Why AI firms across the world should watch out for the new EU privacy rules

From L-R: Katrina Too, head of marketing, Saleswhale; Michael Gryseels, senior partner, McKinsey & Company; Richard Koh, chief technology officer, Microsoft; Laurence Liew, director, Industry Innovation, AI Singapore; and Alfred Huan, executive director, Agency for Science, Technology and Research / Photo credit: Henzy David / Tech in Asia

The General Data Protection Regulation (GDPR) is slated to take effect in late May amidst rising concern over data privacy around the world. While the data shakeup originates from the European Union, its reach extends far beyond the region, urging global businesses – especially those using AI – to take note.

“One important aspect of the GDPR in the context of AI is that it requires companies to explain the decision of a machine. Why did this person get a mortgage? Why did that person not get a mortgage?” said Michael Gryseels, senior partner at McKinsey & Company, onstage at Tech in Asia Singapore 2018.

Approved by the EU Parliament in 2016, GDPR is designed to “harmonize data privacy laws across Europe, to protect and empower all EU citizens’ data privacy and to reshape the way organizations across the region approach data privacy,” according to the official website.

One important aspect of the GDPR in the context of AI is that it requires companies to explain the decision of a machine.

In effect, the regulatory framework aims to bring more transparency to how AI techniques collect, analyze, and utilize user data – a process that’s often deemed opaque even to computer scientists.

“It will require the [AI] industry and startups in the field to move from a black box to a white box,” Gryseels added.

A core mandate of GDPR is the “Right to Explanation” from algorithms. This comes with several implications for any companies practicing AI. Firms will now have to explain what data points they use (Article 15) and how they make decisions based on this data (Article 13). They must also ensure that no discrimination will take place when processing personal data related to racial or ethnic origin, political opinions, religious or philosophical beliefs, and other similarly revealing information. (Article 22).

Asia, beware

Why should technology firms outside the EU pay attention to GDPR? A major point of note among the clauses is that the rule applies to any entities that hold or process data from subjects residing in the EU (Article 3).

Facebook, for example, has 370 million users in Europe as of December 2017. David Wehner, the social media giant’s CFO, discussed the looming effect of GDPR during the company’s Q1 earnings conference call.

“As you might expect, we believe that European MAU and DAU may be flat to slightly down sequentially in Q2 as a result of the GDPR rollout,” he said.

I have a feeling that some flavors of that regulation will come to Asia. It’s just a matter of time.

But the rule will affect more than just Facebook’s EU data. Like many other American technology companies, Facebook established an Irish subsidiary to capitalize on the country’s low corporate tax. In the lead-up to GDPR’s rollout, the firm is relocating the data of its non-EU users to California, reported Reuters.

Microsoft said it has embraced the new law globally. “This is literally a cross-company effort,” shared Richard Koh, Microsoft Singapore’s chief technology officer at the Tech in Asia conference. “We are re-engineering our products and services so that we can help our customers and clients to be compliant with GDPR.”