Privacy and AI: the current scenario

AI is everywhere …

Artificial Intelligence systems are making waves in both private and public sectors, leveraging the potential of data to enhance forecasting, improve product and service quality, cut down costs, and liberate workers from mundane administrative tasks. In healthcare, for instance, physicians can now swiftly and precisely anticipate health risks, performing intricate treatments with greater efficacy. Meanwhile, in the mining sector, AI-driven robots are taking on perilous assignments like coal mining and sea exploration and aiding in rescue missions during natural disasters. Commercial banking is experiencing a revolution with conversational AI chatbots as AI and Machine Learning (ML) assist sales and marketing teams in identifying potential clients and forecasting customer needs and purchasing patterns. AI in financial services & banking facilitates real-time deal pricing for specific market segments and automates decision-making processes, credit rule sets, and exceptions. In the consumer and retail sphere instead, Conversational AI and e-commerce chatbots are instrumental in predicting and analyzing trends, generating virtual models to showcase apparel, foreseeing customer requirements, and providing a more personalized and enjoyable shopping experience.

… and sometimes, it’s cause for concern 

The emergence of AI technology has sparked concerns on multiple fronts, ranging from extensive data gathering for training purposes to suspicions of surveillance and monitoring. Issues such as the proliferation of bias and discrimination, along with a general lack of transparency, have been raised. It's crucial to recognize that these concerns are not exclusive to AI but rather reflect broader shortcomings in both technology and society.When entrusting responsibilities to AI, we must acknowledge our societal responsibility for the tools we create. Biases, for instance, originate from the individuals developing algorithms and writing code. AI mirrors the existing societal landscape, raising questions about the inequalities it reproduces and introduces. Many experts advocate for human involvement in AI processes to address incidents, for example, the case of New York lawyers facing sanctions for inadvertently including fictitious case references generated by ChatGPT in a legal brief. AI-related headlines have consistently highlighted regulatory challenges, particularly with generative AI tools. For instance, Italy temporarily banned ChatGPT, accusing it of unlawfully collecting personal information. Similarly, Google Bard faced European delays due to Google's failure to address privacy concerns raised by the Irish Data Protection Commission.

Personal data issue

The rapid progression of Artificial Intelligence has brought significant changes across various industries, reshaping our lifestyles, work dynamics, and social interactions. One noteworthy consequence is AI's potential impact on privacy rights and the safeguarding of individuals' data.
In recent years, the focus on data privacy has intensified, propelled by high-profile legal battles against major Silicon Valley players, heightened public apprehension regarding data privacy, and landmark legislative measures implemented globally. These developments underscore the crucial and pressing nature of the issue. While comprehensive regulations, both on a national and international scale, have been established to protect consumers and their data, it is important to note that these privacy frameworks were formulated in a pre-AI era and may not have fully anticipated the profound implications of AI's rapid evolution.

Artificial Intelligence and personal data protection: what perspectives lie ahead

The GDPR, or General Data Protection Regulation, stands as the most extensive privacy legislation globally. It oversees the safeguarding of data and privacy for every person within the European Union and the European Economic Area, offering significant entitlements to individuals regarding their data. The legislation places stringent responsibilities on those managing data, insisting that data controllers and processors adhere to rigorous standards and implement data protection principles when dealing with personal information.

The privacy paradox with AI

Ultimately, AI utilizes ML algorithms to handle data; enable autonomous decision-making; and adjust to changes without explicit human guidance. 
The privacy dilemma associated with AI revolves around several key issues as the technology's insatiable demand for vast personal data to fuel its ML algorithms raises significant worries. What is the origin of this data? What about its storage location? Who can access it and under what circumstances can be accessed? These are questions that traditional data protection laws struggle to address.
Additionally, AI's impressive ability to analyze data and perform intricate analyses intensifies said privacy concerns. The technology's potential to infer sensitive information, such as an individual's location, preferences, and habits, poses risks of unauthorized data dissemination. Coupled with the potential for identity theft and unwarranted surveillance, AI presents a unique set of challenges that require immediate proactive solutions.

Privacy regulator and AI 

The question of responsibility in AI

The rapid evolution of AI technologies prompts a critical question: Who bears the responsibility for AI? As the need for ethical considerations in AI development becomes apparent, industry leaders and major tech companies need to acknowledge their responsibility and privacy implications. Legislative efforts, like the Washington AI Summit, underscore the proactive approach some lawmakers are taking to regulate AI. The dynamic interaction between lawmakers, industry players, and the public highlights the complex journey of assigning responsibility in the realm of AI, demanding continuous dialogue and collaboration.

Perspectives on AI & privacy regulation 

Diverse perspectives and approaches that characterize the landscape of AI regulation as states grapple with defining rules and standards. Ongoing developments in Artificial Intelligence have spurred the recognition of the need for ethical guidelines and best practices to address privacy risks. Initiatives led by organizations such as the Partnership on AI (PAI) and the IEEE Global Initiative on Ethics of Autonomous and Intelligent Systems showcase attempts to shape the regulatory framework. However, the absence of standardized rules emphasizes the varied and evolving nature of AI regulation across different regions.

The Italian Privacy’s Garante and OpenAI case

The actions taken by the Italian Privacy’s Garante against ChatGPT, the AI platform developed by OpenAI, exemplify the consequences of the absence of shared rules in AI. The regulatory intervention, prompted by unlawful personal data collection and the lack of an age verification system, resulted in the immediate cessation of ChatGPT's operations in Italy.
The case exposed a significant data breach, emphasizing the lack of information provided to users and the absence of a legal basis for massive data processing, ultimately highlighting the urgency for responsible AI development. Adding to this, tests revealed inaccuracies in the information processed by ChatGPT, raising concerns about reliability. At the time, Open AI had 20 days to comply with the regulatory order; although OpenAI is based in the US, it designated a representative in the EU, and this had to comply with EU GDPR’s standard. 
This case underscores the imperative for shared rules and global cooperation in AI regulation, emphasizing responsible and transparent AI development practices.

EU and Artificial Intelligence: the role of the AI Act

The AI Act, a significant development in European legislation, represents a collaborative effort between Members of the European Parliament (MEPs) and the Council to regulate AI in the region. This legislative milestone aims to establish a secure AI environment, ensuring the protection of fundamental rights, democracy, and environmental sustainability, while concurrently fostering innovation. Specific provisions include obligations for AI systems based on potential risks and impact levels, encompassing prohibitions on applications deemed threatening to citizens' rights and democratic principles.
The AI Act includes exemptions and stringent conditions for the law enforcement use of biometric identification systems, mandatory fundamental rights impact assessments for high-risk AI systems, and transparency requirements for general-purpose AI (GPAI) systems. The regulations also support innovation by endorsing regulatory sandboxes and real-world testing, particularly benefiting small and medium-sized enterprises (SMEs). Substantial fines are outlined to enforce compliance, reinforcing the commitment to striking a balance between AI innovation and the protection of fundamental rights and societal values within the European Union.

‍

In navigating the complex interplay between AI and personal data protection, the evolving landscape reveals a dual challenge of harnessing AI's potential benefits while addressing concerns such as privacy, bias, and transparency. 
The GDPR serves as a foundational privacy legislation, but the proliferation of AI introduces a privacy paradox, prompting questions about data storage, access, and intricate analyses. The question of responsibility in AI development emerges as a central theme, marked by ongoing legislative efforts and diverse perspectives on accountability. 
The EU's AI Act represents a significant regulatory response, aiming to balance innovation and fundamental rights by introducing specific obligations, exemptions, and transparency requirements, while also fostering innovation through regulatory sandboxes. 
As the EU navigates this regulatory landscape, the focus on compliance, enforcement, and safeguarding societal values underscores a commitment to responsible AI development in an ever-evolving technological era.