Nineteenth International Conference on Technology, Knowledge, and Society

Abstract

As we have progressed to a world where actions, inactions and behaviour is constantly under scrutiny, deployment of artificial intelligence would only have the effect of expanding reach of surveillance. This paper analyses how automated data processing and decisions based on such processing are regulated today under prominent privacy laws such as the GDPR and the PDPA of Singapore. There is an ardent need to reimagine these regulatory positions with advent of an AI-powered decision maker conducting impact assessments, determining processing purposes and developing thresholds for sharing or secondary processing, including on anonymized data. The wide-ranging consequences of such decision-making may warrant additional safeguards ranging from higher reliance on consent, stricter enforcement of purpose, storage and processing limitation and other principles through privacy-by-design and default, as merely “limiting automated decision making” which is the future ‘normal’ may be grossly inefficient. Supplementary measures such as pre-release approvals, certifications and users disclosures may also be analysed. Anonymization, earlier perceived to be a panacea for personal data risks, is no longer the same in view of the wide presence of datasets and the ability of many actors on the internet to reassociate individuals with anonymized datasets, especially with unique and sensitive attributes such as location, biometrics, and health data. There is also a need to develop technological tools and processes for efficient protection of such data to ensure that benefits to the digital ecosystem received though open data sharing must not be deprived in attempts to redress residual risks of anonymization.