March 13, 2017

In a blog post accompanying the publication, the ICO explains that big data is becoming the norm for many organisations, using it to profile people and inform their decision-making processes, whether that is to determine car insurance premiums or to accept/reject job applications. Further, artificial intelligence (AI) is stepping out of the world of science fiction and into real life, providing the “thinking” power behind virtual personal assistants and smart cars. In addition, machine-learning algorithms are discovering patterns in data that traditional data analysis could not hope to find, helping to detect fraud and diagnose diseases.

The complexity and opacity of these types of processing operations mean that it is often hard to know what is going on behind the scenes. This can be problematic when personal data is involved, especially when decisions are made that have significant effects on people’s lives. The combination of these factors has led some to call for new regulation of big data, AI and machine learning, to increase transparency and ensure accountability.

In the ICO’s view, whilst the means by which the processing of personal data are changing, the underlying issues remain the same. Are people being treated fairly? Are decisions accurate and free from bias? Is there a legal basis for the processing?

When the General Data Protection Regulation (GDPR) comes into force in 2018, the regulatory toolkit will be further sharpened. Individuals will have more powerful rights, there will be new accountability provisions, and the ICO will have increased enforcement powers, including the ability to issue fines of up to €20,000,000 or 4% of annual worldwide turnover for infringements of the Regulation.

The ICO paper takes these changes into account and gives the ICO’s views on the implications both now and in the future. For those involved in big data, the paper also offers some practical advice on tools and approaches that can help to meet and go beyond compliance with data protection legislation. There’s also some specific guidance on undertaking privacy impact assessments.

The ICO says that the paper does not mark the end of its work on big data. It has a number of key work-streams that are related to and will continue work in this area. To read the blog post in full and for a link to the paper, click here.