Is Your AI Governance Program Built on a House of Cards?

A recent Forbes article focusing on "Sam Altman’s ‘Departure’ And Board Oversight Of Artificial Intelligence" brings to the forefront the critical importance of technologically enforced AI controls. This thought-provoking narrative lays out the necessity for board members to not only understand but also strategically manage AI's capabilities and risks, cementing a forward-looking stance on AI's integration into the corporate structure.

The European Union's highest court, the CJEU, in its recent Scania case decision,¹ clarified the scope of data protection required under the GDPR. The decision indicates that data doesn't need to be immediately identifiable to be considered sensitive. In practice, this means that AI applications that might combine non-specific data to identify individuals will trigger GDPR compliance. This serves as a crucial alert for corporations processing data: the implications of data privacy extend beyond the data itself to the intricate connections AI might draw.²

The unpredictability of not knowing whether data will satisfy the requirements for “Anonymity” highlights the fragility of relying on anonymization alone to ensure the lawful processing of personal data for AI.

Prior to the GDPR, relying on anonymization was generally considered necessary to enable many forms of data innovation, including the lawful sharing and multi-party analysis of data for commercial and societal benefit. However, the likelihood that data processed for AI will satisfy the requirements for anonymization is remote due to today’s realities of:

The ease with which data used for AI processing can be combined with readily available data resulting in the reidentification of individuals as in the Scania case;³
The inability of organizational or contractual measures by themselves to prevent a priori the misuse of the data, and the critical importance of complementary technical safeguards;
The increasing popularity of data processing activities involving innumerable parties;⁴
The increasing prevalence of data breaches and cybercrime exposing data to unintended recipients.

However, this does not mean that the data is unavailable for innovation, including lawful sharing and multi-party data analysis for commercial and societal benefit. To enable this innovation, GDPR Article 25 requires data controllers to leverage the state of the art by complying with new “data protection by design and by default” obligations. Specifically, controllers must “implement appropriate technical and organizational measures, such as pseudonymization, which are designed to implement data-protection principles, such as data minimization, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects.”

The inclusion - for the first time in EU law - of a statutory definition for “pseudonymization” in the GDPR shows that parties can leverage state-of-the-art technical capabilities to enable data-driven innovation that balances fundamental rights - while staying within (versus outside) the scope of the protection of personal data as defined by the GDPR. Prior to the statutory redefinition, the term “pseudonymization” was often used to describe the result of the failed anonymization of personal data. In contrast, to be entitled to the specific statutory benefits attributable to “pseudonymization” under the GDPR,⁵ parties must now show that (a) “the personal data can no longer be attributed to a specific data subject without the use of additional information,” and (b) “such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.”⁶

Anonos recently filed an Intervention with the CJEU in support of the EDPS' appeal of the judgment of the General Court in Case T-557/20, SRB v EDPS (Case C-413/23 P), in the context of the requirements for and benefits of statutorily compliant anonymization and pseudonymization. Anonos believes this filing was necessary since the growing popularity of AI dramatically increases the risk of irreparable harm from processing unsecured personal data. This is because AI involves distributed, multi-party processing of massive amounts of data containing sensitive, personal, and proprietary information on a global scale. Mitigating the associated risks cannot be achieved using traditional privacy and security techniques, effective only within constrained perimeters which is inconsistent with AI’s architectural requirements. It requires technologically enforced controls that travel with the data to prevent misuse before it occurs.

The Anonos Intervention highlights that GDPR-compliant technologically enforced controls can prevent data misuse a priori before it occurs with AI and other processing.

See the Appendix to the Anonos Intervention for details on the requirements for and benefits of statutory pseudonymization under the GDPR, enabling ample opportunities for lawful data innovation and processing within the scope of the statute.

For more information, please email us at LearnMore@anonos.com.

1. The 9 November 2023 CJEU Scania decision deals with Vehicle Identification Numbers (VINs) that are not personally identifying by themselves but become personal data under the GDPR when combined with other data thereby making them identifying. See https://curia.europa.eu/juris/document/document.jsf;jsessionid=DB0D9CE02169DBBAAF41902154AB2249?text=&docid=279492

2. In the Scania case, the obligation of vehicle manufacturers under EU Regulation 2018/858 to make VINs available to independent operators results in the sharing of personal data constituting a legal obligation under GDPR Article 6(1)(c). Subsequent processing of the VIN data will require a lawful basis under GDPR Article 6.

3. See Note 1.

4. Increasingly popular multi-party processing activities like those involved in popular Large Language Models (LLMs) like ChatGPT and Bard increase the risk of unauthorized re-identification of individuals when multiple datasets are combined, even if each dataset by itself appears anonymous (referred to as the “Mosaic Effect”). While encryption, access controls, masking, and tokenization can serve as protective "guardrails," they fall short of achieving the necessary protection required to prevent unauthorized reidentification. Combining diverse datasets protected with masking and tokenization alone can allow the correlation of seemingly harmless information, leading to unauthorized reidentification via the Mosaic Effect. While access controls and encryption may prevent unauthorized access, they do not stop authorized entities from exploiting data to reveal identities via the Mosaic Effect.

5. In contrast to the term “anonymization” and derivatives thereof, which appear three (3) times in the GDPR, or the term “encryption” and derivatives thereof, which appears four (4) times in the GDPR, the term “pseudonymization” and derivatives thereof appear 15 times in the GDPR, many of which, like Article 25 cited above, highlight specific statutory benefits and expanded data use privileges that result from pseudonymizing personal data in a manner that satisfies the new heightened statutory requirements under the GDPR and the EDPR. See the Appendix for information on the requirements for and benefits of statutory pseudonymization under the GDPR, enabling ample opportunities for lawful data innovation and processing within the scope of the statute.

6. The term “pseudonymization” is defined in Article 4(5) of the GDPR as follows: “pseudonymization means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.”