How to protect personal data when working with neural networks, experts explained

The use of artificial intelligence in the work of organizations requires clear rules: it is necessary to determine what information employees can transfer to such systems, and what information should remain inside the corporate infrastructure. On November 11, the director of the National Center for Personal Data Protection Andrei Gaev and the chairman of the department of personal data protection specialists of the Belarusian Republican Union of Lawyers Kirill Laptev told reporters, the correspondent of the Minsk-Novosti agency reports.

Photo is illustrative, pixabay.com

The National Center for Personal Data Protection pays special attention to this issue. This year, half of the employees of the institution passed advanced training courses on working with artificial intelligence. According to Gaev, it is important that specialists not only know how to use such tools, but also understand the risks associated with them.

- We use the basic tools of artificial intelligence to solve current problems when you need to prepare a presentation, information material or conduct analytical work. This allows to speed up processes to a certain extent. However, after using such tools, the information obtained is necessarily checked and processed by a person. Within the center, the relevant organizational and legal rules, as well as technical settings governing the work with such resources are defined. Training of employees in this direction will continue, Gaev said.

Artificial intelligence should not completely replace humans when making decisions that directly affect their lives. Technology can be trusted to pre-process information and perform individual tasks, but the final decision in employment, education and health care must be left to the individual.

K. Laptev noted that organizations today choose different approaches to regulating the use of artificial intelligence. Some are limited to existing documents on the processing of personal data and the protection of trade secrets, others are developing separate local legal acts directly devoted to working with such technologies.

- It is important to understand that the use of artificial intelligence already falls under the current legislation on personal data. The principle of technological neutrality applies here: it does not matter what tool the organization uses, the requirements for information processing remain mandatory. The challenge, therefore, is not simply to allow or prohibit employees from using such systems, but to define rules for their use. The organization must understand what tools are permissible to use, what categories of data can be uploaded into them, what information should not be transferred to external services, the expert explained.

According to K. Laptev, a separate local legal act allows to consolidate such rules, but in itself does not guarantee their observance. It is also necessary to train employees, explain to them the features of working with artificial intelligence and the possible consequences of transferring information to third-party services.

Another aspect concerns companies that develop or provide solutions based on artificial intelligence. When choosing such products, it is important for organizations to find out under what conditions data is processed, whether they are used to train models, what protection guarantees are provided by the provider.

- If the artificial intelligence model is created using data in violation of the law, the question arises about the legality of its further application. Therefore, it is necessary to evaluate not only the technology itself, but also the data on which it works. One of the possible approaches is to limit the use of personal data or their depersonalization in order to exclude the possibility of identifying a particular person, Laptev said.

As another solution, the expert called the use of local artificial intelligence systems that organizations can deploy directly inside their own information infrastructure. In this case, the data does not have to be transferred to an external provider, and the organization has more control over the conditions of their processing.

At the same time, K. Laptev stressed that the cross-border transfer of personal data is not prohibited by Belarusian legislation, but should be carried out in compliance with the established requirements and in the presence of appropriate legal grounds.