data protection
In plain wordsLaws and practices that control how organizations collect, use, store and share information about people, and that give people rights over it, such as seeing it or having it deleted.
The body of law and practice governing how organizations and governments handle personal data, which the GDPR defines as 'any information relating to an identified or identifiable natural person'. Its core principles, descended from the fair information practices of the 1970s, are lawfulness and transparency, purpose limitation, data minimization, accuracy, storage limitation, security and accountability; it gives individuals rights of access, correction, erasure and objection, and is enforced by independent supervisory authorities. The EU treats it as a fundamental right distinct from privacyprivacy, n.: Your ability to control who knows what about you. AI raises new privacy questions because it learns from huge amounts of personal data and can infer things about people they never shared. (Article 8 of the Charter of Fundamental Rights), implemented chiefly through the General Data Protection RegulationGeneral Data Protection Regulation, prop. n.: The European Union's main privacy law, in force since 2018, which controls how personal information is collected and used — including to train and run AI systems.; by the early 2020s more than 130 countries had comprehensive data-protection laws. For AI it governs the lawful basis for training on scraped personal data, requests to erase data that models have memorizedmemorization, n.: When an AI model stores specific pieces of its training data — a paragraph, a phone number, an image — closely enough to reproduce them, instead of only learning general patterns., automated decision-makingautomated decision-making, n.: When a computer system, rather than a person, makes or effectively makes a decision about someone — such as approving credit, screening job applicants or flagging possible welfare fraud., and impact assessments for high-risk processing.
Before fine-tuning on support tickets, run a data protection impact assessment and strip customer identifiers.
Origin
The field takes its name from the German Datenschutz: the West German state of Hesse passed the world's first data-protection law in 1970, and Sweden the first national one in 1973. The OECD Privacy Guidelines (1980) and the Council of Europe's Convention 108 (1981) internationalized it; the EU's 1995 Directive and the GDPR (2016) made it a global template.
Usage note
In US usage 'data privacy' or 'information privacy' covers much the same ground; the US has no comprehensive federal law but relies on sectoral rules and state laws such as the California Consumer Privacy Act. Unlike many privacy doctrines, data protection also applies to publicly available personal data, a point regulators have pressed against web scraping for AI training.
Related
- General Data Protection RegulationGeneral Data Protection Regulation, prop. n.: The European Union's main privacy law, in force since 2018, which controls how personal information is collected and used — including to train and run AI systems.
- privacyprivacy, n.: Your ability to control who knows what about you. AI raises new privacy questions because it learns from huge amounts of personal data and can infer things about people they never shared.
- personally identifiable informationpersonally identifiable information, n.: Information that can identify a specific person, such as a name, address, phone number or ID number — or several facts that together point to one person.
- automated decision-makingautomated decision-making, n.: When a computer system, rather than a person, makes or effectively makes a decision about someone — such as approving credit, screening job applicants or flagging possible welfare fraud.
- right to explanationright to explanation, n.: The idea that a person affected by a decision made or shaped by an algorithm — a refused loan, a rejected job application — is entitled to a meaningful account of why.
- machine unlearningmachine unlearning, n.: Erasing specific things a trained AI model has learned, such as dangerous lab techniques, a copyrighted novel or one person's records, far more cheaply than training the model all over again.
- biometric databiometric data, n.: Information about your body or behavior — your face, fingerprints, voice, eyes or the way you walk — measured by technology and used to recognize who you are or to guess things about you.
Sources
- OECD (1980). Guidelines on the Protection of Privacy and Transborder Flows of Personal Data.
- Council of Europe (1981). Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108).
Mentioned in
privacyprivacy, n.: Your ability to control who knows what about you. AI raises new privacy questions because it learns from huge amounts of personal data and can infer things about people they never shared., biometric databiometric data, n.: Information about your body or behavior — your face, fingerprints, voice, eyes or the way you walk — measured by technology and used to recognize who you are or to guess things about you., right of publicityright of publicity, n.: A person's legal power to decide whether businesses may use their name, face, voice or other recognizable traits to sell things, and to be paid when they do. AI's skill at copying voices and faces makes it more important., contextual integritycontextual integrity, n.: A way of thinking about privacy: information is not simply public or private; what matters is whether it flows in ways that fit the expectations of the setting where it was shared.