The Right To Privacy In The Era Of AI
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
THE RIGHT TO PRIVACY IN THE ERA OF AI
Nithiyakumari M, The Tamilnadu Dr. Ambedkar Law, University (SOEL), Chennai
ABSTRACT
The world is moving towards the sphere of technology for all essential things, right from cleaner to creating a virtual world where property could be sold. Nowadays, I sometimes feel very lazy to go search for a book in the interested topic, or even think or process the information that I have in my mind, so I use some technology like artificial intelligence to get me whatever I need for that hour. Simply to say artificial intelligence is the inculcation of human intelligence in the algorithm. For example, the general AI is used to sort out list the movies of our kind in the OTT platforms. The inculcation in the sense of logical reasoning with the analysis of data pattern and there is a need to train the software with big data for its proper functioning. In the course of using such data, privacy of an individual is affected which in turn violates right to privacy guaranteed to every individual of the country. Others like American countries, European countries and eastern countries have also recognised this right under various laws. But there is not much legislation to deal with the right to privacy in world of AI. Since, the technology is ever growing, the need for the new legislation will always be the need of the hour. Thus, this paper will deals with the right to privacy, the working of artificial intelligence. Moreover this paper will try to understand the impact of artificial intelligence and issues related to it and also the legislations made in various countries to address the issues of right to privacy. Keywords: artificial intelligence, right to privacy, machine learning, data spillover, data persistence, data repurposing.
INTRODUCTION
Basically the law should be composed of various parts which include defining an offence to punishment for the offence. But in the case of cyber crime, defining the offence is itself a big task. Sometimes, it is very difficult first of all to find whether an action is itself an offence or not. Then proceeding further may involves a lot of difficulties. For example in the place of Artificial intelligence, it needs a large amount of data to train itself. You can say the efficiency of the Artificial Intelligence depends more on the data it is fed with. So the data plays a vital role in the proper functioning of the AI. But when we think about feeding of data, the data it takes are the information about the humans or mostly human related information. Ultimately the talk of privacy enters the room as soon as we speak about the humans’ information, whether software uses human data without consent amounts to violation of privacy?. It is upto the wish of the person to keep the things which he/she wants to keep in private. The distinction between the public and private information cannot be made when it comes to a man’s information. May be consent takes a play in which a private information can be used for specific purpose. That is to say with the consent of the concerned person, his /her personal information can be used. So to regulate the usage of such kind, a proper legislation should be made. It should also contain provisions for the proper administration of entities which are using such information for their functioning along with the punishment for their violation. Thus, this paper deals with the right of privacy, also more about artificial intelligence and impact of its functioning. PRIVACY In general right to privacy means “the Right to be let alone” which could be the first definition of information privacy. In an attempt to systematize and more clearly describe and define the new right of privacy being upheld in tort law, William Prosser wrote that what had emerged were four different interests in privacy: a) intrusion into a person’s seclusion or solitude, or into his private affairs; b) public disclosure of embarrassing private facts about an individual; c) publicity placing one in a false light in the public eye; and d) appropriation of one’s likeness for the advantage of another.1 INTERNATIONAL INSTRUMENTS ON RIGHT TO PRIVACY International Covenant on Civil and Political Rights (ICCPR) and the Universal Declaration of Human Rights (UDHR) are the international instruments which has inculcated Right to Privacy of the individuals. Article 12 of UDHR states that “No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks”.2 And Article 17 of ICCPR3 says in detail about the right to privacy The articles emphasize the obligation of states to protect individuals, including those deprived of their liberty, from unlawful and arbitrary interferences with their privacy, family, home, or correspondence. While lawful interference can be arbitrary, it must be legitimate, reasonable, and proportionate to achieve its purpose. Privacy refers to the specific area of an individual's life and autonomy that should not be touched by others, including their identity, sexuality, and personal characteristics. Family includes parents, children, close relatives, grandparents, grandchildren, non-married heterosexual and homosexual partners, and illegitimate and adopted children. Homes encompass various types of houses, including rental, leased, weekend, and garden houses. Interference in homes can include forced trespassing, electronic surveillance, listening devices, and hidden cameras. Correspondence includes all forms of communication, including telephone, telegram, and email. Examples of interference include withholding, censorship, inspection, or publication of private correspondence. Prisoners are protected from correspondence protection. Honour and reputation are only protected if false allegations constitute unlawful and intentional interferences. Honour refers to subjective opinions, while 1 Judith DeCew, Privacy, https://plato.stanford.edu/archIves/win2006/entries/privacy/#VieMeaValPri (last visited Nov 10, 2024).
2 Article 12 of Universal Declaration of Human Rights, 1948
3 International Covenant on Civil and Political Rights, 1966
reputation refers to appraisal by others4. ARTIFICIAL INTELLIGENCE AND ITS WORKING Basically Artificial Intelligence is incorporation of intelligence into the algorithm to make it function in the way how the man thinks or does a work. Definition of Artificial Intelligence given by NASA states that Artificial intelligence refers to computer systems that can perform complex tasks normally done by human-reasoning, decision making, creating, etc5. The working of Artificial Intelligence algorithm may not be transparent. It makes prediction, logical understanding and reasoning, giving suggestions by analysis of the data fed to the software. This is done through various components in AI which are machine learning, deep learning, neural networks, natural language processing, deep learning etc. The process of machine learning depends on the training of algorithm to make decision when exposed to a set of data. Basically the AI uses algorithm to analyse a massive amount of data to derive an inference. The AI algorithm will be trained with that data which are being fed to understand the patterns, decisions involved in that particular set of data for making future decisions. Generally machine learning is of two types: Supervised machine learning is a process where the input data are labelled to train the algorithm to classify the data and make predictions whereas in Unsupervised machine learning the data are not labelled instead its algorithm are trained to analyse the unlabeled datasets to find the relationship or pattern between them and label them. When machine learning algorithm has a number of layers in neural network like 3 or more layers, then it can be called as deep learning where the data enters through the Input layer, the next layer is called Hidden layer which process and transport data to other layers. The final result or prediction is made in the output layer. To think about how it functions internally, it has neural networks which contain interconnected nodes through layers of connection like neurons of human brain. It posses information and transmission of the information take place between these nodes. Through these 4 Simple Guide on The International Covenant on Civil and Political Rights (ICCPR), An overview of Articles 1- 27, Centre for Civil and Political Rights, October 2021, https;//ccprcentre.org/files/media/simple_guide_on_The_International_Covenant.pdf (last visited on 19th Nov, 2024, 9.00pm) 5 Executive Order 13960, Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government, December 3, 2020. transmissions, the strength of connection between nodes are analysed and adjusted to learn a pattern of the fed data. Recognising complex pattern with the data and make prediction is basic work of these nodes. It also has other components like natural language processing to make the computer analyse and process input language to output language, computer vision, Internet of things etc. to assist in this process. NATURE OF PROBLEM IN RELATION TO PRIVACY CONCERNS SPECIFIC TO AI
- Data repurposing is the usage of data beyond the intended and stated purpose, without the data subject’s knowledge or consent. • Data spillover is the usage of data of individuals who were not intended to be included when the data was collected. • Data persistence refers storage or usage or existence of data for long period of time than the reasonable time anticipated at the time of collection or beyond the lifespan of the human subjects whose data were used for consented time or who used the data6. These are some of the basic privacy concerns which are very specific to artificial intelligence that would be sort only by proper management of Artificial Intelligence.
IMPACT OF AI ON RIGHT TO PRIVACY Firstly in the step of collecting sensitive data, when an algorithm is trained for the specific purpose of being used in the medical field, then, the data used should be composed of medical reports and details of the patients only and no other data can collected. If the data is only in the phase of analyse or for the assigned purpose and not in the training phase also amounts to violation of privacy. When the processor uses large amount of sensitive data, there is a risk of compromise of those data to third party by the data processor7. Beware the Privacy Violations in Artificial Intelligence Applications, ISACA, https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2021/beware-the-privacy-violations-inartificial-intelligence-applications (last visited Nov 22, 2024). 7 Md Ashrafur Rahman et al., Impact of Artificial Intelligence (AI) Technology in Healthcare Sector: A Critical Evaluation of Both Sides of the Coin, 17 Clinical Pathology 2632010X241226887 (2024).
Secondly when data is collected without consent, ultimately it amounts to privacy violation. For example Clearview, a small secretive startup that launched an app in 2017 using a 30 billion photo database scraped from social media platforms without users consent. Likewise, another app called PimEyes which offers several pricing plans and the same technology as Clearview. When a photo of someone is uploaded, it shows more a dozen other picture of her with links to where they had been published8. When the data may be collected with the individual’s consent, the use of such data should be monitored that it is being used for the purpose for which data subject’s consent was obtained. If the data controller or the data processor goes beyond the purpose of collection, it amounts to violation of privacy9. In case of Dinerstein v. Google, a class action alleges that through a series of corporate transaction allowing it to acquire and absorb an AI data mining company called DeepMind and its partnership with health care systems and includes University of Chicago, where it was alleged that Google has illegally obtained access to hundreds and thousands of patients’ medical reports which actually used to train the machine learning diagnostic and search algorithm10. In case of Facebook and Cambridge Analytica, Cambridge Analytica collected data of over 87 million Facebook users without their explicit consent, using a seemingly innocuous personality quiz app. This data was then used to build detailed psychological profiles of the users, which were leveraged to target personalized political advertisements during the 2016 US Presidential Election. This case highlighted the potential of AI to infer sensitive information (political views in this case) from seemingly benign data (Facebook likes), and misuse it for secondary purposes11. 8 harvardgazette, How Facial-Recognition App Poses Threat to Privacy, Civil Liberties, Harvard Gazette (2023), https://news.harvard.edu/gazette/story/2023/10/how-facial-recognition-app-poses-threat-to-privacy-civilliberties/ (last visited Nov 10, 2024). 9 Exploring privacy issues in the age of AI | IBM, (2024), https://www.ibm.com/think/insights/ai-privacy (last visited Nov 11, 2024).
10 Matt Dinerstein, IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF
ILLINOIS, EASTERN DIVISION.
11 Examining Privacy Risks in AI Systems, Transcend, https://transcend.io/blog/ai-and-privacy (last visited Nov 14, 2024).
CONCLUSION
The advancement of technology must align with the fundamental rights of individuals, ensuring that progress does not come at the expense of personal freedoms. Specifically, the right to privacy and the ability of users to control their own personal information should remain paramount. As technology continues to evolve, it becomes imperative to establish regulations that keep pace with these developments while simultaneously safeguarding basic human rights. Several jurisdictions have already implemented laws aimed at protecting personal data and privacy. For instance, the European Union has enacted the General Data Protection Regulation (GDPR), a comprehensive legal framework designed to safeguard the rights and freedoms of individuals in relation to the processing and free movement of personal data. This regulation reinforces the fundamental principles of data protection and establishes stringent requirements for organizations handling personal information. Similarly, in 2008, the state of Illinois in the United States introduced the Biometric Information Privacy Act (BIPA), a pioneering law that grants individuals control over their biometric data, such as fingerprints, iris scans, and DNA records. Under BIPA, private entities are prohibited from collecting such sensitive information without first informing users and obtaining their explicit written consent. More recently, the European Union has enacted the EU AI Act, a regulatory framework that categorizes artificial intelligence based on risk levels and sets compliance obligations accordingly. In contrast, the United States has adopted a sector-specific approach to privacy protection, with laws tailored to particular industries such as healthcare and finance. Meanwhile, Australia has established the Australian Privacy Principles, which provide guidelines for the transparent and responsible handling of personal data. In India, the Digital Personal Data Protection Act was passed, though it has yet to be fully enforced. These examples illustrate the growing global recognition of the need for strong data protection laws. However, while the necessity for legislation to safeguard personal data is evident, such regulations must be carefully crafted to strike a balance between protecting individual rights and fostering technological innovation. Excessive restrictions could stifle progress, while unchecked technological growth could compromise privacy and security. Therefore, effective implementation and enforcement of these laws are just as crucial as their formulation.
Furthermore, as artificial intelligence and automated systems become increasingly sophisticated, the methods of legal interpretation—both mechanical and manual—must evolve to remain relevant. Although AI can assist in regulatory compliance and enforcement, human oversight remains essential to ensuring that these systems operate ethically and within established legal boundaries. Thus, while technological advancements should be embraced, they must remain subject to human control to prevent unintended consequences and uphold the principles of justice and fairness in the digital age.