation and privacy must go hand in hand. As technological developments progress ever rapidly, I am duty bound to stand up for the privacy rights of UK citizens. I will not allow their fundamental right to privacy to be carried away on a wave of progress.

“Today we benefit from the wisdom of many futurists. Notably the late Stephen Hawking.  He said AI is the road to dystopia. Yuval Harari (said) AI will make bystanders of us all. Ray Kurzweil – the American author and inventor - who says AI will outsmart the human brain in computational capability by the middle of this century.

“I am a futurist too. I am excited by how AI is already enriching our lives. How it is a way to lever the economy. It can improve health, transport, economics, law enforcement, research - every part of what we do. But I’m also trying to predict how AI will impact on the privacy of individuals.

“Algorithms are not new. Ever since the first shampoo bottle instructed us to “wash, rinse, repeat” we’ve been using a formula to reach a conclusion. What’s changed is the volume of personal data, the velocity at which it can be processed and the value attached to it. And organisations are slurping it up. My office must be a triple threat. I need the law. Regulation is where the power is. But in order to exercise that power, the regulator must also understand the technology and the ethics.”

Discussing the law around AI in the context of GDPR, Denham said, “A lot has changed since the Data Protection Act was forged 20 years ago. Soon there will be a new law in town, the General Data Protection Regulation. It’s a much-needed modernisation that gives us the right tools to tackle the challenges ahead.

“Its considerable focus on new technologies reflects the concerns of legislators here in the UK and throughout Europe about the personal and societal effect of powerful data-processing technology like AI, profiling and automated decision-making.

“The GDPR enhances people’s ability to challenge decisions made by machines. It provides a measure for algorithmic transparency. It provides for human intervention in decisions that are relevant to their lives – shopping recommendations generated by machines – not a big deal. But being eligible for a certain school, a career promotion or medical treatment. Get a human involved.

“Accountability and transparency are driving forces in the GDPR. The rules of transparency and fairness have not changed, but organisations are obliged to account for what they do, why and how they do it.”

So, Denham said, the ICO’s office “is unlikely to have an issue with narrow AI that’s designed to solve a specific problem using defined data sets. This type of AI can be compliant with data protection law.”

But, she went on, “AI that’s opaque, on the other hand, gives rise to the questionability of fairness because the actions being taken cannot be readily shown. It crosses the red line if it can’t be explained.

“Because if a developer can’t explain what an algorithm is looking for, how it does its work or how a decision is reached, it is not transparent. How can that be fair?”

On AI and technology, Denham said, “Understanding how tech effects information rights is a not a niche area for the ICO or just the responsibility of one department. Yes, my new Technology Policy Department will spearhead the work, but this is a thread that must run through the fabric of my office.

“AI is one of our top three priorities for 2018/19 and we’ll kick off our new Technology Fellowship programme with a two-year post-doctoral appointment to investigate and research the impact of AI on data privacy. I’ve spoken before about introducing a regulatory sandbox to enable organisations to develop innovative products and services while benefitting from advice and support from the regulator. We intend to consult on implementation this year.

“And I should say we are not coming at this from a standing start. Our award-winning AI and Big Data paper, which we updated in September, has enjoyed widespread acclaim. It addresses the broader societal implications of the technological age.”

Denham also discussed the increasing importance of data ethics. “This is a subject that fascinates me. I spoke at length about it to the TechUK Data Ethics summit in December last year. The subject, I believe, is still in its infancy,” Denham said.

“My new Head of Technology, Nigel Houlden, came to us a few months ago from Wrexham Glyndwr University. In his team of 14, only one had a PhD in a data ethics. We are good at the doing, we have to get better at the thinking.

“So here’s what I think. The worlds of data protection law and data ethics are not sitting in separate universes. But there are broader questions beyond the law. And we are all working to define the gaps and address outstanding questions. I like to think my office is sagacious in this space, but I am not so naive as to fail to recognise the need for broader conversations across many sectors and society.”

In conclusion, Denham said, “AI offers a world of pure imagination. Some say it’s a wonder. It’s exciting. Its capabilities may be beyond our wildest dreams. But we can’t afford to go crazy like a kid in a candy store.

“There are questions about whether the use of data is acceptable in one context, but not another. We have to consider the right to autonomy and privacy and understand that the way opaque AI algorithms interpret personal data cannot be addressed by legislation alone.

“We’re in a race to the top with economies like Japan, Singapore and France that are focused on AI and digital. This is not a machine vs human battle. It is a defining moment which requires a sense of responsibility and a long term view.

“Future generations will thank us if the way in which we develop artificial intelligence today looks at the true value it can deliver while respecting data protection and ethical principles.”

We have updated our privacy policy. In the latest update it explains what cookies are and how we use them on our site. To learn more about cookies and their benefits, please view our privacy policy. Please be aware that parts of this site will not function correctly if you disable cookies. By continuing to use this site, you consent to our use of cookies in accordance with our privacy policy unless you have disabled them.