The ICO launches new guidance on AI and data protection

On 30 July, the UK's data protection authority, the ICO, issued some welcome guidance on artificial intelligence (AI) which can be found here. This is further to the ICO's general commitment to enable good data protection practice in AI (see here) and in recognition of the opportunities that AI offers society but also the inherent data protection risks associated with using complex and sometimes opaque systems.

The guidance itself is aimed at those with a compliance focus (such as data protection officers) as well technology specialists (such as data scientists). It sets out recommended actions and best practice as well as any technical measures which might be applied by organisations to mitigate the risks associated with AI. The guidance is split into four main sections:

• Part 1, which looks at accountability, governance, data protection impact assessments;

• Part 2,which covers lawful, fair and transparent processing as well as any steps which can be taken to mitigate potential discrimination;

• Part 3, which looks at data minimisation and security -- indeed (as noted by the ICO in its foreword), data minimisation, which may well seem "at odds" with the large datasets required for machine learning, is clearly one of the more difficult principles to apply to AI; and

• Part 4, which deals with individuals rights (including automated decision-making)

all in the context of AI. The guidance is fairly detailed and should provide a helpful starting point for organisations looking to mitigate risks associated with AI at the design stage.

Next steps

Companies should review the guidance on AI and data protection to help determine the steps needed to mitigate risks associated with AI at the design stage.