GDPR will impact different businesses in different ways, depending on the size, operating model and the type of customer data that is held. AI start-ups are working at the frontier of a challenging and innovative technological space, so how will they be affected by the imminent regulation?
One aspect of the roll-out of GDPR that has proved frustrating to AI start-ups is the delayed nature of the guidance, an issue that has affected companies of all sizes and sectors. Final guidance on consent was only released by the EU’s Article 29 Working Party at the end of last month and by the ICO in mid-May.
"GDPR recommendations are still in progress. It is very difficult for small businesses."
Olga Egorsheva, founder of Lobster, was in Brussels speaking to Members of the European Parliament earlier this week alongside three other start-ups. She told them she hopes there will be less focusi on penalties because “the recommendations, even from the European Parliament, are still in progress, so it is very difficult for small businesses.”
She told the MEPs that it has been widely reported that 60% of companies will not be GDPR compliant by 25th May. However, the point was raised that some smaller businesses and companies had started to prepare for the enforcement of the regulation well in advance. On the other hand, in her view, some of the tech giants have taken rash last-minute actions. One of those had a knock-on effect on her business.
Egorsheva described her company as “Uber for stock photos,” enabling social media users to license their photos to marketing and advertising professionals. Many the photos licensed to Lobster are on the Facebook-owned Instagram platform. However, it recently closed off all access to private accounts, even those that belong to users who have explicitly said they want Lobster to be able to access their account and sell their content.
Egorsheva said: “That resulted in 500,000 photos just removed from the platform in one day because Facebook made a last-minute decision. From what I see, a lot of IT companies suffer from that.”
"We all know what GDPR says, but there haven’t been any court cases."
Another issue that AI start-ups have with GDPR is they are unsure how it will be enforced by the ICO. Antoine Amann, CEO and founder of Echobox, said: “One problem I have with GDPR is it is very hard to know how it is going to be implemented. We all know what the rule says, but there haven’t been any court cases.” He said that, until companies have been taken to court for potential breaches, it will be very hard to know what GDPR actually means.
Amann, whose company uses AI to help large news organisations automate their social media content creation, said that because of this it would be tricky to foresee whether or not GDPR will be able to future-proof AI. He also said that larger companies would find it easier to become compliant than smaller ones, probably due to a lack of resource to be able to create and fill new roles.
“A few things in there can be very beneficial for privacy generally, but from a business perspective it can be quite hard because it’s very difficult, especially for smaller businesses, to implement all the rules that are in GDPR, like having a data protection officer,” he said.
"It is awesome that the EU is making privacy law stronger."
While Amann said that it is “awesome” that the EU is making privacy law stronger, he added that we will all have to wait and see exactly what it’s going to focus on.
Though Egorsheva and Amann looked at GDPR from a business perspective, Dr Aygul Zagidullina, the social media director at MotaWord, a business translation platform, took the view of a consumer or data subject. Zagidullina visited Silicon Valley recently where many discussions about GDPR were taking place.
She mentioned the provision in the regulation that gives people the right to information about data processing if a decision made about them was automated as an example of how GDPR is on the side of consumers. However, she said that it is important for members of the AI community to hold each other to account.
“We as a society, we as an AI community, have to aim for and ask for what is ethical so we should request explanations and identification from Google, Microsoft and other companies. Otherwise they will just focus on the technology part,” she warned.
Egorsheva, Amann and Zagidullina were speaking at a panel organised by The AI Talks.