As the use of Artificial Intelligence becomes more prevalent, organisations and regulators need to develop a strong understanding of the appropriate and lawful use of personal data in the context of AI. The deployment of AI can bring transformative benefits to organisations, but may also raise privacy concerns.

The ICO has recently issued guidance addressing a number of these concerns and provides an insight into the application of personal data protection law in the context of AI.

The ICO Guidance provides practical tips to improve how AI and the personal information associated with it are handled. Key takeaways from the guidance are:

  • Adopting a risk-based approach in the development and deployment of AI
  • Explaining decisions made by AI to individuals affected
  • Minimising data collection
  • Reducing the risk of bias and discrimination
  • Preparing data appropriately by dedicating time and resources
  • Security of the AI systems
  • Human review of decisions
  • Engaging with external suppliers

What does this mean for organisations using Al?

  • Organisations need Al governance, not least to understand if and how AI is being used, whether this use amounts to "solely automated decision-making" and the legal risks associated with this, particularly data privacy risks.
  • Organisations using AI should consider producing AI Explainability Statements (given the ICO's comments around explainability) and/or DPIAs. We advised on the first Al Explainability Statement which was reviewed by the ICO and would be happy to advise further on this.
  • Organisations should maintain robust policies and practices around data collection, retention and processing, including for AI use.
  • Where there is a risk of discriminatory output from AI systems, organisations should take effective measures to reduce these risks.

How we can help you

We have a dedicated AI Group, comprising lawyers across various practice areas and jurisdictions, which regularly advises clients on AI legal, regulatory and ethical issues.

We are at the forefront of developments in AI law and involved in cutting-edge projects.

Through Simmons Wavelength, we have numerous in-house data scientists who have day-to-day experience of developing AI models. We are therefore able to offer both legal advice and a practical insight into AI-related legal issues.

View summary of the ICO's guidance


The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.