France's CNIL Working on Tool to Analyze AI Models' Privacy
French data protection authority CNIL and consortium partners Thursday launched the Privacy Auditing of AI Models project to develop a tool that will assess models' privacy.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
The European Data Protection Board's Dec. 18 opinion on processing personal data for AI models (see 2412180004) stated that the General Data Protection Regulation applies in many cases to AI models trained on personal data because of their memorization capabilities, CNIL noted.
The EDPB opinion also pointed out that, to remove an AI model trained on personal data from the scope of the GDPR, it's often necessary to provide an analysis showing the model is resistant to privacy attacks, the watchdog said.
Researchers have worked on models resistant to privacy attacks, but they are often implemented only at the experimental level for scientific publications, CNIL noted.
Several roadblocks prevent industry from adopting the models, CNIL said. Academic literature on the subject is scattered and extensive, making it hard for companies to find the time and expertise to navigate it. Use cases aren't always adapted to the industrial context, and there's no standardized framework for formalizing the coding of confidentiality tests.
The tool that the consortium develops should enable "efficient and cost-effective implementation of certain technical privacy assessment tests that players in the AI ecosystem are likely to carry out to assess the GDPR compliance of an AI model."
In addition to CNIL, consortium members are PERen (the French government center of expertise for digital platform regulation); ANSSI (National Agency for the Security of Information Systems); and the interdisciplinary project on privacy of Priority Research Programs and Equipment Cybersecurity.