The Privacy Commissioner says agencies and businesses should be "clear and upfront" when they use generative artificial intelligence (AI) and involve "senior leaders" in the process, warning that many people may be "uncomfortable" with its use.
Seven "expectations" have been released by Privacy Commissioner Michael Webster on Thursday about how New Zealand agencies, businesses and organisations use generative AI.
He said these expectations were important to ensuring New Zealanders' privacy rights are protected.
"I would expect all agencies using systems that can take the personal information of New Zealanders to create new content to be thinking about the consequences of using generative AI before they start", Webster said in a statement.
The seven expectations are:
- Have senior leadership approval - Webster said organisations must involve senior leaders and privacy officers in decisions about how to implement generative AI systems.
- Review whether generative AI tools are necessary and proportionate - Businesses should consider if there are alternative approaches given potential privacy implications.
- Conduct a privacy impact assessment - This should include seeking feedback from impacted communities, including Māori, and asking the tool's provider how privacy protections have been built into the system.
- Be transparent - Be "clear and upfront" with customers or clients that generative AI is being used and how privacy risks are being managed.
- Develop procedures about accuracy – A procedure should outline reasonable steps to be taken to ensure information is accurate and how the agency would respond to requests from individuals to access or correct their information
- Ensure a human review before acting - The AI's output should be checked before it is acted upon to mitigate the risk of acting on inaccurate information. This should also assess the risk of re-identification of the inputted information
- Ensure personal or confidential information isn't retained or disclosed by the AI tool - Don't enter such data into an AI tool unless it's been explicitly confirmed the information won't be retained or disclosed by the provider
The Commissioner notes that generative AI is a new technology and "many people will be uncomfortable with its use or don’t understand the risks for them".
"Giving them information about the generative AI system you’re using in plain language will be essential to maintain consumer trust and your organisation’s social licence to use AI."
Webster said agencies should do due diligence and privacy analysis to ensure they comply with the law.
"Generative AI is covered by the Privacy Act 2020 and my Office will be working to ensure that is being complied with; we will investigate where appropriate," he said.
"The Commissioner has previously sent a letter to government agencies outlining his caution around prematurely jumping into using generative AI without a proper assessment and signalling the need for a whole-of-government response to the growing challenges posed by this tool."
More information about the Privacy Commissioner's expectations can be found here.
AI has been in the spotlight this week after Newshub revealed that the National Party was using artificial intelligence to generate some of its attack advertisements. For example, health workers and robbers in some ads aren't real people, but AI-generated characters.
National leader Christopher Luxon wasn't initially aware of that when questioned by Newshub.
"I don't know about the topic in the sense of I am not sure. You are making an accusation that we are using it, I am not sure that we are. I will need to talk to our team."
He later told AM it was a "fantastic" innovation.
"Here's what happens: you either go out and buy a standard, stock image… of an actor playing a fake nurse or a doctor or whatever it is, or you can create it now through AI and I don't think there's any difference in both of those approaches."
However, Luxon said National would use "AI responsibly" and wouldn't get into AI videos.
Other political parties have said they don't use AI in their ads and don't intend to
