An Overview of the ICO’s Response to the UK’s White Paper on Artificial Intelligence

On 29 March this year, the UK’s government published its white paper: ‘AI Regulation: A Pro-Innovation Approach’ (White Paper) which acknowledges that the existing regulatory landscape requires government intervention. It recognises that in the absence of a regulatory framework, AI could present risks to individuals’ privacy, human dignity and fundamental liberties.

As evident in the White Paper’s title, the UK favours an innovative and adaptable approach. Whilst the White Paper states that ‘regulatory intervention will ensure that AI does not cause harm at a societal level’, the overall aim is to strike the balance between regulating AI without stunting its development. As a result, there are currently no plans to introduce new legislation and instead, the government’s intention is to regulate based on the use of AI technology rather than legislating entire sectors or technologies. To achieve this, the White Paper sets out five principles which underpin the ‘pro-innovation framework’ that the government proposes to put in place ‘to bring clarity and coherence to the AI regulatory landscape’ and which regulators are to incorporate in their own respective guidance. These are:

1.  Safety, Security and Robustness;
2.  Transparency and Explainability;
3.  Fairness;
4.  Accountability and Governance; and
5.  Contestability and Redress.

 

ICO’s response

The White Paper remains open for consultation until June 2023 and the Information Commissioner’s Office (ICO) has already published its views, including commentary on the compatibility of the AI principles with the UK GDPR.

Specifically, the ICO has addressed the White Paper’s statement that regulators are expected, where a decision involving the use of an AI system has a legal or similarly significant effect on an individual, to ‘consider the suitability of requiring AI system operators to provide an appropriate justification for that decision to expected parties.’ In its response, the ICO highlights that in the event an AI system uses personal data and Article 22 of the UK GDPR (which gives an individual the right not to be subject to a decision based solely on automated processing which has a legal or similarly significant effect) is engaged, “it will be a requirement for AI system operators to be able to provide a justification, not a consideration”. 

Overall, the ICO recognises the importance of close collaboration with the government to ensure that the AI principles are interpreted and applied in a way which are compatible with and do not undermine UK data protection law. The ICO has also called for greater clarity and distinction on the respective roles of government and regulators in issuing AI guidance though it welcomed the White Paper’s strategy to convene regulators with the aim of delivering joint regulatory guidance.

 

What can businesses do next?

Where AI involves the processing of personal data, it is important to ensure compliance with existing UK data protection law. The principles of UK GDPR such as data protection by design and default are relevant to AI and should be embedded into any AI technology being developed by a business.

At this stage and in light of the government’s proposed outcomes-based approach, businesses should be conscious of and actively look out for further updates and guidance from regulators relevant to their sector. Therefore, businesses may find it useful to evaluate their current internal resources that are best placed to react as efficiently as possible to any changes or updates and implement any requirements as and when they are introduced.