AI Weekly: MIT aims to reconcile data sharing with EU AI regulations

“Enterprises would like to legally share data to do collaborative analytics and consumers want privacy of their data, location, and pictures, and we would like to address both scenarios,” Devadas, a co-director of the initiative, told VentureBeat via email. “The initiative is focused on legal sharing, use and processing of data … Some of the new [EU] regulations ban the use of certain technologies, except for security reasons. I can imagine, for example, that surveillance cameras produce encrypted video streams, and face recognition technology is only applied in a scenario where safety and security considerations are paramount. This might mean that the encrypted streams are processed without decryption — something that is actually possible with available technologies.”

The initiative is the brainchild of MIT Computer Science and Artificial Intelligence Laboratory managing director Lori Glover and Danny Weitzner, who runs the Internet Policy Research Initiative at MIT. As Devadas explains, the goal is integrating research on privacy policy with privacy-preserving technologies to create a virtuous cycle of R&D and regulation. “In many fields, such as medical diagnostics and finance, sharing of data can produce significantly better outcomes and predictions, but sharing is disallowed by [laws] such as HIPAA,” Devadas said. “There are private collaborative analytics techniques that can help with this problem, but it is not always clear if particular techniques or approaches satisfy regulations, because regulations are oftentimes vague. The initiative would like to address this issue.”

Particularly in health care, consumers often aren’t fully aware their information is included in the datasets used to train AI systems. In 2019, The Wall Street Journal reported details on Project Nightingale, Google’s partnership with Ascension, which is America’s second-largest health system, that is collecting the personal health data of tens of millions of patients for the purposes of developing AI-based services for medical providers. A U.K. regulator concluded that The Royal Free London NHS Foundation Trust, a division of the U.K.’s National Health Service based in London, provided Google parent company Alphabet’s DeepMind with data on 1.6 million patients without their consent. And in 2019, Google and the University of Chicago Medical Center were sued for allegedly failing to scrub timestamps from anonymized medical records. (A judge tossed the suit in September.)

The EU regulations impose requirements on “high-risk” applications of AI, including medical devices and equipment. Companies developing them will have to use “high-quality” training data to avoid bias, agree to “human oversight,” and create detailed documentation that explains how the software works to both regulators and users. Moreover, in an effort to provide transparency about what technologies are in use, all high-risk AI systems will be indexed in an EU-wide database.

Devadas sees a number of technologies enabling ethical approaches to AI that align with the EU regulations. For example, secure multiparty computation can be used to arrive at an aggregated statistic in a way that doesn’t expose users’ data. On the horizon are approaches like secure hardware and homographic encryption, which allow AI to derive insights from encrypted data. While homomorphic encryption is possible today, it’s upwards of 100,000 times slower than unsecured techniques. As for secure hardware, it’s often not without security vulnerabilities and requires complete trust in hardware manufacturers.

“There are a lot of techniques that are perhaps close to being deployable but not quite there,” Devadas said. “[However], multiple projects in the initiative will directly address this performance gap.”

For AI coverage, send news tips to Kyle Wiggers — and be sure to subscribe to the AI Weekly newsletter and bookmark our AI channel, The Machine.

Thanks for reading,

Kyle Wiggers

AI Staff Writer