AI companies are releasing powerful products at speed, while questions about personal data and privacy remain unresolved. Wojciech Wiewiórowski, the EU’s data protection supervisor, says that combination could lead to another scandal on the scale of Cambridge Analytica.
Speed can leave privacy behind
Wiewiórowski says companies should build privacy safeguards into products from the beginning. That can be difficult when businesses feel pressure to deliver quickly, but treating privacy as a later fix creates risks for both users and companies.
He points to Cambridge Analytica as a warning. The company collected personal data from tens of millions of Americans through their Facebook accounts, saying it was for scientific purposes and quizzes. It later used the information to create political profiles in an effort to influence how people voted.
For Wiewiórowski, the episode shows how data protection problems can arise when a company cuts corners and changes what it does with information. He says another major scandal is only a matter of time if companies fail to take those lessons seriously.
How data is used matters
The European approach to data protection focuses in part on the purpose for which information is collected and used. Wiewiórowski says a company can breach the law when it uses personal data for a different purpose than the one it communicated to people, especially when that change goes against what they were told.
That principle is relevant to the scrutiny of ChatGPT. OpenAI faces investigations by European and Canadian data protection authorities over how it collects and uses personal data. Italy has temporarily banned the chatbot, and OpenAI has until the end of this week to comply with Europe’s strict data protection regime, the GDPR.
Italian authorities say OpenAI collected data it wanted to use illegally and did not tell people how it intended to use it. The concern is not only about how much information an AI company gathers. It is also about whether people are told what will happen to their information and whether the company sticks to that purpose.
AI systems are trained using content gathered from across the internet. The source article notes that experts believe this collection model may make it impossible for OpenAI to comply with the GDPR. That challenge underscores why privacy questions need to be considered as AI products are built, rather than after they are already widely used.
Rules can shape innovation
Some technologists argue that regulation stifles innovation. Wiewiórowski questions whether companies should have unlimited access to people’s personal data in the name of progress. He describes regulation as an effort to make innovation more civilized, rather than stop it.
He also points out that the GDPR protects trade and the free flow of data across borders, alongside personal data. In that view, rules can set expectations for how companies handle information while allowing business and technology to develop.
The debate is not confined to Europe. The White House is considering rules for AI accountability, and the Federal Trade Commission has demanded that companies delete algorithms and data collected and used illegally. The source cites Weight Watchers in 2022 as an example.
Signs of a shared approach
Wiewiórowski welcomes President Biden’s calls for technology companies to take more responsibility for product safety. He also sees encouragement in US policy thinking moving closer to European efforts to prevent AI risks and hold companies responsible for harms.
His warning is straightforward: AI development is moving quickly, but responsibility for personal data cannot be an afterthought. Companies that design privacy into products and make their data practices clear may reduce the chance that innovation becomes the next major data protection scandal.