智善 · 共济链接人工智能原则平台

6. 数据安全与隐私保护

In the development and use of artificial intelligence solutions, users' personal privacy and data security need to be strictly protected.

原则: 人工智能应用准则, Jul 8, 2019

作者：Megvii

相关原则

· Article 7: Protect privacy.

Adhere to the principles of legality, legitimacy, and necessity when collecting and using personal information. Strengthen privacy protection for special data subjects such as minors. Strengthen technical methods, ensure data security, and be on guard against risks such as data leaks.

由 Artificial Intelligence Industry Alliance (AIIA), China 在人工智能行业自律公约（征求意见稿）（Joint Pledge on Artificial Intelligence Industry Self Discipline (Draft for Comment)）发表, May 31, 2019

5. Privacy and Data Governance

AI systems should have proper mechanisms in place to ensure data privacy and protection and maintain and protect the quality and integrity of data throughout their entire lifecycle. Data protocols need to be set up to govern who can access data and when data can be accessed. Data privacy and protection should be respected and upheld during the design, development, and deployment of AI systems. The way data is collected, stored, generated, and deleted throughout the AI system lifecycle must comply with applicable data protection laws, data governance legislation, and ethical principles. Some data protection and privacy laws in ASEAN include Malaysia’s Personal Data Protection Act 2010, the Philippines’ Data Privacy Act of 2012, Singapore’s Personal Data Protection Act 2012, Thailand’s Personal Data Protection Act 2019, Indonesia’s Personal Data Protection Law 2022, and Vietnam’s Personal Data Protection Decree 2023. Organisations should be transparent about their data collection practices, including the types of data collected, how it is used, and who has access to it. Organisations should ensure that necessary consent is obtained from individuals before collecting, using, or disclosing personal data for AI development and deployment, or otherwise have appropriate legal basis to collect, use or disclose personal data without consent. Unnecessary or irrelevant data should not be gathered to prevent potential misuse. Data protection and governance frameworks should be set up and adhered to by developers and deployers of AI systems. These frameworks should also be periodically reviewed and updated in accordance with applicable privacy and data protection laws. For example, data protection impact assessments (DPIA) help organisations determine how data processing systems, procedures, or technologies affect individuals’ privacy and eliminate risks that might violate compliance7. However, it is important to note that DPIAs are much narrower in scope than an overall impact assessment for use of AI systems and are not sufficient as an AI risk assessment. Other components will need to be considered for a full assessment of risks associated with AI systems. Developers and deployers of AI systems should also incorporate a privacy by design principle when developing and deploying AI systems. Privacy by design is an approach that embeds privacy in every stage of the system development lifecycle. Data privacy is essential in gaining the public’s trust in technological advances. Another consideration is investing in privacy enhancing technologies to preserve privacy while allowing personal data to be used for innovation. Privacy enhancing technologies include, but are not limited to, differential privacy, where small changes are made to raw data to securely de identify inputs without having a significant impact on the results of the AI system, and zero knowledge proofs (ZKP), where ZKP hide the underlying data and answer simple questions about whether something is true or false without revealing additional information

由 ASEAN 在东盟人工智能治理与道德指南发表, 2024

Privacy protection and security

Throughout their lifecycle, AI systems should respect and uphold privacy rights and data protection, and ensure the security of data. This principle aims to ensure respect for privacy and data protection when using AI systems. This includes ensuring proper data governance, and management, for all data used and generated by the AI system throughout its lifecycle. For example, maintaining privacy through appropriate data anonymisation where used by AI systems. Further, the connection between data, and inferences drawn from that data by AI systems, should be sound and assessed in an ongoing manner. This principle also aims to ensure appropriate data and AI system security measures are in place. This includes the identification of potential security vulnerabilities, and assurance of resilience to adversarial attacks. Security measures should account for unintended applications of AI systems, and potential abuse risks, with appropriate mitigation measures.

由 Department of Industry, Innovation and Science, Australian Government 在人工智能伦理原则（AI Ethics Principles）发表, Nov 7, 2019

4. Privacy Protection

The development of artificial intelligence needs to ensure the user's data security, artificial intelligence development must not be at the expense of user privacy, need to strengthen data protection legislation, enrich the technical route of artificial intelligence, and constantly strengthen user privacy protection in artificial intelligence applications.

由 Shanghai Advisory Committee of Experts on Artificial Intelligence Industry Security 在人工智能安全发展上海倡议（Shanghai Initiative for the Safe Development of Artificial Intelligence）发表, Aug 30, 2019

Right to privacy, data protection and data governance

Privacy of individuals and their rights as data subjects must be respected, protected and promoted throughout the lifecycle of AI systems. When considering the use of AI systems, adequate data protection frameworks and data governance mechanisms should be established or enhanced in line with the United Nations Personal Data Protection and Privacy Principles also to ensure the integrity of the data used.

由 United Nations System Chief Executives Board for Coordination 在联合国系统内人工智能伦理使用原则发表, Sept 20, 2022