Artificial intelligence—data protection
Artificial intelligence—data protection

The following TMT practice note provides comprehensive and up to date legal information covering:

  • Artificial intelligence—data protection
  • Relevance of data protection law to AI
  • Key guidance
  • Explain Guidance
  • ICO Guidance on AI and data protection
  • ICO Toolkits
  • Data in AI
  • Machine learning (ML)
  • Input or training data
  • Output data
  • More...

Artificial intelligence—data protection

This Practice Note provides a summary of UK data protection law as it applies to the use of artificial intelligence (AI). It covers the following:

  1. Relevance of data protection law to AI

  2. Key guidance

  3. Data in AI

  4. Understanding the controller/processor relationships in AI

  5. General obligations on controllers

  6. Lawfulness

  7. Fairness

  8. Transparency and the need for ‘explainability’ of AI

  9. Purpose limitation

  10. Data minimisation and privacy-preserving techniques

  11. Accuracy

  12. Storage limitation

  13. Security

  14. Accountability

  15. DPIAs

  16. Data protection by design and by default

  17. Data subjects’ rights

  18. Automated decision-making in AI systems and the role of human oversight

  19. Children’s personal data

  20. Obligations on processors

This Practice Note focuses on the guidance issued in the UK and does not detail the various strategies and policies outlined in the European Commission’s Digital Strategy or the White Paper on AI. To follow the progress of these initiatives, see Practice Note: Artificial intelligence—timeline.

Relevance of data protection law to AI

Data protection law is technology neutral and the UK General Data Protection Regulation, Retained Regulation (EU) 2016/679 (UK GDPR) regime which governs the processing of personal data does not mention AI directly.

However, harnessing AI involves the processing of large quantities of data and although not all applications for AI will use personal data, a significant proportion of them do. Personal data can be processed both during the training of the AI and in deployment. Even where

Related documents:

Popular documents