Mind Readings: AI Bill of Rights, Part 3: Data Privacy

Welcome back to our review of the AI Bill of Rights. This is part three, data privacy. And this one, I'm going to read this whole thing aloud. I've been sort of summarizing these, but this one deserves to be read in full because a lot of it is already law or becoming law, and uh we need to pay attention to it as marketers. Data privacy.

You should be protected from abusive data practices via built-in protections, and you should have agency over how data about you is used. You should be protected from violations of privacy through design choices that ensure such protections are included by default, including that data collection uh options conform to reasonable expectations that only data strictly necessary for the specific context is collected. Designers, developers, and deployers of automated systems should seek your permission and respect your decisions regarding collection, use, access, transfer, and deletion of your data in appropriate ways and to the greatest extent possible. Where not possible, alternative privacy by design safeguards should be used. Systems should not employ user experience and design decisions that obfuscate user choice or burden users with defaults that are privacy invasive.

Consent should only be used to justify collection of data in cases where it can be appropriately and meaningfully given. Any consent requests should be brief, be understandable in plain language, and give you agency over data collection and the specific context of use. Current hard-to-understand notice and choice practices for broad uses of data should be changed. Enhanced protections and restrictions for data and inferences related to sensitive domains, including health, work, education, criminal justice, and finance, and for data pertaining to your youth should be should put you first. In sensitive domains, your data and related inferences should only be used for necessary functions, and you should be protected by ethical review and use prohibitions.

You and your communities should be free from unchecked surveillance. Surveillance technologies should be subjected to heightened oversight that includes at least pre-deployment assessment of their potential harms and scope limits to protect privacy and civil liberties. Continuous surveillance and monitoring should not be used in education, work, housing, or other contexts where the use of such surveillance technologies is likely to limit rights, opportunities, or access. Whenever possible, you should have access to reporting that confirms your data decisions have been respected and provides an assessment of the potential impact of surveillance technologies on your rights, opportunities, and access. This section of the AI Bill of Rights is probably the closest to already being a reality.

You'll notice the language sounds very similar to GDPR, the General Data Protection Regulation of the EU. It sounds very similar to CCPA and CPRA, California's consumer protections for citizens of California and households there about data. And this is also the section that companies resist the hardest, particularly marketers, because marketers, let's face it, have an addiction to data that even if they don't know how to use it well, they have an addiction to it, particularly personal identifying information and demographic data, sensitive data. That's gotta stop. Enhanced privacy is a good thing.

Not good for marketing, but good for people. Let's look at a couple of the examples that they cite in here of things companies have done wrong. Number one, an insurer might collect data from a person's social media presence as part of deciding what life insurance rates they should be offered. Yep, no. Number two, a data broker harvested large amounts of personal data and suffered a breach, exposing hundreds of thousands of people to potential identity theft.

Gosh, who could that be? A local public housing authority installed a facial recognition system at the entrance to housing complexes to assist law enforcement with identifying individuals viewed by a camera when police reports are filed, leading the community, both those living in the housing complex and not to have videos of them sent to local police departments and made available scanning by its facial recognition software. In the last episode on algorithmic discrimination, one of the things we've got to talk about was that things like facial recognition don't work the same for everybody. They're trained on certain libraries of faces, and uh this there's a lot of issues with that. But in this case, this is a consent issue.

Uh, people who are not living at that housing complex did not give their consent to uh to being videoed. Uh companies use surveillance software to track employee discussions about union activity and use the resulting data to surveil individual employees and surreptitiously intervene in discussions, Starbucks. Um to be fair, there's a lot of companies that do stuff like that. Amazon does that too. Um allegedly, allegedly.

Uh I don't believe any of those cases have come to a court uh to a decision in courts yet. So they we have to say allegedly, but that's who's allegedly behind these things. So data privacy is really going to be challenging for AI and for marketing. Uh because we already have laws in the books saying you have to provide consent for uh a consumer must provide consent for the data to be used. And in California's CPRA, which takes effect January 1 of 2023, there's a provision saying consumers have the right to know if their data is being used by machines for decisioning, aka machine learning, and have the right to opt out of it.

So think about that. If you are building machine learning based on the data within your systems, you have to, if you're planning on doing business with California at all or Europe, you have to be able to exclude people's data from machine learning. That's a pretty big deal. There will be an entire cottage industry of folks helping to clean that stuff up and to build what are called synthetic models, uh, synthetic models based on data that conforms to the statistical patterns of users without using any actual user data, right? So if 40% of your database is women, and you know 52% of uh those women are people of color, and of that, you know, 16% are Latina, then you would create a synthetic data set of artificial people that match those statistical criteria that you could use for modeling, but none of the individual entries in that synthetic data are real people.

Right? They're like um you know AI generated images of people, they're not real people, but they look enough like real people that you could use them uh in decisioning systems to look for um patterns that you can make decisions on. For consent. Consent is one of those things that marketers have not really figured out. Uh because we sort of assume blank consent, and it's becoming more and more challenging with legislative leave because uh companies and various entities have said no, you have to get consent per purpose, per use.

So if you fill out a form on my website, I have to list out all the things that I'm going to do with your data. I'm going to subscribe it to my newsletter. I'm going to use your data to make uh predictions about whether you know what email domain uh you use and whether that is a predictor for whether you're likely to be a customer or not, um, and so on and so forth. I would use your data to, you know, for marketing lead scoring. If you work for a certain type of company, uh give you more points in our in our lead scoring system, all of these things have to be things that we as marketers have to be thinking about now because it's going to be legislatively required.

And again, this is one of those things where a lot of this is already law. Certainly overseas in China and in the EU, it is law. It's operational law now. There are substantial civil and criminal penalties for breaking those laws. And in the United States, there's differential privacy laws all over the country, but California has some of the strictest ones.

Other states, uh Virginia, Massachusetts, New York, um, they are also coming up with uh privacy laws. It's gonna be a patchwork quilt, but the general guidance that we've seen be effective is if you are conformant to GDPR, the EU legislation, you're pretty much gonna check the box on everything else because GDPR is the strictest implementation of privacy right now. AI and machine learning are founded on data, right? You build models from data. The the fundamental technology underlying it is data.

And so if we are losing access to data because we didn't get permission for it, we've got to come up with other things, right? Behavior based analysis is really useful, right? Do you really care who somebody is? Or do you just care that you see enough buying signals that you can nudge them? For example, if you go to the Trust Insights website and you uh visit a blog post and then you visit the about us page and then the team page and then the services page, you're probably gonna convert to something, right?

I don't need to know who you are, your age or your location or your your ethnicity to know that I should fire a pop-up saying, hey, want to buy something? Um, right? Your behavior is indicative of buying behavior, regardless of who you are. And that is the mind shift that marketers and particularly marketing technology vendors need to pivot to is let's make sure we are focusing on behaviors and not individuals, and certainly not personally identifying information wherever possible in order to conform to regulations as best as we can. So that's that's data.

There's a lot to unpack there, but the bottom line is we need permission for everything on a case by case basis, on a use by use basis, and we should only be collecting data if we're actually going to use it. So take a look at the data you collect now as a marketer. How much do you actually use? Is there stuff that you could just throw overboard and it wouldn't affect your decisioning at all? Right?

If there is, get rid of it. Get rid of it sooner rather than later, delete it from your systems. And you are that much more protected from privacy regulations and from data breaches, too. But this is a really important one. In the uh next section, we're going to talk about notice and explanations.

That'll be tomorrow's episode. If you like this video, go ahead and hit that subscribe button.