The CNIL publishes its first recommendations for the development of AI. The goal ? Be connected with GDPR to reconcile technological innovation and respect for personal data.
Artificial intelligence (AI) is now part of our daily lives: health, finance, administration, it has quickly become an essential part of our digital society. But it has also raised debates and controversies, in particular because of its exponential development, sometimes leaving gray areas concerning personal data.
The National Commission for Information Technology and Liberties (CNIL) recently published its first recommendations on the subject. These guidelines, the result of two months of public consultation, aim to help professionals develop AI systems while respecting personal data. The proposed recommendations take into account the future European regulation on artificial intelligence, which should be adopted very soon. Indeed, when it comes to the development of an AI system involving personal data, both the GDPR and the AI Regulation come into play. Thus, the CNIL recommendations were designed to coherently complement these regulations, focusing specifically on data protection.
Recommendations in 7 steps
The CNIL has delivered seven initial recommendations for the development of AI. These recommendations are the result of two months of public consultation with researchers, associations and companies in the AI, finance, health and aeronautics sectors. They aim to help professionals reconcile the development of AI with respect for personal data. The CNIL considers that “ Development [de l’IA] is compatible with the issues of protection of the private life “. To do this, she advises those who develop AI systems to check that they have the right to reuse certain personal data, and that it is not stolen elements, for example.
It also encourages minimizing the personal data collected and used in order to limit it to that which is necessary, adequate and relevant. This principle must be applied even more rigorously. when the processed data is sensitive », that is to say those which relate to health, sexuality or even religious opinions. The Commission also recommends defining a retention period for the data and then checking that it is deleted once the period has expired.
The next steps
Beyond these first recommendations, the CNIL plans to complete these directives “ In the coming months ” with ” other sheets relating in particular to the legal basis of legitimate interest, management of rights, information of the persons concerned, annotation and security during the development phase “. These additional sheets will deepen the initial recommendations and cover a broader spectrum of issues related to AI and data protection.
It is also recommended to assess the risks inherent in an AI system, such as the possibility that confidential data will be made public or misused. The CNIL therefore invites companies that develop these systems to take precautionary measures, in particular data encryption.
This proactive approach to risk management is essential to ensure user trust in AI systems and ensure their widespread adoption. In short, these CNIL recommendations constitute an important step towards ethical and responsible AI.
Source : The CNIL
0