Blog By
Njoki Kimemia,
Legal and Data Protection Officer (LDPO))
South-End Tech Limited
Friday, February 9, 2024
The world was first made aware of the revolutionary possibilities of artificial intelligence (AI) when ChatGPT debuted in late 2022. One of the most significant advancements in AI history is the technology underlying the potent new Chabot: generative AI. Unlike traditional AI, which just analyses and categorizes data, generative AI produces whole new content, including text, photos, audio, synthetic data, and more.
Generative AI relies on data to customize user experience and this can bring issues with Privacy. The potential of inadvertently generating content that violates an individual’s personal information, particularly sensitive data, prevails as AI models learn from training data – enormous databases obtained from multiple sources containing personal data, often without the individual’s explicit consent
AI Models are susceptible to various privacy risks and attacks if they are not trained using privacy-preserving algorithms and the following problems can arise:
- invasive surveillance,
- AI can be used to create convincing fake images and videos, which can be used to spread misinformation or even manipulate public opinion.
- unauthorized data collection, which can compromise sensitive personal information and leave individuals vulnerable to cyber-attacks.
- Additionally, AI can be used to create highly sophisticated phishing attacks, which can trick individuals into revealing sensitive information or clicking on malicious links.
Questions that arise from the use of Generative AI
- Can you opt-in/opt out of your data being used to train the AI model?
- Does the Gen AI have a way to abide by the principles of data protection such as storage limitation?
- Is your data shared with third parties?
Safeguarding Tips for Data Privacy Protection
- Ensuring Regulatory Compliance– Organizations that are responsible for a high-impact system, then they must establish measures to identify, assess, and mitigate risks of harm or biased output that could result from the use of the system per the regulations.
- User Consent and Transparency-Where necessary, obtain the user’s explicit consent before using their data for generative AI purposes. Provide data subjects the right to opt out of their data being used by AI systems (or to opt-in or withdraw consent) when collecting their data. Ensure transparency by informing users of the intended use of their data and the security measures in place to ensure the privacy and security of their data, along with the source of the training data.
- Data Minimization: Only obtain and retain the minimum data necessary for AI training purposes. Limiting the amount of sensitive data reduces the potential risks associated with data breaches or inadvertent sensitive data exposure.
- Classify AI Systems and Assess Risks: Discover and make an inventory of all AI models in use. Assess the risks of your AI model at the pre-development, development, and post-development phases and document mitigations to the risks. You must also classify your AI system, do bias analysis, etc.
- Anonymization and De-Identification: Apply anonymization techniques to eliminate personal identifiers from the data before feeding it to generative models.
- Secure Data Storage and Transfer: Ensure to employ encryption techniques and proper safeguards to store the data needed to train and improve generative models. Use encrypted channels to move data across systems to prevent unauthorized access.
- Access Control: Implement strict access controls and enforce a least privileged access model to limit who can access and utilize generative AI models and the data they generate. Role-based access ensures that only authorized individuals can interact with sensitive data.
- Ethical Review: Establish an ethical review procedure to evaluate the potential impacts of content produced by AI. This assessment should concentrate on privacy concerns to ensure the material complies with ethical standards and data protection laws.
- Publish Privacy Notices: Develop and publish comprehensive data governance policies that outline how data is collected, used, stored, and disposed of, along with explanations of factors used in automated decision-making, the logic involved, and the rights available to data subjects.
- Transparent AI Algorithms: Utilize transparent and comprehensible generative AI algorithms. This enables discovering how the model produces material and locating any potential privacy issues. Introduce a module to detect the presence of sensitive data in the output text. If detected, the model should decline to answer or mask any sensitive data detected.
- Regular Auditing: Conduct regular audits to monitor AI-generated content for privacy risks. Implement mechanisms to identify and address any instances where sensitive data might be exposed.
Please do not hesitate to contact us for your Cybersecurity and Data Protection Solutions and Service needs on the telephone at +254115867309 +254721864169; +254740196519; +254115867309 or email.
