A ruthless introduction to AI data protection and ethics…
There is no way we can cover all the nuances of data protection and ethics, that is for multiple PhD projects at least. I will however try and distil our approach and experince here at Bristol.
When it came to data protection, I asked myself some internal questions (not reflective of UoB policy or approach) that were the thoughts of this author. Do I personally know enough about data protection law + contractual law between data processors and data controllers? Do I have the capacity to learn enough to make a sensible decision? Is it my decision to make? I broadly decided that the answer to all of the above questions was some version of ‘no’. This left me asking, do I personally feel comfortable sending student reports outside of our direct control to AI. This is where contractual stuff / law etc. collide in a way that I was not going to have answers to. So I asked a different question:
Is it even necessary to take the risk of sending data anywhere outside of our organisation? After consulting with my AI counterpart Rich (he is real, just the expert in AI…) I was informed that we could pull it off locally, which went a long way to mitigating the risk. Data stays within our already agreed data centres and arrangements with our enterprise providers, the usual protections that the institution puts in place remain, and I feel quite a bit happier being able to snooze at night.
Does that mean all data protection and ethical considerations have been met? Alas no, but we help achieve quite a few ‘yeses’ with that approach, and again received, meaningful engagement from IT’s James Bingham (see day 2) which led to the Data Protection and Impact Assessment (DPIA) process. Whilst the form might have felt about as exciting as it looks, slowing down to think and understand precisely what is classed as personal data, how to handle it, and receiving expert advice from the university’s legal team was both an informative learning experience and helped ensure we put in place robust procedures.
Leave a Reply