Big data, artificial intelligence, machine learning and data protection

Data Protection Act and General Data Protection Regulation

Big data, artificial intelligence, machine learning and data protection

Contents

Information Commissioner's foreword ................................. 3

Chapter 1 ? Introduction ...................................................... 5 What do we mean by big data, AI and machine learning? ...........6 What's different about big data analytics?.................................9 What are the benefits of big data analytics? ............................ 15

Chapter 2 ? Data protection implications ........................... 19 Fairness ............................................................................. 19 Effects of the processing .................................................... 20 Expectations .................................................................... 22 Transparency ................................................................... 27 Conditions for processing personal data.................................. 29 Consent ........................................................................... 29 Legitimate interests .......................................................... 32 Contracts ......................................................................... 35 Public sector..................................................................... 35 Purpose limitation ................................................................ 37 Data minimisation: collection and retention ............................ 40 Accuracy ............................................................................ 43 Rights of individuals ............................................................. 46 Subject access.................................................................. 46 Other rights ..................................................................... 47 Security ............................................................................. 49 Accountability and governance .............................................. 51 Data controllers and data processors...................................... 56

Chapter 3 ? Compliance tools ............................................. 58 Anonymisation .................................................................... 58 Privacy notices .................................................................... 62 Privacy impact assessments .................................................. 70 Privacy by design ................................................................ 72 Privacy seals and certification................................................ 75 Ethical approaches ............................................................... 77 Personal data stores ............................................................ 84 Algorithmic transparency ...................................................... 86

Chapter 4 ? Discussion ....................................................... 90

Big data, artificial intelligence, machine learning and data protection 20170904 Version: 2.2

Chapter 5 ? Conclusion....................................................... 94 Chapter 6 ? Key recommendations ..................................... 97 Annex 1 ? Privacy impact assessments for big data analytics ........................................................................................... 99

2

Big data, artificial intelligence, machine learning and data protection 20170904 Version: 2.2

Information Commissioner's foreword

Big data is no fad. Since 2014 when my office's first paper on this subject was published, the application of big data analytics has spread throughout the public and private sectors. Almost every day I read news articles about its capabilities and the effects it is having, and will have, on our lives. My home appliances are starting to talk to me, artificially intelligent computers are beating professional board-game players and machine learning algorithms are diagnosing diseases.

The fuel propelling all these advances is big data ? vast and disparate datasets that are constantly and rapidly being added to. And what exactly makes up these datasets? Well, very often it is personal data. The online form you filled in for that car insurance quote. The statistics your fitness tracker generated from a run. The sensors you passed when walking into the local shopping centre. The social-media postings you made last week. The list goes on...

So it's clear that the use of big data has implications for privacy, data protection and the associated rights of individuals ? rights that will be strengthened when the General Data Protection Regulation (GDPR) is implemented. Under the GDPR, stricter rules will apply to the collection and use of personal data. In addition to being transparent, organisations will need to be more accountable for what they do with personal data. This is no different for big data, AI and machine learning.

However, implications are not barriers. It is not a case of big data `or' data protection, or big data `versus' data protection. That would be the wrong conversation. Privacy is not an end in itself, it is an enabling right. Embedding privacy and data protection into big data analytics enables not only societal benefits such as dignity, personality and community, but also organisational benefits like creativity, innovation and trust. In short, it enables big data to do all the good things it can do. Yet that's not to say someone shouldn't be there to hold big data to account.

In this world of big data, AI and machine learning, my office is more relevant than ever. I oversee legislation that demands fair, accurate and non-discriminatory use of personal data; legislation that also gives me the power to conduct audits, order corrective action and issue monetary penalties. Furthermore, under the GDPR my office will be working hard to improve standards in the use of personal data through the implementation of privacy seals and certification schemes. We're uniquely placed to provide the right framework for the regulation of big data, AI and machine learning, and I strongly believe that our efficient, joined-up and co-regulatory approach is exactly what is needed to pull back the curtain in this space.

3

Big data, artificial intelligence, machine learning and data protection 20170904 Version: 2.2

So the time is right to update our paper on big data, taking into account the advances made in the meantime and the imminent implementation of the GDPR. Although this is primarily a discussion paper, I do recognise the increasing utilisation of big data analytics across all sectors and I hope that the more practical elements of the paper will be of particular use to those thinking about, or already involved in, big data. This paper gives a snapshot of the situation as we see it. However, big data, AI and machine learning is a fast-moving world and this is far from the end of our work in this space. We'll continue to learn, engage, educate and influence ? all the things you'd expect from a relevant and effective regulator. Elizabeth Denham Information Commissioner

4

Big data, artificial intelligence, machine learning and data protection 20170904 Version: 2.2

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download