The interfaces between artificial intelligence (AI) and data protection are becoming increasingly complex. Companies are increasingly using sophisticated algorithms to generate valuable insights, automate processes, and optimize decision-making. However, the use of AI raises significant questions regarding data protection and compliance with other regulations.
In this context, the following article highlights the compliance requirements for AI systems concerning data protection and presents solutions for handling protected business secrets.
The most important points in brief
- The announced „Regulation of the European Parliament and of the Council laying down harmonised rules on Artificial Intelligence“ (AI Act) aims to regulate the use of artificial intelligence in companies.
- The proposed draft law creates a comprehensive legal framework for the use of AI systems within the EU.
- In a business context, AI can help optimize operations, create forecasts, and improve customer service.
- With the rise of AI, so does the amount of data that companies can collect and analyze.
Overview of the AI Regulation
The rapid development of Artificial Intelligence has far-reaching effects on many areas of life. In April 2021, the European Commission presented its draft regulation for Artificial Intelligence, which was to be enacted by the European Parliament and the Council. This proposed AI regulation is considered landmark legislation to establish uniform rules for the use of artificial intelligence in the European Union.
The AI Regulation seeks to achieve a number of important objectives designed to protect the well-being and rights of citizens in the European Union. One of the priority objectives is to safeguard the fundamental rights and freedoms of individuals. This involves ensuring that AI systems respect human dignity and privacy and do not have discriminatory or harmful effects. The regulation places great emphasis on AI systems operating transparently, non-manipulatively, and in accordance with fundamental rights.
Another goal of the AI regulation is to strengthen citizens' trust in AI systems. This is to be achieved by promoting transparency, accountability, and comprehensibility. This ensures that AI systems are traceable and explainable, allowing people to better understand how these systems work and their decision-making processes.
In addition to protecting civil rights and building trust in AI systems, the AI Regulation also aims to foster innovation and enhance the competitiveness of the European economy. Companies should be encouraged to develop and use AI technologies, as this not only strengthens their competitiveness but also contributes to the economic development of the EU. The AI Regulation thus has the ambitious goal of leveraging the benefits of AI technology while ensuring that it operates in line with the fundamental principles of freedom and dignity.
Compliance
The integration of artificial intelligence into business operations is undoubtedly key to increasing efficiency and competitiveness for many companies. The automated data processing and analysis that AI enables open up new opportunities for companies to make informed decisions faster and optimize their processes. However, while AI holds enormous potential, it also comes with significant risks, particularly concerning data protection.
Fundamentally, a certain skepticism towards new technologies is appropriate, especially those with long-term potential. With regard to artificial intelligence, however, companies must ensure that they can leverage the benefits without neglecting data protection concerns. It is crucial for companies to invest in technologies, training, and systems to both maximize the benefits of AI and minimize the risks.
The responsibility for data protection does not lie solely with data protection officers, but particularly with the managing directors and board members of a company. According to Section 43 of the German Limited Liability Companies Act (GmbHG) and Section 93 of the German Stock Corporation Act (AktG), managing directors and board members bear the liability and responsibility for compliance with data protection regulations and the security of their customers' and employees' data. These legal provisions underscore the importance of careful and responsible data handling, especially in the context of AI.
Overall, regulating artificial intelligence with regard to data protection is a complex task that requires both technical expertise and legal knowledge. Companies must actively work to leverage the benefits of AI without neglecting data protection, while also ensuring that their leaders take responsibility for data protection and comply with legal requirements. Only in this way can they realize the full potential of AI without compromising the integrity and security of data.
Trade secrets
Trade secrets are a valuable asset for companies. They represent carefully developed know-how that often requires years of research and development. Unlike patents, which are time-limited, trade secrets can potentially last indefinitely and cover areas that cannot be protected by patent law. Especially for data that is not subject to the General Data Protection Regulation (GDPR), the protection of trade secrets offers an important safeguard for companies. However, it is crucial to take the necessary measures to establish and maintain this secrecy.
It is important to note that inputting confidential information into AI chatbots like ChatGPT is potentially risky. ChatGPT and similar AI chatbots use the data entered to improve their own systems. As a result, the information entered into such chatbots may no longer be considered confidential under certain circumstances, thereby jeopardizing the protection of trade secrets and potentially constituting a violation of competition law.
It is difficult to estimate how easy it is for other users to view previously entered trade secrets by entering a corresponding prompt. Therefore, companies should ensure that their employees do not enter trade secrets into publicly available AI tools. This could be ensured by completely blocking websites on which such chatbots are operated.
If a company permits the use of generative AI tools, it should ensure that employees are prevented from entering trade secrets into chatbots through appropriate clauses in their employment contracts or a separate declaration. Additionally, training sessions and codes of conduct could be introduced to raise employees' awareness of how to handle trade secrets carefully and to inform them how to identify whether something is a trade secret in the first place.
For companies that still want to benefit from AI, there are two possible alternatives. The first is to have a tailor-made AI tool developed by an external company and to contractually ensure that the entered information is only used for the client's purposes and not for model improvement. However, the safest option is to develop proprietary, in-house AI tools, even if this can be costly. Large technology companies in particular, which leverage a significant portion of their know-how in their AI applications, could benefit considerably from such investments.
Should your company require assistance with data protection and employee training, contact You are welcome to join us.
Conclusion
Artificial intelligence is increasingly being used, with future development being uncertain. In the compliance sector, the technology presents both a challenge and an opportunity. On the one hand, it supports the handling of increasing demands, and on the other hand, it also harbors new risks. For this reason, companies should address the legal framework for the lawful use of AI systems at an early stage, as the implementation of the announced „Regulation of the European Parliament and of the Council laying down harmonized rules on artificial intelligence“ (AI Act) is likely to entail multifaceted requirements for companies, such as the strategic decision of who within the company will be responsible for AI governance compliance.