Data & Information ยท DAT-05
Lawful and fair use of data
Before data is used in an AI system, its use is confirmed as lawful, consistent with the purpose for which it was collected, and fair to the people it describes.
Why it matters
Using existing data for AI is often a new purpose that the original basis for holding it does not cover. Settling the lawful basis and fairness of each use before work starts avoids systems that have to be withdrawn, and protects the people whose data is used.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | Data is used for AI wherever it is available; lawful basis and fairness are not considered. |
| 2 Developing | Data protection advice is sought for some uses, usually late or only for obviously personal data. |
| 3 Defined | Each use of data in AI has a lawful basis, purpose check and fairness consideration signed off before use, with data minimised and privacy techniques considered. |
| 4 Managed | These records are checked for completeness against the AI inventory, are revisited when the use or the data changes, and gaps are acted on. |
| 5 Optimising | Lawful and fair use is designed in from the start of each use of AI, and the approach is refined from case outcomes, complaints and changes in law. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- DAT-05.1 Each use of data in AI has a record of its lawful basis, purpose compatibility check and fairness consideration.
- DAT-05.2 Each record is completed before use and signed off by the data owner with data protection advice.
- DAT-05.3 Data collected and processed for each use is limited to what the purpose needs.
- DAT-05.4 Wherever personal data is used, including to train or tune AI, privacy enhancing techniques such as minimisation, anonymisation or synthetic data are considered, informed by the impact assessment, and the decision is recorded with reasons.
- DAT-05.5 People whose data or inputs an AI system uses are told, accessibly, how they are used, accessed and stored, including any retraining and review by staff or suppliers.
- DAT-05.6 Individual rights requests about data used in AI are handled, including where personal data has been used to train a model.
Assessment questions
- For a given use of AI, what is the lawful basis for using each data set, and where is it recorded?
- Was the data collected for a purpose compatible with this use?
- When is this checked again, for example when the system or its data changes?
- Recorded decision on privacy enhancing techniques for each training or tuning data set that holds personal data
- Records of lawful basis, purpose compatibility and fairness for a sample of uses of AI
- Data protection advice or sign-off on those uses
- Notices telling people how their data and inputs are used, accessed and stored
How to reach Level 3
- Before each use of data in AI, record the lawful basis, a check that the use fits the purpose the data was collected for, and a fairness consideration, signed off by the data owner with data protection advice.
- Limit the data collected and processed to what the purpose needs, and record the decision on privacy enhancing techniques such as minimisation, anonymisation or synthetic data, with reasons informed by the impact assessment (RSK-03).
- Tell people, in accessible language, how their data or inputs are used, accessed and stored, including any retraining and any review by staff or suppliers.
- Set up a route to handle individual rights requests, including where personal data has been used to train a model.
Common pitfalls
- Seeking data protection advice only after the system is built.
- Having no answer for a rights request about data already used to train a model.
Starter artefacts
- Data use assessment template
- Privacy notice wording for AI uses
- Rights request procedure covering trained models
Cross-references
| AI Cyber Security Code of Practice | 2.5 partial; 10.1 direct |
|---|---|
| Algorithmic Transparency Recording Standard | Tier 2 Development data specification direct; Tier 2 Operational data specification partial; Tier 2 Risks, mitigations and impact assessments partial |
| EU AI Act | Art 26(9) partial; Art 50(3) partial |
| GDS AI Playbook | P2 direct |
| JSP 936 Part 1 | para 47 partial; para 108 partial; para 202 partial |
| MITRE AI Maturity Model | P1.3 partial; P5.2 direct; P5.3 partial |
| NIST AI 600-1 | R4 direct |
| NIST AI RMF 1.0 | MEASURE 2.2 partial; MEASURE 2.10 direct |
| UK Data and AI Ethics Framework | Accountability 2 partial; Fairness 3 partial; Privacy 1 partial; Privacy 2 direct; Privacy 3 partial; Privacy 4 direct; Privacy 5 direct; Privacy 6 direct; Privacy 7 partial; Privacy 9 direct; Safety 3 direct; Trade-offs 3 partial; SAT 1.3 direct; SAT 1.5 direct; SAT 1.6 partial; SAT 1.7 partial; SAT 2.4 direct; SAT 2.6 direct; SAT 4.8 partial |
| UNESCO AI Maturity Framework | 5.4 partial; 6.4 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.