Regulations should look at potential harm of data rather than its semantics posted on 20 May 2024

Incomplete-thoughts: Regulations should look at potential harm of data rather than its semantics

Today privacy laws regulate data based on their “sensitivity” (e.g. ethnicity, religion, gender etc.). One large issue with this approach is that systems today can infer (e.g. with AI) sensitive attributes of a person with mundane data, allowing them to operate without being constrained by most regulations.

Rather than focusing on the properties of the data, we should focus on how it can be used (which would cover sensitive data being inferred) and what are the potential harm and risks of this data being used – the same should go for technologies.

Relying on harm and risk is not that trivial though – harm is well understood and accepted only when it does happen (but not always!), and risk is an even more elusive concept. The risk of a piece of sensitive data leaking is extremely hard to quantify (systems are so large and complex nowadays) but I do believe it is the right framework to think about data/technology – regulations may need to be translated into more specific laws for specific topics though.

For example, generative AI will likely make sextorsion significantly worse. We don’t need to ban generative AI, but we need to make sure data and this technology doesn’t harm our society – this is currently a problem that’s unaddressed by privacy regulations and not broadly known. In general AI is making many gaps left by privacy regulations much worse, and this is a pressing issue we should fix.

I’m not naive enough to think that companies are going to do what’s right – their goal is to generate profits and survive. Raising awareness is probably the first step – if you are involved in some of these efforts, DM me, I would be interested to know about it and maybe help!

Note: I personally didn’t know about sextorsion and this might be because I’m a man, a millennial or living under a rock, but if this is your case too, you should look at some of Paul Raffile articles – they are well written and very informative on this problem.

LinkedIn post