Privacy & Security
About Privacy & Security in AI
Proper privacy and security mechanisms are especially crucial to protect data integrity and privacy. Strong data governance should be in place to protect individuals’ privacy and data security with consideration given to the type of data used, the environment or industry the AI system will be deployed in and the algorithm the data is subjected to. AI systems used by public and private sector organisations should always respect privacy and incorporate security standards when using AI.
Key Considerations
General
- Personal data protection – AI systems must guarantee that the data collected about the end users throughout their interaction with the AI system will not be used unlawfully or unethically.
- Subject to provisions in the PDPA, AI systems should obtain consent from the end users to process personal data or sensitive personal data, and such consent should be recorded when necessary.
- Anonymisation, pseudonymisation and other industry standard techniques of removing personally identifiable information should be implemented when training the AI system to avoid compromising indivisual identities.
- Resilience to cybersecurity attacks – AI systems should be technically robust and protected from adversaries, such as hackers or scammersence to cybersecurity attacks – AI systems should be technically robust and protected from adversaries, such as hackers or scammers.
- Consideration should be given to ensure that the AI system is resilient to any attacks or security threats from data and model leakage.
- Continued security and privacy of subjects must be considered when commissioning and decommissioning the AI system.
- Insufficient security measures may cause the AI system behaviour to change and cause data to be corrupted, wrongfully distributed, or result in harmful and erroneous outputs.
- Data governance – AI systems should have proper data protocols or governance in place throughout the AI life cycle.
- Protocols to ensure that only qualified and competent employees can have access to data should be implemented.
- AI systems should have adequate and regular privacy and/or protection impact assessments.
- Implement data management protocols to ensure security when using classified data.
- Policies should be made regarding how long data is retained and how it will be securely disposed of when it is no longer needed.
