What's the issue?

Although the news isn't being completely written by AI yet, it does seem to be pre-occupied by it.  With hugely disruptive products starting to go mainstream, the ICO has been asked to update its guidance on AI and Data Protection.

What's the development?

In line with its ICO25 strategy, the ICO has published updated guidance on AI and Data Protection, following requests for clarification on fairness requirements when using AI.  The guidance has been restructured and a number of sections have been expanded or added.  It covers:

• accountability and governance implications of using AI
• transparency
• lawfulness
• accuracy and statistical accuracy
• fairness (including bias and discrimination and the impact of Article 22 UK GDPR on fairness)
• individual rights.

What's new?

• The guidance contains new content on things to consider as part of a DPIA.
• There is a new stand-alone chapter looking at the transparency principles as they apply to AI although the main guidance on transparency and explainability is included in the existing guidance on Explaining Decisions Made with AI.
• The section on lawfulness has been moved into a stand-alone chapter with content added on AI and inferences, affinity groups and special category data.
• The section on accuracy and statistical content has been moved to a stand-alone chapter but the content has not changed.

Similarly the fairness section is now stand-alone and this has been added to in order provide information on:

• data protection's approach to fairness and how that applies to AI with a non-exhaustive list of legal provisions to consider
• the difference between fairness, algorithmic fairness, bias and discrimination
• high level considerations when thinking about evaluating fairness and inherent trade-offs
• processing personal data for bias mitigation
• technical approaches to mitigate algorithmic bias
• how solely automated decision-making and relevant safeguards are linked to fairness and key questions to ask when considering Article 22 of the UK GDPR
• a new Annex A on fairness in the AI lifecycle from problem formulation to decommissioning, including an explanation of different sources of bias that can lead to unfairness and possible mitigation measures
• an update to the glossary with new definitions.

What does this mean for you?

The ICO says the updated guidance is in line with the government's ambitions to adopt a pro-innovation approach to AI with embedded principles of fairness.  The ICO expects further updates to the guidance will be required to keep up with technological and legislative developments so the guidance will need to be consulted on a regular basis.

The important take away from this guidance as with so much ICO guidance, is that it is principles based.  Getting these principles right from the outset is likely to help future proof the use of AI as far as possible in a rapidly evolving environment. It's also helpful to remember that while the UK does not have legislation equivalent to the EU's draft AI Act, the use of AI is still being looked at carefully by UK regulators in the context of the existing legal framework.