Artificial Intelligence (AI) and Data Privacy: Challenges & Solutions

Artificial intelligence is among the most exciting digital topics of our time. New developments and applications make day-to-day work much easier for businesses—for example, by automating processes such as lead generation or content production. However, they also come with legal pitfalls. Collecting and processing information that may contain personal data must always be viewed critically through the lens of data privacy. Here is an overview of potential challenges and solutions.

Note: This article is intended as an introduction to the topic and aims to raise awareness; it does not claim to be exhaustive and does not replace legal advice from specialists familiar with AI and data protection laws.

How Does Artificial Intelligence Work?

How artificial intelligence works is complex, but put simply, AI systems are designed to simulate human intelligence. A subfield of artificial intelligence is machine learning, which is capable of learning through input data and algorithms. At its core, then, it relies on information, algorithms, and mathematical models designed to simulate the human brain.

Where Do the Data and Information Used to Feed AI Come From?

Which specific data was used to train an AI application depends on the system and cannot be answered with a simple rule of thumb. ChatGPT, for instance, draws on publicly available information—such as Wikipedia, digitally available books, and openly accessible texts from across the internet. In addition, the chatbot learns from the "conversations" it has with users.

What Legal and Data Privacy Issues Can Arise When Using Artificial Intelligence?

Data protection officers and regulatory authorities have been looking into the topic of data privacy and artificial intelligence for years. As early as 2019, Germany's Conference of Independent Federal and State Data Protection Authorities (DSK) published a position paper recommending technical and organizational measures for designing privacy-compliant AI systems.

In the spring of 2022, the French data protection authority CNIL released two guides detailing the privacy requirements and assessment criteria for AI systems.

One of the most well-known AI tools, ChatGPT, was initially banned by Italian data protection authorities this spring, before being allowed back for use in Italy following a statement and adjustments from the provider.

These examples show that authorities in various countries have been tackling the issues AI tools can bring—and whether they can be used in a privacy-compliant way—for quite some time.

Data privacy demands closer scrutiny whenever AI tools use non-public personal data, such as customer records or employee details. Sensitive personal data includes names, addresses, and phone numbers. The processing of this data, and a company's interest in doing so, must be balanced against an individual's right to informational self-determination. For especially sensitive information, such as health data, the legal framework is even stricter.

Things also get tricky when sensitive, non-public information is fed into an AI system via a prompt, without realizing that this data is being stored and could potentially be revealed to other users in their queries. Examples include asking an AI to summarize confidential meeting notes or analyzing personnel records based on specific criteria.

AI and the GDPR

Relevant to the GDPR is any processing of personally identifiable information—for example, using datasets with personal details or connecting an AI tool to communication channels like an email client.

Here, too, the fundamental principle of data minimization applies: personal data may only be collected and processed to the extent necessary to achieve the specific goal. Unnecessary data collection should be avoided. When in doubt, it is also wise to be able to demonstrate why the use of AI is necessary to process that data.

Individuals whose data is being used should be clearly informed (for example, through a privacy policy) about what data is collected, how it will be used, and who has access to it. Whether this data is anonymized and whether it is adequately protected, such as through encryption, also makes a big difference from a legal perspective.

AI and Copyright Law

Less frequently discussed, but just as relevant, is the question of copyright when using artificial intelligence. Works generated purely by AI are not protected by copyright because they were not created by humans. But what about the source material that AI applications use to generate new content? A hot topic of debate, for example, is whether it is permissible to use image datasets to train AI tools without the consent of the original creators.

At first glance, using popular AI tools that generate results based on a prompt seems similar to using a search engine. Both answer questions; both provide information. However, search engines only display previews or excerpts of content in its original form. Generally, this data is not altered, and no new content is created.

Just as in the offline world, what matters for the assessment is how close the newly generated work (text or image) is to an original work. When using an AI tool, this is almost impossible to gauge because the training sources—and therefore the original works—are unknown. Adopting AI-generated content without a critical eye can quickly lead to copyright issues.

What Options Exist for Using Artificial Intelligence in a Privacy-Compliant Way?

It is undisputed that artificial intelligence holds tremendous value for businesses, for instance in online marketing (read our whitepaper to learn more). Many companies regularly use tools like ChatGPT to streamline or speed up their content production. In light of the potential legal pitfalls, the question arises: how can AI be used in compliance with data privacy laws, and what approaches are already out there? We always recommend taking a thoughtful, critical approach rather than using AI-generated texts or images blindly. For instance, we love drawing inspiration from AI tool responses, but we always review and edit them manually.

How data is collected and used, which sources an AI tool taps into, and what privacy safeguards are in place vary from provider to provider. This is especially true for personal data—how is it protected, is it anonymized, is it processed outside the EU, and so on. Clarifying who is liable in a legal dispute (is it the tool provider?) is just as important. Before deciding on a solution, it's a good idea to check these details and seek legal advice if you're unsure.

When using AI-based chatbots, mindfulness is key when it comes to what you type into a prompt. This information can, in some cases, be used by the system for further training—including personal details not meant for public consumption. Depending on the tool you use, you may be able to opt out of having your entered data used for training.

Beyond using online AI solutions that require checking against legal standards, there are two alternative approaches we'd like to touch on briefly.

Local/Offline Use of AI Tools

Several providers are working on locally deployable solutions for their AI applications. One example is GPT4All, an open-source alternative to ChatGPT. It can run on your own network and does not require an active internet connection.

How helpful these local AI solutions are depends on the size of the underlying model, the quality of the language model, and what you plan to use it for. Supplying the tool with your own company data for processing, for example, is not something GPT4All can easily do right out of the box. However, rapid advancements and expansions in these solutions are definitely on the horizon.

Developing Custom AI Tools

Coding a completely custom AI tool from scratch is resource-intensive and rarely cost-effective for most businesses. That said, pre-built algorithms and AI models are available that make this work much easier and can be customized to your specific needs. You can then use this tailored AI solution to evaluate your own data, get insights, or automate processes securely.

More Updates from the World of Online Marketing and Online Business

At internetwarriors, we have been closely following developments in the digital landscape with genuine enthusiasm—in some cases, for decades. We stay on top of new tools and technical standards, testing how they can best be applied to our work. Our clients benefit from up-to-date expertise and staying one step ahead of the competition when it comes to adopting new technologies and answering key trends. Want to stay in the loop? Subscribe to our newsletter for the latest insights. Looking for support with your online marketing? Feel free to reach out to us!