CNIL Publishes Action Plan on AI

On
May
16,
2023,
the
French
Data
Protection
Authority
(the
“CNIL”)
announced
its

action
plan
on
artificial
intelligence
(the
“AI
Action
Plan”).
The
AI
Action
Plan
builds
on
prior
work
of
the
CNIL
in
the
field
of
AI
and
consists
of
a
series
of
activities
the
CNIL
will
undertake
to
support
the
deployment
of
AI
systems
that
respect
the
privacy
of
individuals.

The
AI
Action
Plan
is
centered
around
four
key
objectives:

• 
  Understanding
  the
  functioning
  of
  AI
  systems
  and
  their
  impacts
  on
  people:
  Through
  its
  new
  artificial
  intelligence
  service,
  the
  CNIL
  will
  focus
  on
  addressing
  key
  data
  protection
  issues
  relevant
  to
  the
  design
  and
  operation
  of
  AI
  applications.
  These
  issues
  include
  the
  protection
  of
  publicly
  available
  data
  on
  the
  web
  against
  scraping,
  the
  protection
  of
  data
  transmitted
  by
  users
  of
  AI
  systems,
  and
  consequences
  for
  the
  rights
  of
  individuals
  to
  their
  data
  with
  respect
  to
  data
  collected
  for
  training
  AI
  applications
  and
  the
  outputs
  produced
  by
  AI
  systems,
  among
  other
  issues.
• 
  Guiding
  the
  development
  of
  AI
  that
  respects
  personal
  data:
  To
  support
  organizations
  innovating
  in
  the
  field
  of
  AI
  and
  to
  prepare
  for
  the
  potential
  passage
  of
  the
  EU
  AI
  Act,
  the
  CNIL
  will
  publish
  guidance
  and
  best
  practices
  on
  several
  AI
  topics,
  including
  a
  guide
  on
  rules
  applicable
  to
  the
  sharing
  and
  re-use
  of
  data
  as
  well
  as
  recommendations
  for
  the
  design
  of
  generative
  AI
  systems.
• 
  Supporting
  innovative
  players
  in
  the
  AI
  ecosystem
  in
  France
  and
  Europe:
  The
  CNIL
  will
  support
  actors
  in
  the
  AI
  ecosystem
  to
  innovate
  in
  a
  way
  that
  ensures
  protection
  of
  French
  and
  European
  fundamental
  rights
  and
  freedoms.
  In
  particular,
  the
  CNIL
  will
  soon
  open
  a
  new
  call
  for
  projects
  for
  participation
  in
  its
  2023
  regulatory
  sandbox
  and
  plans
  to
  engage
  in
  increased
  dialogue
  with
  research
  teams,
  R&D
  centers
  and
  organizations
  developing
  AI
  systems.
• 
  Auditing
  and
  controlling
  AI
  systems:
  The
  CNIL
  plans
  to
  develop
  a
  tool
  to
  audit
  AI
  systems
  and
  will
  continue
  to
  investigate
  complaints
  lodged
  with
  its
  office
  related
  to
  AI,
  including
  generative
  AI.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts