The fifth call for evidence addresses the recommendation for ICO guidance on the allocation of accountability in AI as a Service (AIaaS) contexts made in Sir Patrick Vallance’s Pro-innovation Regulation of Technologies Review.
The allocation of accountability is complicated because of the different ways in which generative AI models, applications and services are developed, used and disseminated, but also the different levels of control and accountability that participating organisations may have.
The ICO is interested in additional evidence on how this works in practice. In the meantime, it provides a summary of our current analysis, the policy positions we want to consult on and some examples which show how this analysis could be applied in practice.
The deadline for submissions is 18th September 2024.
Enjoy reading our blog? Help us reach 10,000 subscribers by subscribing today!
Saudi Arabia’s Personal Data Protection Law (PDPL) comes into force on 14th September 2024 and regulates the collection, handling, disclosure and use of personal data. Like many data protection laws around the world, including the UK GDPR, the PDPL contains strict rules about when personal data can be transferred outside the jurisdiction.
Article 29 of PDPL states that when transferring personal data outside Saudi Arabia, Data Controllers must ensure that that the receiving country or international organisation has an appropriate level of personal data protection. The Regulation on the Transfer of Personal Data Outside the Kingdom (Transfer Regulation) provides more detail about the rules to be followed upon transfer. Two of the circumstances where personal data transfers are allowed outside the Kingdom is when Standard Contractual Clauses are used and where personal data is transferred among a group of multinational entities, provided that the Data Controller and its entities abide by Binding Common Rules (BCRs).
SCCs and BCRs are vital safeguards, defining the obligations of Data Controllers and Data Processors involved in cross-border data transfers, thereby ensuring compliance and protecting personal data even beyond the Kingdom’s borders. Organisations doing business in the Middle East need to carefully consider the impact of the rules on international transfers under the PDPL. Thought must also be given to the appointment and training of a suitably qualified DPO.
Like the monster plant in Little Shop of Horrors, Generative AI has an insatiable appetite; for data though rather than food. Generative AI applications, like ChatGPT and Midjourney, need a constant supply of data to train (and improve) their output algorithms. In the early days of AI development, this data came from public sources especially the internet. However, this “data scraping” was not without legal obstacles.
Where personal data is used to train AI models, of course GDPR applies. The transparency provisions and the requirement for a legal basis are of particular importance. In 2022, the Information Commissioner’s Office (ICO) issued a fine of more than £7.5 million to Clearview AI for GDPR breaches in the way it compiled its online database containing 20 billion images of people’s faces and data scraped from the internet. The company did manage to successfully appealthe fine but the ICO, and other GDPR regulators in the EU, have issued clear warnings to AI companies to ensure they comply with GDPR.
To satisfy Generative AI’s demand for more data, AI developers have been striking deals with tech companies for access to the latter’s user data. This includes data generated by users whilst using popular websites and apps. In February it was reported that Tumblr and WordPress.com are preparing to sell user data to Midjourney and OpenAI. And (surprise surprise) Meta and Alexa have exploited user data, in the past, to train their AI models.
Elon Musk’s X (formerly Twitter) came under fire recently after it started collecting and using its users’ data, including their posts, to train X’s Grok AI model. This was allegedly done without notifying X users or asking for their consent. In June, the Irish Data Protection Commission (DPC), X’s Lead Supervisory Authority, made an urgent application under Section 134 of the Irish Data Protection Act 2018. This allows the DPC, where it considers there is an urgent need to act to protect the rights and freedoms of data subjects, to request the High Court for an order requiring the data controller to suspend, restrict or prohibit the processing of personal data.
This was the first time that any Lead Supervisory Authority has taken such action, and the first time that the DPC has sought to utilise its powers under Section 134. The DPC said the application was made to protect the rights and freedoms of X’s EU/EEA users, and came after extensive engagement between the DPC and X regarding its AI model training. Last week, the DPC announced that X had agreed to suspend its processing of the personal data contained in the public posts of X’s EU/EEA users which it processed between 7 May 2024 and 1 August 2024, for the purpose of training its AI model.
But this agreement is not the end of X’s privacy woes. Noyb, a privacy advocacy group headed by Max Schrems, has filed nine more GDPR complaints with regulators across Europe alleging that X appears to have breached a number of other GDPR provisions including the GDPR principles and the transparency rules. Several other major tech firms have also faced regulatory setbacks in Europe over privacy issues raised by their AI plans. In June Meta announced that it was pausing its plan to process user posts and images on Facebook and Instagram to train its AI tools after a number of GDPR complaints. LinkedIn was also the subject of a similar complaint by consumer organisations.
AI is a priority for the ICO. It’s existing guidance on AI explains how to apply the concepts of data protection law when developing or deploying AI and the AI toolkit helps organisations identify and mitigate risks during the AI lifecycle. The ICO consultation series on generative AI and data protection closed in June.
The training of Generative AI does not just pose GDPR compliance issues. In December last year, the New York Times announced it was suing OpenAI and Microsoft for copyright infringement. The lawsuit claimed the “unlawful use” of the paper’s “copyrighted news articles, in-depth investigations, opinion pieces, reviews, how-to guides, and more” to create AI products “threatens The Times’s ability to provide that service”.
Please subscribe to this blog and help us to get to 10,000 subscribers.
The EU AI Act comes into force today although not all the provisions will become enforceable straight away.
The Act sets out comprehensive rules for AI applications, including a risk-based system to address potential threats to health and safety, and human rights. It will ban certain AI applications that pose an “unacceptable risk,” including real-time and remote biometric identification systems such as facial recognition. Additionally, it will impose strict obligations on those considered “high risk,” encompassing AI used in EU-regulated product safety categories, for example, cars and medical devices. These obligations include adherence to data governance standards, transparency rules, and the incorporation of human oversight mechanisms.
February 2025: Chapters I (general provisions) & II (prohibited AI systems) will apply
August 2025: Chapter III Section 4 (notifying authorities), Chapter V (general purpose AI models), Chapter VII (governance), Chapter XII (confidentiality and penalties), and Article 78 (confidentiality) will apply, except for Article 101 (fines for General Purpose AI providers)
August 2026: the whole AI Act applies, except for Article 6(1) & corresponding obligations (one of the categories of high-risk AI systems)
August 2027 – Article 6(1) & corresponding obligations apply.
In the UK, despite media reports, the King’s Speech did not include a bill to regulate AI. The King said that the government would “seek to establish the appropriate legislation to place requirements on those working to develop the most powerful artificial intelligence models”. Expect a government consultation to be announced soon.
Our AI Act workshop will help you understand the new law in detail and its interaction with the UK’s objectives and strategy for AI regulation.
Friday’s global IT outage, caused by the CrowdStrike software update, is likely to continue to have an impact on critical systems this week. NHS England says that health service IT systems are back online but has warned that there may still be disruption, particularly with GP services who may need time to rebook appointments.
The question now for Data Protection Officers, in the UK and EU, is whether the CrowdStrike outage is a personal data breach under the UK and EU GDPR (hereinafter referred to as GDPR, since the law is effectively the same). If it is, it may need to be reported to the data protection regulator (in the UK, the Information Commissioner’s Office(ICO)) and even to the individuals whose services have been affected e.g. patients, customers and service users.
Before making this decision, DPOs need to go back to first principles. The law on reporting data breaches is set out in Article 33 and 34 of the GDPR. Article 33 states:
“In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the Commissioner , unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification under this paragraph is not made within 72 hours, it shall be accompanied by reasons for the delay.”
The term “personal data breach” has a very specific meaning which is set out by Article 4:
“a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.”
So to even start to consider whether an incident needs to be reported, a DPO needs to consider whether it is “a breach of security” and, if it is, whether this breach has led to the consequences set out in Article 4 above i.e. accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
In deciding this question, many have jumped straight to focussing on the consequences of the incident; because it led to many organisations unable to access critical data which had a considerable impact on individuals; for example, GPs being unable to access patient medical records. They say it is a personal data breach due to lack of availability of data. They rely on the ICO guidance which states:
“A personal data breach can be broadly defined as a security incident that has affected the confidentiality, integrity or availability of personal data. In short, there will be a personal data breach whenever any personal data is accidentally lost, destroyed, corrupted or disclosed; if someone accesses the data or passes it on without proper authorisation; or if the data is made unavailable and this unavailability has a significant negative effect on individuals.”
“It is well established that “access” is fundamentally part of “availability”. See, for example, NIST SP80053rev4, which defines “availability” as: “Ensuring timely and reliable access to and use of information,” … CNSSI-4009 also refers to: “Timely, reliable access to data and information services for authorized users”. … ISO/IEC 27000:2016 also defines “availability” as “Property of being accessible and usable upon demand by an authorized entity”
For an alternative view on the meaning of “loss” in Article 4, it is worth reading Jon Baines personal blog.
Few have considered the first aspect of the definition of a personal data breach, set out in Article 4 i.e. Is the CrowdStrike incident a “breach of security”? The cause of the incident has been identified as an update CrowdStrike made to its cloud-based software product called Falcon. When CrowdStrike pushed the update, which interacts with other parts of computer systems and software like Microsoft’s Windows products, it caused a malfunction that disabled those systems and their widely used pieces of software the world over. In short the outage was caused by a planned software update which went wrong; ironically the software intended to protect against crashes and disruptions in vital computer systems ended up crashing them!
In a post on X, formerly Twitter, Geroge Kurtz, president and CEO of CrowdStrike said:
“ This is not a security incident or cyberattack.The issue has been identified, isolated and a fix has been deployed.”
Some would say, “he would say that wouldn’t he!” Our point is, when deciding whether to report an incident as a personal data breach, rather than first focussing on the consequences, DPOs should first consider whether it is a “breach of security” or, perhaps in this case, planned maintenance (albeit which went disastrously wrong). EDPB guidance says:
“To be clear, where personal data is available due to planned maintenance being carried out this is not a “breach of security” as defined in Article 4(12).”
Of course even if the CrowdStrike incident is not a reportable data breach, this does not mean that there will be no repercussions for organisations who suffered an outage. The GDPR includes stand-alone obligations on Data Controllers to ensure they have technical and organisational measures to keep personal data safe and secure.
A bill to regulate Artificial Intelligence(AI) will be one of 35 bills to be included in the King’s Speech tomorrow according to the Financial Times. The Bill will seek to enhance the legal safeguards surrounding the most cutting-edge AI technologies, according to people briefed on the plans.
The 2024 Labour election manifesto contained pledges to support the development of AI. It stated Labour would ensure their “industrial strategy supports the development of the AI sector and removes planning barriers to new datacentres.” The Bill seeks to follow through on the manifesto pledge to regulate AI but only in some cases:
“Labour will ensure the safe development and use of AI models by introducing binding regulation on the handful of companies developing the most powerful AI models and by banning the creation of sexually explicit deepfakes.”
The Bill is likely to focus on the production of large language models (LLMs), the general-purpose technology that underlies AI products such as OpenAI’s ChatGPT. It is a departure from the previous government’s approach which was not to place AI regulation on a statutory footing but to make use of “regulators’ domain-specific expertise to tailor the implementation of the principles to the specific context in which AI is used.”
The new Bill follows the EU’s tougher approach. The EU AI Act was published in the Official Journal of the EU last Friday (July 12th 2024) firing the gun for the enforcement countdown. It will be on the EU statute books on 1st August 2024 and then become enforceable in stages.
The main provisions of Act can be read here. In summary, the Act sets out comprehensive rules for AI applications, including a risk-based system to address potential threats to health and safety, and human rights. The Act will ban certain AI applications that pose an “unacceptable risk,” including real-time and remote biometric identification systems such as facial recognition. Additionally, it will impose strict obligations on those considered “high risk,” encompassing AI used in EU-regulated product safety categories, for example, cars and medical devices. These obligations include adherence to data governance standards, transparency rules, and the incorporation of human oversight mechanisms.
It will be interesting to read the text of the new Bill when it is published especially how it overlaps with the provisions on the UK GDPR.
Our AI Act workshop will help you understand the new law in detail and its interaction with the UK’s objectives and strategy for AI regulation.
The EU AI Act was published in the Official Journal last Friday (July 12th 2024) firing the gun for the enforcement countdown.
In summary, the Act sets out comprehensive rules for AI applications, including a risk-based system to address potential threats to health and safety, and human rights. The Act will ban certain AI applications that pose an “unacceptable risk,” including real-time and remote biometric identification systems such as facial recognition. Additionally, it will impose strict obligations on those considered “high risk,” encompassing AI used in EU-regulated product safety categories, for example, cars and medical devices. These obligations include adherence to data governance standards, transparency rules, and the incorporation of human oversight mechanisms.
For a more detailed guide read the document produced by lawyers Stephenson Harwood.
Here are the key dates for your calendar:
August 1st, 2024: The AI Act will enter into force
February 2025: Chapters I (general provisions) & II (prohibited AI systems) will apply
August 2025: Chapter III Section 4 (notifying authorities), Chapter V (general purpose AI models), Chapter VII (governance), Chapter XII (confidentiality and penalties), and Article 78 (confidentiality) will apply, except for Article 101 (fines for General Purpose AI providers)
August 2026: the whole AI Act applies, except for Article 6(1) & corresponding obligations (one of the categories of high-risk AI systems)
August 2027 – Article 6(1) & corresponding obligations apply.
Our AI Act workshop will help you understand the new law in detail and its interaction with the UK’s objectives and strategy for AI regulation.
So now we have a Labour Government, what can we expect vis a vis information governance?
Data Protection
Before the snap election was announced, most information professionals were getting ready to implement the Data Protection and Digital Information Bill which was making its way through the House of Lords and was set to be passed in July. The Bill would have amended the UK GDPR to make it, according to the Government, “a tailored, business-friendly British system of data protection.” The election put an end to the Bill which failed to make it through Parliamentary “wash up” stage.
The Labour Party had nothing to say on this topic in its manifesto, apart from a pledge to “improve data sharing across services, with a single unique identifier, to better support children and families.” It also said it intends to create a “National Data Library” to bring together existing research programmes and “help deliver data-driven public services”.
It is still likely that some Data Protection law reform will be undertaken by the new Government. Some of the less controversial aspects of the Bill, such as making it easier to use personal data for research and re organisation of the ICO, could return. But we are not going to see wholesale reform in the first few years, especially as the Government will not want to jeopardise the UK’s EU adequacy status which is due for renewal by June 2025.Thankfully the introduction of digital ID cards have also been ruled out, after Tony Blair suggested they could help control immigration.
AI Regulation
The rapid advancements in Artificial Intelligence (AI), and their potential to impact on people’s rights and freedoms, has led to calls for better regulation. The Labour manifesto contains pledges to support the development of AI. It says Labour will ensure their “industrial strategy supports the development of the AI sector and removes planning barriers to new datacentres.” There is also a pledge to regulate AI but only in some cases:
“Labour will ensure the safe development and use of AI models by introducing binding regulation on the handful of companies developing the most powerful AI models and by banning the creation of sexually explicit deepfakes.”
But there is no real detail about what AI regulation will look like under Labour. Perhaps the party will take the lead from the TUC ,which produced an AI Bill in April, or the EU which recently passed the EU AI Act.
Online Safety
The Labour manifesto states that the party will “build on” on the Online Safety Act, “bringing forward provisions as quickly as possible, and explore further measures to keep everyone safe online, particularly when using social media”. Labour also intends to give coroners “more powers to access information held by technology companies after a child’s death” and to create a “Regulatory Innovation Office” which will help existing regulators “update regulation, speed up approval timelines and co-ordinate issues that span existing boundaries”.
Freedom of Information
Freedom of Information laws are always popular with opposition parties who wish to critically assess government policies or discover uncomfortable truths (at least for the Government) about their implementation. But in government such laws are often seen as an inconvenience (just ask Tony Blair). None of the parties made any specific mention of FOI in their manifestos. This is surprising; the Labour Party has been arguing for many years that private contractors delivering public services should be subject to FOI laws. Perhaps they will look again at strengthening FOI.
This and other data protection developments will be discussed in detail on our forthcoming GDPR Update workshop.
NHS England has now confirmed its patient data, managed by blood test management organisation Synnovis, was stolen in a ransomware attack on 3rd June. According to the BBC some of that data has been published on the dark web by the hackers.
On 4th June 2024, the Independent reported that two major London hospital trusts had to cancel all non-emergency operations and blood tests due to a significant cyber attack. Both King’s College Hospital Foundation Trust and Guy’s and St Thomas’ Hospitals Foundation Trusts have seen their pathology systems compromised by malware.
Synnovis, the service provider responsible for blood tests, swabs, bowel tests, and other critical services for these hospitals, was targeted in this attack. The impact was widespread, affecting NHS patients across six London boroughs.
It now transpires that, Qilin, a Russian cyber-criminal group, shared almost 400GB of private information on their darknet site on Thursday night. A sample of the stolen data seen by the BBC includes patient names, dates of birth, NHS numbers and descriptions of blood tests. NHS England said in a statement that there is “no evidence” that test results have been published, but that “investigations are ongoing”.
The Information Commissioner’s Office said in statement:
“While we are continuing to make enquiries into this matter, we recognise the sensitivity of some of the information in question and the worry this may have caused.
“We would urge anyone concerned about how their data has been handled to check our website for advice and support, as well as visiting NHS England’s website.”
Article 15 of the UK GDPR gives a Data Subjects, a right to receive all the information held about them by a Data Controller. In addition, they have a right to receive information on “the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations.” Does the Data Controller have a choice whether to disclose the recipients or categories of recipient?
In a recent High Court case, Mark Harrison v Alasdair Cameron and Alasdair Cameron Limited (2024), Mrs Justice Steyn ruled that Data subjects are entitled to know the identities of the recipients of their personal data, not just the categories of recipients. Steyn J also clarified the nature and scope of the Subject Access Right (SAR).
Background
The case involved Mr. Cameron, a director of a gardening company, and Mr. Harrison, a wealthy homeowner involved in property investment. Mr. Cameron recorded threatening calls from Mr. Harrison during a dispute and shared these recordings with family members and others. These recordings eventually reached Mr. Harrison’s business peers, allegedly causing his company to lose a significant property acquisition.
Mr. Harrison submitted SARs to Mr. Cameron and his company, ACL, requesting details of who received his personal data. The requests were initially denied on several grounds:
Mr. Cameron argued that he was processing the data in a purely personal context, which would be outside the scope of the UK GDPR.
It was claimed that Mr. Cameron, as an individual, was not a Data Controller under the UK GDPR.
ACL invoked an exemption, arguing that disclosing the identities of recipients would involve sharing information about other individuals without their consent.
Court’s Findings
The court disagreed with Mr. Cameron’s assertion that the data processing was purely personal. It ruled that he acted as a director of ACL, meaning the processing was within a professional context and thus subject to the UK GDPR.
Despite Mr. Cameron’s role in processing the data, the court ruled that he was not a Data Controller. Following legal precedents, the court said that a company director, acting in that capacity, is not a controller but the company itself is.
Despite Mr. Harrison’s entitlement in principle to know the identities of recipients, the court decided against disclosing this information. Mr. Harrison had a history of making numerous SARs and exhibited intentions to pursue legal actions beyond data protection law. ACL argued that revealing the recipients would expose them to significant risks of harassment and legal threats from Mr. Harrison. The court agreed, highlighting that the potential for hostile litigation was a relevant factor in balancing interests. The motive behind a SAR can be considered, especially when there is a need to protect third parties from harm that extends beyond the scope of data protection rights.
The High Court’s judgment brings clarity to the SAR process, emphasising the Data Subject’s right to specific recipient information and reinforcing the limited purpose of SARs in protecting privacy rights. It also introduces a nuanced approach to balancing the rights of the requester against potential risks to third parties, particularly when the requester’s motives suggest potential misuse of the information.
Our upcoming Handling SARs course can help you deal with complex subject access requests. Places are limited so book early to avoid disappointment.
