ISACA Now Blog 2019 AI or GDPR

AI vs. GDPR

Proposed Suggestions

Reference GDPR Provisions

Accuracy of automated decision-making

Obtain human intervention and do not rely solely on a machine
Use data accuracy analysis technology—monitor the AI agent performance and use ML to increase the accuracy
Conduct a data protection impact assessment (DPIA) and trustworthy AI assessment
Conduct rigorous testing, e.g., penetration tests and cybersecurity control assessments
Ensure traceability, auditability and transparent communication on system capabilities

Article 4(4), Article 9, Article 12, Article 13, Article 14, Article 15, Article 21, Article 22, Article 35(1) (3)

The Right to Erasure

Use something like Google’s option of automatic deletion of a user's search and location history

Article 6, Article 9, Article 12, Article 17, Recital 65, Recital 66

Data minimization

Pseudonymize data
Use data distortion processing technology; keep the property of data for statistics use in AI
Apply federated ML and transfer learning when there is a need to collect personal data

Article 5(1)(c), Recital 39, Article 16, Article 17

Transparency principle

Use metadata management tools: data governance to authorize specific person accessing the specified data link terminal (DLT)
Have a specific privacy notice and explicit consent
Use a differential privacy model; delete personally identifiable information (PII) without modifying the meaning of datasets

Article 5, Article 12, Article 13, Article 14

AI or GDPR?

AI vs. GDPR	Proposed Suggestions	Reference GDPR Provisions
Accuracy of automated decision-making	Obtain human intervention and do not rely solely on a machine Use data accuracy analysis technology—monitor the AI agent performance and use ML to increase the accuracy Conduct a data protection impact assessment (DPIA) and trustworthy AI assessment Conduct rigorous testing, e.g., penetration tests and cybersecurity control assessments Ensure traceability, auditability and transparent communication on system capabilities	Article 4(4), Article 9, Article 12, Article 13, Article 14, Article 15, Article 21, Article 22, Article 35(1) (3)
The Right to Erasure	Use something like Google’s option of automatic deletion of a user's search and location history	Article 6, Article 9, Article 12, Article 17, Recital 65, Recital 66
Data minimization	Pseudonymize data Use data distortion processing technology; keep the property of data for statistics use in AI Apply federated ML and transfer learning when there is a need to collect personal data	Article 5(1)(c), Recital 39, Article 16, Article 17
Transparency principle	Use metadata management tools: data governance to authorize specific person accessing the specified data link terminal (DLT) Have a specific privacy notice and explicit consent Use a differential privacy model; delete personally identifiable information (PII) without modifying the meaning of datasets	Article 5, Article 12, Article 13, Article 14