CHUONG Luong Van (Chris)’s Post

Such a welcome and refreshing news. But not a surprise at all ! Of course the publicity of a data set or of a user information doesn’t make it automatically usable without proovable user permission. Plus GDPR is fully clear about how ‘permission’ are defined ‘by purpose’. Now I understand that companies focus on ‘permission’ only and mixes purposes for convenience and at most translate it in a web banner or an pop up alert which most users ignore what scope it has… but what companies should really starting understanding is that ‘user permission’ without purpose means zero monetization right for them. Hence a company to gain meaningful rights to process data may even scrape upon condition to get the appropriate ‘right to scrape’ by the data right holder and define for what purpose it is using the scraping. Including for AI training. Now people will contest me saying ‘but how do we do that?’ Technically speaking ‘permissions’ can be managed as ‘machine readable’ information. In real time. By computers and devices with processing capabilities. Are we saying that the devices circulating in the world are not fit for the purpose ? #data #use #legitimate #purpose #transparency #franework

🚨 AI policy alert: The new report from the Dutch Data Protection Authority is out, and it has bad news for AI developers & entrepreneurs (automatic translation below) ➡ According to the Dutch DPA: "Scraping will almost always be a violation of the General Data Protection Regulation (GDPR). In a number of cases, scraping is not allowed anyway. For example: ➵ scraping the internet to create profiles of people and then resell them; ➵ scraping information from protected social media accounts or private forums; ➵ scraping data from public social media profiles, with the aim of determining whether or not those people will receive requested insurance. - "A widespread misunderstanding is that scraping is allowed, because everything on the internet is already available to everyone. 'But the fact that information about you is public does not automatically mean that you also give permission for scraping,' says AP chairman Aleid Wolfsen. 'Even if you post on your social media account that you recently won the lottery or had an operation, you do not give permission for that data to be scraped. You only give permission to collect personal data if you have been asked in advance. That is usually not possible with scraping." ➡ It's great to see that what I've been writing about in my newsletter (since December 2022) and teaching in my courses is slowly becoming a consensus and being translated into practical recommendations - at least in the EU. ➡ Link to the full report below. ➡ For more AI policy & regulation updates, subscribe to my newsletter. #AI #AItraining #scraping #generativeAI #AIregulation #DutchDPA

It is inconceivable to me that we have to state explicitly that shared information in a specific circumstance does not grant universal access to it. "Everything on the internet is already available to everyone" is only technically true. My father was one of the earliest (ethical) hackers so I grew up with warnings about this. It's true in the sense that if you have someone who wants to target you and steal your information then you are doing most of their job for them. It is not true that "everything is available to everyone", because we don't all have the same access to the internet, the same skills or even the same privacy settings. I guarantee you that the internet I experienced living with a hacker and the internet most people accessed at that time were very different things. Public information is NEVER an invitation for abuse, and the fact that this has to be made explicit because people creating A.I. do not seem to understand the basic concept of "it is not yours just because you can see it", is worrying. In saying that, people creating A.I., are part of the same society that tells women that "they asked for it" and tells P.o.C that "they looked threatening" before killing them, so really, I should probably be less surprised. When we did Privacy law under torts, we discussed what the ethics of new technologies such as FB (which had just started up), and what that might mean for individual privacy. My opinion has yet to change: just because something exists does not mean it belongs to you. Relatedly: this is also why I truly wish that companies that put "any intellectual property you develop here becomes ours upon your leaving us", would be named, shamed, and put out of business permanently. Just because I share information openly is no excuse to take it and then try to profit off it exclusively. This is the greed that mars our world: from the colonization of the land we are on, and all the way to our newest technology. Colonizers will always choose profit over people. Sharing information freely is important for the development of humanity as a whole. Scraping information freely given in the name of development, so you can profit is colonization, and cannot be allowed to be made into an acceptable standard. Scraping is a fancy new way to say "stealing", "exploiting" and "mining". If a rose by any other name should smell as sweet, then the intentional disregard of people's privacy, be it called "scraping", "hacking" or "A.I. training" must be treated with the same seriousness as any other intentional breach of shared property, and individual safety/privacy.

🔍 Data Scraping Under Fire: Dutch DPA Report Raises Concerns for AI Developers 🔥 Remember our blog post from last year discussing the joint statement on data scraping by international privacy authorities? 📝 https://lnkd.in/efcSvujr Well, it seems the conversation is gaining momentum, and this time, it's hitting close to home for AI developers and entrepreneurs in the EU. 🌍💼 Check out Luiza Jarovsky's post for more insights!

While data scraping offers many benefits for research, analysis, and decision-making, users must be mindful of ethical considerations and legal implications. Respecting terms of service, protecting data privacy, and complying with copyright and data protection laws are essential aspects of responsible data scraping practices.

🧠 EU AI Act update 💡 Important issues to be discussed (agreed?!) at next week's trilogue. See my colleague Christopher's summary below. Foundation models / general purpose AI is a key issue that needs to be resolved. This has significant implications for LLMs and generative AI. The EU is struggling (understandably so) with: ➡ Defining "foundation models" (e.g. should this be by reference to compute, size of dataset, parameters?) and "general purpose AI" ➡ Getting the balance right between regulating these increasingly-used technologies and not stifling innovation ➡ Reconciling the regulation of these technologies with the approach in the remainder of the Act to regulate AI based on how it is used The Spanish presidency of the EU Council is keen to have the final text agreed by the end of the year: ➡ On one view, this is ambitious: more time is needed to carefully construct the provisions around these sorts of fundamental points and this process shouldn't be rushed. ➡ On the other hand, do we now just need to get this Act over the line and start the implementation period (likely to be 2 years), and deal with finer points in guidance and implementing legislation (which is likely to be needed anyway)? Either way, we'll have a better idea after the discussions next week. Watch this space! #ai, #aiact #euaiact #airegulation William Dunning, Lisa Kingsbury, Hazal Kirci, Ophelia Pressley, Emily Jones, Lauren Dickinson, Olivia Ward, Raza Rizvi, Angus Brown, Sophie Sheldon, Thomas Howard, Alejandro Guerrero, Eric Le Quellenec, Emilie Danglades-Perez, Edoardo Tedeschi, Can Görgülü, LL.M. (Stockholm)

📢 #AI Act (draft) - new proposals made by EU-Presidency (17 October 2023) for upcoming fourth political trilogue, which will take place on 24 October 2023: 👉 #Foundation models: - all models: subject to transparency obligations (before & after model is put on market) - "very capable" models: additional obligations, particularly red-teaming through vetted red-testers, risk assessment/mitigation and regular compliance controls through independent auditors. 💡 "Very capable" foundation models should be those whose capabilities go beyond the current state-of-the-art and may not yet be fully understood. Threshold (compute power used to train model in FLOPS) to be introduced that triggers (rebuttable) assumption that model is "very capable". 👉#GPAI (General Purpose AI) systems: - all provider of GPAI systems: explicit statement whether GPAI can be used for high-risk uses. Where high-risk is excluded: measures to detect and prevent such use need to be introduced. Where high-risk is allowed: GPAI system needs to comply with requirements for high-risk AI systems. - GPAI systems used "at scale" in EU: subject to regular red-teaming through vetted red-testers & risk assessment/mitigation. 💡 Whether a GPAI system is used "at scale" is to be based on the impact and reach. Relevant threshold proposed: 10,000 registered business users (i.e. developers) or 45 million registered end users. (Note for comparison: ChatGPT has currently approx. 100+ million users.) 👉 #Copyright & foundation models: Providers of foundation models must: - demonstrate that adequate measures to ensure training in compliance with EU copyright law have been taken, respecting right holders' opt-out from their content to be used for training purposes (Text and Data Mining exception) - make publicly available sufficient detailed summary re content used for training & policies to manage copyright-related aspects 👉 AI-generated #output: - Providers of AI systems that generate output: ensure that output is detectable as AI generated / manipulated (Presidency notes at the same time that this might be difficult for generated text ...) 👉 Centralised #supervision / #enforcement concerning foundation models & GPAI "at scale": - AI Office shall (amongst others) have power to carry out compliance controls by its own or with support of auditors, carry out investigations upon alerts and take corrective measures (including suspension of model). 💡 "Being the first body worldwide with powers to enforce rules on foundation models and GPAI, the #AIOffice would become an international reference point for AI governance." 📝Further topics for discussion on this (very interesting) agenda: - #Classification of AI systems as high-risk - List of #high-risk AI use cases (Annex III) - Testing high risk AI systems in real world conditions outside AI regulatory #sandboxes For details, see the document attached. Alexander Brown Angus McLean Minesh Tanna Drew Winlaw Rasmus Rothe

Hey everyone! In my latest piece, I dive into the intricate world of the EU AI Act, a groundbreaking piece of legislation that is setting the stage for how artificial intelligence systems are developed and deployed across not just Europe, but globally. Yes, you heard that right - it doesn't matter where you are, if your AI services touch the EU in any way, you need to sit up and pay attention! The Act meticulously categorizes AI systems into risk tiers, and let's just say, the higher the risk, the higher the scrutiny. If you're dabbling in AI systems considered high-risk, brace yourself for a deep dive into conformity assessments. That means making sure your AI is up to snuff when it comes to EU standards, and believe me, they're not skimming on the details. For all of us working with AI, transparency is the new watchword, especially if your tech involves chatbots. The idea is that users should always know when they're interacting with AI. As for compliance, it's pretty much what you'd expect but cranked up a notch. Documentation of your AI systems, checking those risk levels, and making sure you meet the mark for your specific category is the name of the game. And if you think that sounds complicated, you're right. But it's not all doom and gloom. For AI systems that pose limited or minimal risk, the hoops are fewer and smaller. Yet, for those playing in the high-risk arena, be prepared for a hefty to-do list. This includes everything from comprehensive documentation to implementing solid security measures and ensuring everything is crystal clear to the end-users. Now, maintaining this level of compliance isn't a set-it-and-forget-it deal. It involves constant monitoring, upskilling your team, and keeping your policies in perfect alignment with the Act. And because I know you love diving deep into these subjects as much as I do, I've also included some juicy extras on the legalities and compliance nuances of web scraping. Trust me, it's a read you wouldn't want to miss, packed with insights that could save you a ton of headache down the line. Stay compliant, folks, and remember, in the fast-evolving world of AI, being informed is your best defense. Happy innovating! Here is the full article on The Web Scraping Club

Early morning reflections on the hottest topic of the moment - Artificial Intelligence! Having completed a handful of DPIAs in this space now, common themes are emerging and they are interesting. As a technologist, the potential for transformational good from AI is incredibly exciting but equally the potential for transformational harm is terrifying. My greatest wish is that we can harness its power for good while dampening its power for misuse. It is early days yet – let’s hope this wish comes true! Our DPIA exercises are uncovering some interesting common themes - 1. Sometimes you've been told its AI but actually its not AI. That is probably good news for you but you still need to consider whether there is automated decisioning and if you need to consider Article 22. 2. Using personal data to train the AI Engine raises challenges around lawful processing and transparency - and you may need to undertake additional supplier due diligence. 3. Use of the AI solution also raises challenges around establishing a lawful basis and transparency - and we also find new challenges in the DPIA process itself. GDPR doesn’t weigh in on ethics, competition or intellectual property debate but if your AI system is trained on personal data or processes or generates personal data as a result of its use GDPR has a lot to say and you should take heed! #ArtificialIntelligence #DPIA #GDPR #DataPrivacy #Technology #Ethics #Transparency

🌐 EU's New AI Law: A Step Forward or Too Restrictive? The EU has just agreed on rules aimed at making AI safer. A key aspect? It's stopping AI that can manipulate our emotions - a significant move for digital ethics. Here's my take: While the intent is admirable, it feels strict. After all, digital marketing has long been influencing emotions. However, the law isn't solely about restrictions. It introduces 'regulatory sandboxes' for SMEs, allowing them to experiment with AI in real-world scenarios without the immediate burden of full compliance. In my view, this strikes a smart balance. It safeguards ethical considerations while fostering innovation, enabling small businesses to thrive in the AI landscape. Here is the link to the European Parliament's press release on the AI Act: