28 January 2025 was Data Protection Day and the Information Commissioner's Office (ICO) used it to highlight the opportunities and challenges related to AI and data protection.
AI adoption is integral to the government's growth plans, however the ICO are keen to make sure that the opportunities AI brings are taken up in a way that keeps people safe.
The ICO have highlighted some misconceptions about AI, and this contains some good pointers for businesses and organisations considering using AI.
Control over personal data
There is no change to the rights that people have over their personal data. Each person has the right to object to their own personal data being used for AI purposes. The ICO are also stepping in on this issue - as they did recently with LinkedIn and Meta - when they observe incorrect approaches by organisations.
Be transparent
The ICO emphasised that being open and honest with people isn’t optional or an afterthought. Businesses that want to use people’s data to train AI models need to be transparent about what they are doing. The ICO recently consulted on this and found a lack of transparency across the industry, but feel this matter is central to firms building trust in their AI models.
Intention is irrelevant
While an organisation may not mean to process people’s data, intention is irrelevant. It is what happens to the data that matters. This means businesses must be careful about the data they use to train AI models.
AI models have data protection risks
Some have argued that AI models don’t store personal data and so data protection doesn’t apply. However, some AI models can contain the personal data they have been trained on in a form that allows for people to be identified. The ICO have said they are continuing to improve their understanding of this area.
Data protection and AI go hand in hand
Again, some have argued that data protection law should be lighter touch when it comes to developing AI. However, the ICO are clear that businesses must first consider how they will make sure people’s rights and freedoms are protected before using AI in their products and services.
Considering the overall message from the ICO, it seems clear that businesses involved in training AI models or using AI in their products and services need to be careful that they are complying with data protection laws.
See: https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/01/debunking-data-protection-myths-about-ai/