Balancing Innovation and Privacy: Key Insights from the ICO

On 6 December 2023, the Information Commissioner, John Edwards, delivered a speech at the TechUK Digital Ethics Summit, with a focus on the importance of organisations remaining "authentic" if they are to "seize the moment" in using AI and other emerging technologies.

We have summarised here some key takeaways from Edwards' speech:

1. Maintaining trust in AI

Edwards noted that AI has "never been so entrenched in modern society", with the ability to "improve our lives", such as by:

• automating otherwise labour-intensive processes;

• improving customer service;

• bettering safety features for online services; and

• providing quicker resolutions for common technical issues. 

Edwards was very clear that the ICO is not against organisations using AI and that the ICO wants to ensure that people do not move away from using apps or technology due to fears around the risks to their data.

However, Edwards warned that AI must be deployed in  "sensible, privacy-respectful ways, ensuring that people's personal information and privacy rights remain protected throughout".

2. Looking into the AI supply chain

Edwards explained that the ICO are also interested in "getting into the weeds of the AI supply chain" by understanding how the model works and asking such questions as:

• "What information are they trained on?"

• "Does this introduce any unwanted bias or discrimination against minority groups or those who aren't represented as widely in society?"

• "How can we, as the data protection regulator, ensure that these biases aren't carried over and incorporated into later AI models?"

3. Collaboration with other regulators:

Edwards was clear that this is not just an issue for the ICO. He cited various ways in which the ICO is working with other regulators to help ensure the safe deployment of AI across the UK:

(a) Competition and Markets Authority ("CMA")

Edwards noted that the ICO are working with the CMA, given the number of cross-overs between competition,  consumer and data protection objectives in relation to AI.

(b) Digital Regulation Cooperation Forum ("DRCF")

The DRCF, which consists of the ICO, Ofcom, the FCA and the CMA, was set up "to ensure that there was a cohesive and collaborative approach to issues that affect society".

Edwards explained that the ICO works closely with the its partners in the DRCF and they are currently working together to pilot a multi-agency advice service, helping innovators to develop their ideas with regulatory compliance in mind.

Edwards noted that they are aiming to launch the pilot service in 2024.

4. Sandbox

Edwards referred to the Sandbox which the ICO have put in place so as to provide a “safe space” for creating innovative products and services, with staff on hand to help with “tricky” data protection issues that organisations may come up against, whilst offering a way to “stress test” products and services before releasing these to the wider market.

Edwards urged organisations to make applications for the Sandbox, which closes at the end of December 2023.

5. Innovation Advice Service

Edwards reminded listeners of the ICO's Innovation Advice Service (launched in April this year), through which the ICO promises to answer data protection questions within 10-15 working days.

Edwards noted that, since its launch, the ICO have answered various AI-related queries, such as how a law firm can deploy a generative AI system to draft responses to clients.

Main Takeaways:

The ICO recognises the benefits of AI in our society. However, in order to ensure that the innovative values of AI can be seen, privacy rights must be protected throughout.

Organisations looking to use AI must take all steps to ensure that their deployment of AI is compliant with all applicable laws and should consider utilising the support available from the ICO accordingly.