Risks and opportunities

1. Risks and opportunities

Welcome!

2. Massive opportunities of AI and big data

Artificial Intelligence is one of this century's most exciting and disruptive technologies, harnessing the power of ever-increasing data and easy access to powerful computational resources. AI adoption provides a substantial competitive advantage to businesses. It is expected that AI adoption by companies and governments has the potential to contribute an additional 15 trillion dollars to the global economy by 2030.

3. AI for good

AI is not only useful for economic benefits. The United Nations believes it can be used to achieve the various UN Sustainable Development Goals like tackling climate change and improving access to healthcare and education using AI-based systems. On the other hand, AI poses risks to individuals and societies both on fairness and discrimination as we've seen before as well as data protection itself. Understanding these risks is important to understand the safeguards one need to take while implementing AI systems compliant to GDPR and beyond. Let's see what happens when companies use AI that is not GDPR compliant.

4. GDPR fines: discriminatory AI

In 2021, the Italian supervisory authority fined a food delivery company, which used profiling and automated decision-making systems to process the personal data of their riders to assign them food orders and routes based on a feedback-based scoring system. This system had several shortcomings regarding GDPR compliance because it was found that the company used poor quality and biased datasets to feed their algorithms resulting in incorrect and discriminatory scores. Additionally, there were several areas for improvement in how riders were informed about their data processing and the amount of data collected. In addition to the fine, the company was ordered to implement safeguards to prevent inappropriate and discriminatory feedback-based scoring applications and to apply data minimization mechanisms and privacy by design and default principles.

5. Data protection and beyond

From a purely data protection point of view, AI systems can be complicated in preventing the disclosure of personal information, even with aggregated data like X-rays or CT scans. Even if a company performs a DPIA, the residual risks regarding disclosures are hard to document, let alone mitigate. This again is related to the black box problem. For example, researchers found that when using AI for medical imaging, the AI was inadvertently predicting the patient's race just by looking at the CT scans or X-rays without any additional information. Here, it would be impossible to mitigate the risk since we don't know the cause of it. This is not only a disclosure issue but also discriminatory since it can perpetuate dangerous pseudo-scientific beliefs on race and ethnicity.

6. The balancing act

AI systems that use personal data should follow all the GDPR principles. GDPR expects additional safeguards to prevent inference risks due to powerful AI technologies. Especially when processing special categories of data such as health information or religious beliefs. We've seen that GDPR restricts fully automated decision-making and profiling, specified in article 22. However, there are exemptions, such as fulfilling contractual obligations; for public interest purposes and if data subjects give explicit consent. Although GDPR is compatible with AI system functionings, it doesn't cover all aspects like definitions of AI models and the level of risk they pose. Therefore the European Commission has proposed a new regulation similar to GDPR for AI systems, also known as the AI act, which we will see in the following video.

7. Let's practice!

So far, we've seen GDPR as a standalone regulation. In the final part, we will examine its relationship with other regulations and how we expect its influence to extend in the future. Before that, let's test your skills on AI risks and opportunities.

Create Your Free Account

By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.