Consider privacy when using generative AI, warns ICO

In a blog by Stephen Almond, executive director, regulatory risk, at the ICO, the regulator said that organisations developing generative AI should be considering data protection obligations from the outset and reminding companies that personal information taken from public sources still needs to consider data protection law.

Generative AI models, or large language and image AI models, can produce text and images using complex machine learning models, and have been popularised by the launch of ChatGPT by OpenAI in November 2022.

The ICO’s comments follow a recent temporary ban on ChatGPT in Italy over privacy and data processing concerns, as well as a recent letter from more than 2,000 academics and AI specialists calling for a six-month moratorium on large-scale AI “experiments”.

Almond said in the blog: “It doesn’t take too much imagination to see the potential for a company to quickly damage a hard-earned relationship with customers through poor use of generative AI.

“But while the technology is novel, the principles of data protection law remain the same – and there is a clear roadmap for organisations to innovate in a way that respects people’s privacy.”

He added there were eight areas that organisations should consider before adopting generative AI, including lawful reasons for processing data, ensuring transparency and mitigating security risks.

Other tips included checking whether you were a controller or processor of personal data, preparing a data protection impact assessment, working out how to limit unnecessary processing, deciding how to comply with individual rights requests and whether generative AI would make solely automated decisions.

“As the data protection regulator, we will be asking these questions of organisations that are developing or using generative AI,” concluded Almond.

“We will act where organisations are not following the law and considering the impact on individuals.”