Author: Samuel Uzoigwe and Anastasia Edward1
1. Introduction:
Artificial Intelligence (AI) is rapidly altering the mode and manner of human and business interactions in the world, with its applications present in virtually every industry and sector ranging from financial to health, real estate, human resources, cloud computing and storage, telecommunications, entertainment/content creation etc. The common denominator in the application of AI in these industries is that data is processed on a massive and continuous scale throughout the lifecycle of AI systems, and much of this data is personal data. The interplay between AI and privacy is evolving and because developing AI systems is iterative coupled with the presence of personal data processing after deployment, AI utilization raises new and complex privacy concerns which pose risks to the rights and freedoms of humans.
Pre-deployment, AI systems are often trained on massive datasets that contain personal data, which could include sensitive personal data. When AI systems are trained using personal data, they acquire the capacity to make inferences and identify objects, patterns and relationships that can be used to make predictions about human behaviour and preferences. This could be useful in many cases, but it could also pose risks to the rights and freedoms of data subjects and individuals at large. The personal data in training datasets could also be deployed for purposes beyond that for which it was initially processed, and privacy breaches could expose data subjects to numerous risks in the hands of malicious threat actors.
This work examines the delicate and intricate nexus between AI development and deployment and data privacy and protection. It also outlines key privacy considerations that AI developers or organizations should consider to enable compliance with the Nigeria Data Protection Act (NDPA) 2023. The work is structured into three (3) major sections comprising of the examination of AI systems use in a Nigerian context; the nexus between AI and the NDPA 2023, as well as data privacy considerations for AI systems use in Nigeria. There will be references to foreign guides for context where the NDPA does not provide a sufficient description of a subject or concept.
2. Artificial Intelligence: Uses and Lifecycle
In the Nigerian context, artificial intelligence (AI) is increasingly deployed in diverse applications, including creditworthiness assessment by financial institutions, talent acquisition processes, document authentication, biometric recognition in consumer electronic devices and smart home systems, plagiarism detection, data analysis, chatbots for consumer related services, and generative AI. All the aforementioned applications involve the processing of personal data at some point, and in various capacities and volumes. Some of the industries in Nigeria where this utilization of AI systems is common include legal, finance, healthcare, security, telecommunications, insurance, real estate, etc. Artificial Intelligence has subsets such as deep learning (DL) – the recognition of complex patterns in pictures, text, sounds, and other data to produce accurate insights and predictions e.g virtual assistants, facial recognition and language translation; 2 machine learning (ML) – the focus on the use of data and algorithms to imitate the way and manner in which humans learn, gradually improving the accuracy of the system e.g customer service chatbots; 3 and natural language processing (NLP - the branch of AI) that enables computers and machines to comprehend, generate, and manipulate human language e.g analysis of large documents and also chatbots. An AI system could sometimes rely on third-party frameworks and codes, which creates increased complexity of relationships involving personal data processing.
Artificial Intelligence systems typically transit from the design and development phase to the deployment phase. The design and development phase includes building, testing, and validation of the models by AI developers in collaboration with software engineers, analysts, enterprises etc., to ensure that it meets performance metrics, baselines and is scalable before deployment at production levels. After an AI model has gone through the iterations of the development phase, it is deployed into production.4 As summed by Rybalko, "deployment is the process of configuring an analytic asset for integration with other applications or access by business users to serve production workload at scale."5 Each phase within the outlined life cycle of AI systems exhibits distinct activities, contexts, and goals, entailing a spectrum of varying privacy risks and considerations. This is further accentuated by the pervasive practice of collecting personal data without data subject participation, as exemplified by web scraping and facial recognition technologies.
3. Nexus Between Artificial Intelligence Systems Use and the Nigeria Data Protection Act 2023:
Section 2(1) of the Nigeria Data Protection Act 2023 ("the NDPA" or "the Act"), provides that the Act shall apply to all forms of processing of personal data, whether by automated means or not. The processing of personal data in AI systems, whether at the development stage or after deployment, falls within the ambit of the NDPA, and the data controller or processor is expected to carefully ensure the lawfulness of such processing, among other key privacy considerations under the Act.
Data Preparation/Data Pre-Processing
Data Preparation is a critical part of an AI system development process. It is the process of gathering, combining, structuring and organizing data so that it can be used in business intelligence (BI), analytics and data visualization applications.6 Data preprocessing on the other hand, a component of data preparation, describes any type of processing performed on raw data to prepare it for another data processing procedure.7
It is usually a misconception that data privacy obligations do not apply to these phases of an AI model development. Under the NDPA, once any operation or set of operations is performed on any information relating to an identified or identifiable individual during these stages, personal data processing is deemed to have occurred.8 This includes during data collection, discovery and profiling, cleaning, structuring, transformation, validation, etc. Therefore, the data preparation and pre-processing stages fall within the purview of the NDPA irrespective of how they are designated once an individual can be identified directly or indirectly through the concerned data, until such personal data is deidentified.
4. Data Privacy Considerations for Artificial Intelligence Systems Use;
By virtue of the processing of personal data both at the development and deployment of artificial intelligence models/systems, several privacy considerations must be taken into account by AI system developers and users that operate within the scope and jurisdiction of the NDPA. The factors below are not exhaustive, and new regulations guides, and global best pest practices must be considered at all times to ensure robust compliance with the NDPA. It should also be noted that the considerations below should not be confused with pure principles of responsible AI use.
To view the full article click here
Footnotes
1. Samuel Uzoigwe is an Executive Associate at Alliance Law Firm, Lagos, Nigeria.
2. Amazon Web Services, "What is deep learning," https://aws.amazon.com/what-is/deeplearning/#:~:text=Deep%20learning%20is%20a%20method,produce%20accurate%20insights%20and%20predictions.
3. IBM, "What is Machine Learning," https://www.ibm.com/topics/machine-learning
4. Dmitriy Rybalko, AI model lifecycle management: Deploy Phase, IBM, https://www.ibm.com/blog/ai-modellifecycle-management-deploy-phase/, accessed January 15, 2024.
5. Ibid.
6. Craig Stedman, industry editor | Ed Burns, execu7ve editor | Mary K. Pra=, "What is Data Prepara%on? An indepth Guide to Data Prep", TechTarget, https://media.techtarget.com/digitalguide/images/Misc/EAMarke&ng/Eguides/What_is_Data_Prepara&on_An_In-Depth_Guide_to_Data_Prep.pdf, accessed January 15, 2024.
7. George Lawton, "Data Preprocessing", Techtarget, https://www.techtarget.com/searchdatamanagement/defini5on/data-preprocessing, accessed January 15, 2024.
8. Sec$on 65, of the NDPA.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
