The client is an independent think tank focused building high resilience to extreme risks, including those arising from AI.
Research has shown the capacity for AI agents to exhibit deceptive behaviour. These systems may conceal or obfuscate activities, objectives or capabilities or pursue goals that differ those set by their developers. The ability to assess and monitor these phenomena is hindered by limited evidence regarding the behaviour of deployed AI systems and real-world harms, as well as a lack of detection capabilities for incident response.
AWO was asked to review a data protection impact assessment and provide data protection and legal advice for a research project focused on collecting publicly available data regarding deceptive behaviour by AI agents easier.
- DPIA review. We reviewed and amended the initial DPIA draft to include a more comprehensive analysis of the legal basis should be relied on the organisational and technical measures that should be in place for the project.
- Legal advice. In addition to the DPIA, we also provided the client with a legal opinion on the legal risks of the project beyond those related to data protection, including contractual and intellectual property risks.
Publicly available data from social media platforms can be rich sources of information for certain kinds of research projects. Such platforms are likely to contain real-world instances of deceptive behaviour that are more authentic and potentially richer in content compared to other sources such as voluntary submissions or news stories. However, just because data are public does not mean that they can be used for unlimited purposes or without an appropriate legal basis, and it is important that organisations comply with relevant data protection requirements.
Our biggest takeaway from this work is that the use of publicly available data for research or other purposes often triggers certain key data protection principles: lawfulness, purpose limitation, data minimisation and transparency. It is difficult to justify using publicly available data without measures in place to adhere to these principles to ensure the responsible and ethical use of data.