AI Data Lakes: Top Five Issues To Consider

Datasets processed through AI systems (also "AI Data Lakes") are becoming increasingly popular, with an exponential increase in potential "use cases."

You will find here below the main legal issues to consider:

Privacy (and GDPR) - This is obviously at the top of the list. Even when the database does not include personal data, AI systems may progressively infer (or re-identify) personal data, which will then have to be processed adequately in accordance with all applicable data protection regulations. As for the Italian (and other) jurisdiction(s), GDPR principles will have to be taken into account, including purpose limitation, fairness and transparency, as well as privacy by default and privacy by design. This implies, among other things, completing a prior Data Protection Impact Assessment (DPIA) and setting up a data governance system, also including, for instance, adequate privacy notices that inform about the consequences of the data processing. Data transfer regulations will have to be taken into account carefully, also considering that in certain cloud scenarios it may not always be possible to determine exactly where the data resides in a given moment in time. Anonymization and simultaneous aggregation solutions will remain the risk-free option, but they should be reviewed from time to time taking into account the technology evolutions that may allow re-identifications. Antitrust - Big data economy has already been addressed by the Italian Antitrust Authority, and useful guidelines can be inferred already. That said, to avoid risks, a system to tag competition sensitive data should be set up, also providing for escalation procedures for certain use cases / data processes, particularly, but not limited to, when pricing and competitors data are handled. Data usage will have to be assessed carefully, also where data is used to reconsider the pricing/conditions applied by the suppliers; under Italian law, certain provisions on economic dependence may be triggered. Product safety - Data sets may include, among other things, production and performance data, with potential implications on product safety risks. When processing such data, product safety laws (and related notification obligations) will have to be addressed carefully. For instance, in Italyin addition to the relevant tort law responsibilitywith regard to consumer products, the Italian Consumer Code provides for an obligation to inform the competent authorities even when there...