Dr W Kuan Hon

UK GOVERNMENT AI REGULATION PROPOSALS - REGULATOR'S STRATEGIES 13 Regulator strategies have been published at 1st May 2024, including those of the Information Commissioner's Office, Competition and Markets Authority, Ofcom and Equality and Human Rights Commission The regulators task, pursuant to the Government response to the public consultation, was to publish their strategic approaches to AI incorporating the regulatory principles (which are based on the OECD.AI trustworthy principles). The Government said 'The updates provide important information about the way the UK’s regulators are approaching the risks and opportunities of AI within their spheres of responsibility, the measures they are taking to upgrade their capabilities, and their future plans. Transparency on these points will be critical for maintaining the confidence in the UK’s regulatory approach and the government has encouraged other regulators to consider publishing similar updates.' The Anekanta®AI team have been unpacking the varying approaches since they were published, and which use current regulatory instruments for AI. For example, considering the ICO document, the data protection regulations leave some gaps and this may be why the strategy cites over 60 sources of additional information. Additionally, the EHRC, the regulator for 'fairness' says it has no funding or resources available to meet the Government's requirements. We see the positives, as it is progress towards an emerging common ground, and we look forward to seeing further instruments and Government guidance. The UK approach is moving forward and businesses clearly need a great deal of additional support to understand how to adopt the proposed UK regulatory systems; which may be in addition to the EU AI Act and US Executive Order requirements for international organisations and british companies wishing to grow through export. Anekanta®AI are specialised in helping businesses comply with their obligations; from voluntary Responsible AI principles to meeting legal requirements and preparing for their AI Management System implementation. For more information visit our web site: www.anekanta.co.uk or contact us via LinkedIn messaging or our contact form, https://lnkd.in/eibBt9gr https://lnkd.in/dDA2zwKv #responsibleAI #BSISOIEC42001 #EUAIAct #Anekanta #bs9347 #AI #euaiact #aigovernance #airiskmanagement #biometrics #facilitiesmanagement #smartcities #cni #aviation #artificialintelligence #retail #airegulation #securityindustry #riskintelligence #riskmanagement #oecd #aidefinition #facialrecognition #algorithmicbias #aimanagementsystem #grc #aiassurance #aiethics #ai #highriskai

2

Looking forward to reading this paper - 'High-fidelity synthetic data applications and privacy considerations' - from Puja Myles and the team, and not just because it references the PHG Foundation report! It will be published in the Journal of Data Protection and Privacy vol 6.4. Our report, 'Are synthetic health data 'personal data'? https://lnkd.in/eeFiir8c was published last year. In it we make three recommendations including: - regulators and policymakers should prioritise determining what form of regulation is appropriate for this sector and how it fits within the overall regulatory framework. - synthetic data developers, researchers, regulators and policymakers should seek to achieve greater clarity, and reach consensus on appropriate standards and approaches to assessing identifiability of specific synthetic data generation methods, utilising quantitative metrics as far as possible. These recommendations were based on our extensive analysis of the legal and regulatory frameworks and related commentaries which found that regulators and legal commentators currently approach synthetic data with caution. The default approach is to presume that synthetic data generated from real patient data are ‘personal data’ unless it can be shown that risk of identification has been reduced to remote levels. While this safeguards privacy, it may limit research, testing and ultimately translation into patient care.

4

...if only we were free... Freedom has been demolished and lives only in our memories - the digiverse has ingested it completely. While I do appreciate the level at which we can perform forensic analysis today, the aggregation of data to look for crimes violates the majority of all laws and regulations currently implemented globally. But then who am I (who are we) but a cog in the wheel of time. I wish all of those attending the best, and if you are a researcher in this area... answer this: "How do we properly engage in the aggregation of data, analyze it, forensically dive down, and formulate possible/actual crimes without violating the true rights of privacy and freedom for those caught in the "dragnet" inadvertently?

1

1 Comment

The Information Commissioner’s Office has published its fourth call for evidence in its Generative AI consultation series on ‘engineering individual rights into generative AI models’. The draft guidance asserts that, in order to meet the obligation under Article 14(5)(c) UK GDPR to “take appropriate measures to protect the data subject’s rights and freedoms and legitimate interests, including making the information publicly available” in circumstances where notifying affected data subjects individually would “prove impossible or would involve a disproportionate effort”, “Vague statements around data sources (eg just ‘publicly accessible information’) are unlikely to help individuals understand whether their personal data may be part of the training dataset or who the initial controller is likely to be”. Read our blog post on why generative AI model developers should regenerate their privacy policies to ensure compliance: https://lnkd.in/eN6mxANy Information Commissioner's Office #DataProtection #PersonalData #UKGDPR #DPA2018 #DataProtectionAct2018 #GDPR #Article14UKGDPR #PrivacyPolicy #PrivacyNotice #Transparency #DataSubjectRights #AI #ArtificialIntelligence #AIRegulation #GenerativeAI #LLMs #LargeLanguageModels #GDPR #Article14GDPR #WebScraping #Copyright #IntellectualProperty #IPRs #IntellectualPropertyRights #CopyrightInfringement #DataPrivacy

FINANCIAL CONDUCT AUTHORITY - AI UPDATE The UK’s Financial Conduct Authority has published an update on its approach to AI as a technology-agnostic, principles-based and outcomes-focused regulator, following the UK Government’s publication of its AI Regulation White Paper. The White Paper set out five principles which the FCA has helpfully expanded upon in its guidance, including how they fit with its wider Principles for Business and other requirements: ·      AI systems should function in a robust, secure and safe way throughout the AI life cycle, and risks should be continually identified, addressed and managed; ·      AI systems should not undermine the legal rights of individuals or organisations, discriminate unfairly against individuals or create unfair market outcomes. Actors involved in all stage of the AI lifecycle should consider descriptions of fairness that are appropriate to a system’s use, outcomes and the application of relevant law; ·      AI systems should be appropriately transparent and explainable; ·      Governance measures should be put in place to ensure effective oversight of the supply and use of AI systems, with clear lines of accountability established across the AI life cycle; and ·      Where appropriate, users, impacted third parties and actors in the AI life cycle should be able to contest an AI decision or outcome that is harmful or creates material risk of harms. It also explains where the Authority's work will focus over the coming 12 months, including: ·      Developing its understanding of how AI is deployed in UK financial markets to ensure that any potential future regulatory interventions are effective, proportionate and pro-innovation and so the Authority can respond promptly to any emerging issues at specific firms; ·      Continuing to collaborate with the Bank of England, PSR, other regulators (including international partners and fora) regulated firms, civil society and academia; ·      Testing the design and impact of AI on consumers and markets safely and responsibly, potentially within an AI sandbox; ·      Investing in its own use of AI technologies, including to proactively monitor and surveil markets, generate synthetic data, analyse and summarise text and potentially triage decisions. The FCA notes that the regulatory framework needs to adapt, evolve and respond to the challenges and risks that technology is bringing. The safe and responsible deployment of AI in UK financial markets in the interests of consumers and the markets it regulates is therefore one of its priorities. The guidance is an interesting read for regulated businesses already working or considering working with AI technology. Even for firms outside of the UK, the FCA’s approach is a strong indication of how other regulators may choose to respond. #AI #regulation #financialservices #JerseyAIForum

11

My submission to the UK Competition and Markets Authority about Google/Chrome Privacy Sandbox. I initially put the idea forward in 2021, now it's getting traction, and I provide some details. It's about privacy, competition, web, ad technology. Transparency and governance are a must. https://lnkd.in/dA7DK3Dy #privacy #competition #dataprotection #web #chrome

7

Wondering about the key dates around the EU AI Act? Check out this blog by my colleagues Marcus Evans and Rosie Nance. Norton Rose Fulbright

18

In our latest blog, our Head of Consultancy Louise Brooks gives a refresher on the lawful bases for processing, how consent compares to other lawful bases and consent management. Read it here: https://lnkd.in/e2tRd9SD #GDPR #consent #consentmanagement

2

A project using #AI in #law #enforcement is among those to have won shares of a new round of funding from UK Research and Innovation under its #Responsible AI UK programme - one of a number of initiatives receiving shares of £12m to address the challenges of rapid advances in AI. The PROBabLE Futures project has received nearly £3.5m to support its work on the uncertainties of using AI in law enforcement. Its lead, Prof. Marion Oswald, MBE from Northumbria University, said that AI can help #police and #courts tackle an overload of digital data and unknown risks and increase efficiencies: “The key problem is that AI tools take inputs from one part of the law enforcement system but their outputs have real world, possibly life changing, effects in another part – a miscarriage of justice is only a matter of time... Our project works alongside law enforcement and partners to develop a framework that understands the implications of uncertainty and builds confidence in future probabilistic AI, with the interests of justice and responsibility at its heart.” #AI4Good https://lnkd.in/dahtkmrb

1

The latest update from the data protection team explores the UK Information Commissioner's Office's strategic approach to regulating AI. Please click below to read the full update. #Technology #DataProtection

34

AI regulation does not need to be restrictive. As the ICO have outlined, with the correct evaluation, AI can be used safely, even when processing data in relation to those under the age of 18. Full article: https://lnkd.in/e_RHT545 #AnsonEvaluate #AE #Compliance #Evaluate #Consultancy #Training #Assessment #Data #Innovation #ArtificialIntelligence #AI #IOT #Transparency #bias #LLM #Regulation #ICO

3

📲 Data Protection Reform in the UK Data protection law is in a constant state of flux globally, driven by new guidance, cases, enforcement action, and emerging technologies (hello, generative AI!). The UK is no exception, especially post-Brexit. The journey began with the Data Protection and Digital Information Bill under Boris Johnson. It evolved through various stages and names, finally becoming the Data Protection and Digital Information Bill 2023. Despite much anticipation, progress stalled. There was hope it would pass before the summer recess, but... On 22 May, Rishi Sunak called for an election on 4 July. By 23 May, it was clear the Bill wouldn’t be part of the government's ‘wash-up’ session, leaving commentators to declare it “dead” for now. What’s next? If Labour wins, they might not prioritise data protection reform. However, there's a rumour of potential Labour-led reform this Autumn, which could also address AI. Stay tuned! Follow us on LinkedIn for the latest updates on this ever-changing landscape! 📲🔍 Click here for more Data Protection news: https://lnkd.in/enPmyRyf Louise Thompson Sarah Wheadon Kate S. #DataProtection #UKGDPR #UKLaw #TechNews #GenerativeAI #StayInformed

2

New Release: Scoping Paper on Decentralised Autonomous Organisations (DAOs) ✨ Today, we are excited to share newly published scoping paper on #Decentralised #Autonomous #Organisations (DAOs), which aims to explore the characterisation and current issues surrounding #DAOs to inform potential future law reforms and innovations. 🔍 What is a DAO? DAOs represent a novel type of internet-based collaborative organisation, coordinating people and resources through rules encoded in computer code. Integral to the “crypto ecosystem,” DAOs manage billions in assets and have been involved in significant litigation in the US, raising concerns about participant liabilities. Despite their growing prominence, DAOs are challenging to define both practically and legally, as the term encompasses a wide range of arrangements. This paper seeks to elucidate what constitutes a DAO and discusses the diverse structures and ideologies they embody. This scoping paper aims to raise awareness among government bodies, market participants, and advisors about the implications and risks associated with various DAO structures. 🔗 Read the Full Paper: https://lnkd.in/eCpRSTKr We hope this paper will stimulate informed discussions and help shape the future legal landscape for DAOs in England and Wales. Your feedback and insights are welcome! #DAOs #Blockchain #Crypto #LawReform #LegalTech #Innovation #LawCommission #SarahGreen https://lnkd.in/eHbJBuVt

2

𝗪𝗵𝗲𝗻 𝗶𝘀 𝗶𝘁 𝗼𝗸 𝗳𝗼𝗿 𝗮𝗻 𝗼𝗿𝗴𝗮𝗻𝗶𝘀𝗮𝘁𝗶𝗼𝗻 𝘁𝗼 𝘀𝗵𝗮𝗿𝗲 𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗱𝗮𝘁𝗮? In truth, it is not always clear cut. This article, written by Principal Data Protection Consultant Sandy May, will help your organisation 𝘂𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱 𝗱𝗮𝘁𝗮 𝘀𝗵𝗮𝗿𝗶𝗻𝗴 𝗯𝗲𝘀𝘁 𝗽𝗿𝗮𝗰𝘁𝗶𝗰𝗲𝘀 within the UK GDPR, and the steps to take to make an informed decision when it comes to sharing personal data. So, if your organisation regularly shares data, or is embarking on a project which will involve data sharing, or you would like to understand the steps to take to ensure you are prepared for sensitive situations within the workplace, here are some important things for you to consider. #datasharing #gdpr #dataprotection #dpo #dataprotectionofficer #b2b https://lnkd.in/ekMrkaPG

12

LIVE WEBINAR: How to Adopt AI in Compliance with the GDPR 4th June | 3pm Join our consultant Mark James for: • How existing data protection laws such as the GDPR regulate AI use; • Assessing risk and mitigation strategies through DPIAs (data protection impact assessments); • Key data protection pitfalls to look out for when assessing AI tools; • Privacy by design as a concept for organisations striving for innovation; and • Our recommendations for AI success. Sign up here: https://lnkd.in/dmn-dnTW (Even if you can't attend, you'll still receive a copy of the slides and recording) #GDPR #dataprotection #AI

12

Another angle on the EU AI Act as published! We probably all know the Act was published today and the schedule for incoming obligations - especially the first general obligation, for AI Literacy, affecting all providers and deployers of AI systems from August 2025. I thought I would check if anything has changed since March in the "legal-linguistic finalisation". I attach an informal comparison. Most of the changes are consistency, clarity, cross-references, etc. But there are a few instances of substantive new wording. Top of my list follows (limited by the LinkedIn wordcount). ➡ The effect of Article 2(12) has been reversed (as some predicted). It now says that that Act does *NOT* apply "to AI systems released under free and open-source licences, unless they are placed on the market or put into service as high-risk AI systems or as an AI system that falls under Article 5 or 50." ➡ The penalties under Article 99(4) now apply to "non-compliance" with Article 5, not just to "non-compliance of an AI system". (That could have been an interesting loophole ...). ➡ the definition of "AI system" has been tweaked! I doubt the changes are material ... but then, why change it now? ➡ "putting into service" no longer specifically mentions "by the provider". That might have conflicted with obligations of other actors who put AI into service, such as product manufacturers. ➡ The definitions of "notified body", "CE marking", "national competent authority" and "profiling" have also been changed. ➡ The prohibition on subliminal techniques now requires causing harm or being "reasonably" likely to cause harm. ➡ Tidying up of the interaction between the AI Act and other EU legislation relating to safety components - see Recital (50) and Article 2(2). ➡ The words "To ensure consistent implementation, it is appropriate to empower the Commission to adopt implementing acts on the application of the provisions on the labelling and detection of artificially generated or manipulated content" have been deleted from Recital (135). The intention seems to be to attempt codes of practice first (see Article 50(7)). (Henry Ajder) ➡ In Recital (169) the decisions of the Commission under the Act are now expressly subject to "the unlimited jurisdiction of the Court of Justice with regard to penalties pursuant to Article 261 TFEU". ➡ Articles 40, 41, 53 and 55 regarding standardisation, specifications, codes and deemed compliance have been tidied up quite a bit. ➡ Articles 58-60 (Sandboxes) have been tweaked regarding the application to prospective provider/provider/prospective deployer/deployer. ➡ Article 92(5): representatives of providers are expressly required to supply information for evaluations conducted by the AI Office. Anything important to add?

201

14 Comments