In May I presented a privacy focused look into artificial intelligence. I went over 7 criteria to review prior to implementing any use of AI. The first of these was necessity, whether aspects of the proposed use of AI is needed or not. As part of a series of blogs, I will go over what constitutes these criteria, and today we start with Necessity.
At the most foundational level, necessity is determining whether or not something would be needed in order to function correctly. In the case of AI, if the program or algorithm would not function correctly without that information, it is necessary. Note that necessity is different and separate from proportionality, in that being proportional is about the use of data being appropriate or acceptable culturally or by wider society.
Let’s talk about a couple of examples to illustrate when the use of data is necessary. Luckily, this is a very binary criteria, in that you either do or do not need information and there is little grey area. Our first example would be an AI that learns to play a boardgame. It’s no secret I am a big nerd, so let’s use a good old fashion game of table top d20 (twenty sided die) system, think something like Dungeons and Dragons. Our goal is to make an AI that plays the game effectively, so that means programming in the rules of the game, options it can choose, and logic to make those decisions. In theory, this AI would also be capable of taking in information from playing the game to determine what actions are best or worst given a specific situation. From a necessity standpoint, the information meets the threshold as without it, the AI would not be able to play the game. If we started collecting data on the other players, like who they are or their emails, then we would have an issue as that information would not be necessary.
Now, let’s do something a bit more complex, such as determining if users of an automated tollbooth are valid. Many users of EZ-Pass or similar services are familiar with this concept, where the user has a transmitter, assigned to an account which has assigned vehicles as well. Cameras are going to be involved to monitor the tolls and see which cars go through. So we have a lot of information we are collecting, such as transponder information, license plates, car make and model, biometric information of the driver or passengers (pictures), and location information. In order to process the cars going through, it is necessary to know the following:
- The transponder number
- The account number associated with that transponder
- The make and model as well as the license plate of the car going through the toll
- The make and model as well as the license plate of the car(s) listed on the account
All of this information is all that is needed to validate the car going through and to bill the account. An AI would be able to grab the license plate as well make and model from cameras to further validate the car was one on the account of that transponder. However, we do not need photos of the driver, as there are many cases where someone may not be driving their own car, such as when they teach their children to drive, have a friend driving them because they are tired or incapable otherwise, or the car is being borrowed by someone. Additionally, we are validating that the car is valid, we only care about the car, not the driver, so that is not necessary.
The location is also not needed, as it is irrelevant to the car being validated. If there was some geographic restriction on the transponder, then the AI could start processing that information, but until then it is unnecessary for validation. It should be noted that we would still collect that information, as there is most likely a legal reason to maintain that information.
Overall, whenever you assess the necessity of the information for an AI, we are asking if the information is needed for processing related to a specific task. Remember that collection is a kind of processing, but the data you make available to the AI may differ from the sum total data collected. The big question is whether or not the AI will absolutely need the data to perform the function you will assign it. If it is assessing large sums of data, learning a board game, or validating identities, there is information that will be superfluous to that assigned goal.
Reach out to Privacy Ref with all your organizational privacy concerns, email us at info@privacyref.com or call us 1-888-470-1528. If you are looking to master your privacy skills, check out our training schedule, register today and get trained by the top attended IAPP Official Training Partner.