Understanding AI and Privacy Obligations

Businesses strive for greater efficiency across their operations. As a result, artificial intelligence (AI) is fast becoming a vital tool to help achieve that objective. However, when AI interacts with customers, organizations must ensure they meet privacy obligations.

The Office of the Australian Information Commissioner (OAIC) has issued guidance on privacy concerning the use of commercially available AI products.

Outlined below are some Australian Privacy Principle (APP) considerations that businesses should address when developing plans to introduce AI or using AI that involves individuals' personal information.

1. Lack of Transparency (APP 1)

Businesses that fail to understand or communicate the risks associated with AI might unintentionally violate APP 1. This principle requires that personal information be handled in an open and transparent manner. Transparency is crucial as it builds trust between organizations and individuals. It ensures that people are fully informed about how their data is being used, processed, and possibly shared.

Without clear communication, individuals may remain unaware of the consequences of AI decision-making processes on their lives. This includes outcomes from automated hiring systems, credit scoring algorithms, or personalized advertising. Also, the absence of transparency can lead to misunderstandings regarding data collection, its purposes, and potential risks such as data breaches or misuse.

To comply with APP 1, businesses must disclose their data practices and engage in meaningful dialogue with individuals. They should provide detailed explanations of how AI systems function and what safeguards are in place to protect personal information. This proactive approach not only meets regulatory requirements but also improves ethical AI use. It promotes accountability and fosters a culture of respect for individuals' privacy rights.

2. Improper Collection of Personal Information (APP 3)

AI systems often generate or infer personal information without obtaining it directly from individuals. This raises significant privacy and legal compliance concerns. APP 3 mandates that personal information should typically be collected directly from individuals unless it is unreasonable or impracticable to do so.

Businesses must provide strong justifications for any indirect collection methods. For example, if an AI system infers personal information from publicly available data or third-party sources, businesses must ensure this indirect collection is essential for their functions or activities. Furthermore, organizations should implement measures to mitigate potential risks associated with indirect personal information collection. This includes ensuring data accuracy, currency, and relevance to the intended purpose.

3. Unanticipated Use of Data (APP 6)

Using personal information to train AI models can breach APP 6 if individuals did not reasonably expect their data to be used in this way. APP 6 emphasizes that personal information should only be used in ways consistent with the original collection purpose. Businesses must ensure that any secondary data use, particularly for training AI, aligns with the initial purpose or that explicit consent has been obtained.

This underscores the significance of clear communication and informed consent in data practices. For instance, if an individual provides data for a specific service, they should be made aware if their information will be used to train an AI model. They should also have the option to agree or decline. Moreover, businesses should implement robust data governance frameworks, including regular assessments of personal information use to ensure compliance with APP 6.

4. Inadequate Notification and Understanding (APPs 5 & 6)

AI systems can be complex and opaque, making it challenging for individuals to understand how their data is used or where it may be transferred. This lack of transparency can lead to non-compliance with APP 5 and APP 6, which govern the notification and use of personal information.

To comply, businesses must provide clear, accessible, and comprehensive notifications explaining the purpose of data collection and potential uses. This includes any transfers to third parties or training AI systems. Notifications should be plain and easy to understand, avoiding technical jargon that may confuse individuals. Organizations should also adopt user-friendly interfaces and educational resources to enhance individuals' understanding of their data rights and management.

Key Takeaways

Prioritizing transparency and clarity can help individuals feel more informed and empowered regarding their personal information. This approach fosters trust and compliance between businesses and customers.

Businesses should regularly review their current Privacy Policy and update or implement all relevant systems and documents to reflect the use of AI. If you need assistance, please let me know.

You can obtain more information from the OAIC.

Contact for help with AI

KJ