Worried about what AI does with your data? The main ai privacy concerns are what gets collected, how it is used and who sees it. You can respond by sharing less and using the access and deletion rights many laws give you.
This guide is part of the site’s coverage of emerging technologies, where AI sits alongside other fast-moving fields.
| Item | Value |
|---|---|
| NIST AI Risk Management Framework issued | January 2023 (voluntary) |
| Risks defined in NIST’s draft Generative AI Profile | 12 risks (April 2024 draft) |
| Public comment on that draft profile closed | June 2, 2024 |
| Maximum GDPR fine | Up to €20 million or 4 percent of worldwide annual revenue |
| Top EU AI Act fine tier (political agreement stage, March 2024) | Up to €35 million or 7% of global turnover |
Figures come from a March 2024 legal commentary and a June 2024 law-firm summary of NIST’s draft profile. Fines, laws and drafts can change, so check the source before you rely on them.
Why does AI raise privacy questions?
AI systems learn from data, and a great deal of it. A legal commentary from March 2024 describes AI systems as trained on vast amounts of data and advancing without a clear consensus on principles or a process to assess and mitigate AI risk.
A plain-language primer on what is training data is a useful companion to this guide.
The NIST AI Risk Management Framework adds a second worry. Its executive summary says AI systems may be trained on data that can change over time, sometimes significantly and unexpectedly, in ways that are hard to understand. That makes the data behind a system harder to track.
Even a tool that only labels the mood of a message, as described in what is sentiment analysis, works on text that may be personal data.
Where AI privacy risks show up
NIST released an initial draft of its Generative AI Profile in April 2024. According to a June 2024 law-firm summary, the profile defines 12 risks that are novel to or made worse by generative AI. NIST named three of them as key:
- Data privacy: personal information handled by or exposed through AI systems.
- Information security: protecting those systems and the data in them.
- Information integrity: keeping AI-generated content trustworthy.
The same summary lists “sensitive data exposure” as something organisations should watch for through periodic audits and monitoring of AI-generated content. NIST accepted public comments on the draft until June 2, 2024.
How the NIST framework treats privacy
The NIST framework was issued in January 2023 and is voluntary, according to the March 2024 commentary. It does not bind any company, but it shows what regulators and buyers may expect.
A law-firm summary of the framework lists the traits of trustworthy AI: valid, reliable, safe, secure, resilient, accountable, transparent, explainable, interpretable, privacy enhanced and fair with harmful biases managed. It also describes four functions:
- Govern: policies, processes and procedures, including legal and regulatory compliance.
- Map: framing the risks, impacts and interdependencies of an AI system.
- Measure: analysing, benchmarking and monitoring AI risk.
- Manage: allocating resources to risks and planning responses to incidents.
NIST calls the framework a living document and expects a review with formal input from the AI community no later than 2028, as the framework text explains.
Privacy sits beside traits such as security and transparency, not in place of them.
What the law gives you
As of a March 2024 commentary from a law firm, the United States had no comprehensive federal privacy law, although multiple states had begun to fill the void. Details of the commentary also show that privacy laws elsewhere tend to apply to any company that processes personal data of covered residents, wherever the company is based.
These laws tend to give individuals more control. The same source says you may be able to:
- request access to the information a company holds about you;
- request deletion of that information;
- receive your data in a format that lets you move it to another organisation;
- refuse consent to tracking or the sale of your data.
The EU’s General Data Protection Regulation allows data protection authorities to fine companies up to €20 million or 4 percent of worldwide annual revenue, depending on the provision violated. As of that March 2024 commentary, European negotiators had also reached a political agreement on the Artificial Intelligence Act, with fines ranging from €7.5 million or 1.5% of global turnover to €35 million or 7% of global turnover. Check the final text and current status before relying on those numbers.
Privacy practitioners often assess risk with the Fair Information Practice Principles, which include minimization, transparency, security and individual participation. Many AI rules borrow from them, so they are a handy yardstick for any AI product you use.
Practical steps you can take
You cannot audit a model yourself, but you can control what you hand over and what you ask for. These steps follow the principles and rights described above:
- Look for disclosure. NIST’s generative AI actions include telling end users when generative AI is used, so ask if a service does not say.
- Share less. Minimization means organisations should collect only the information they need for their stated purpose, and you can apply the same rule to what you type or upload.
- Read the notice. Under purpose specification, uses should be limited to those disclosed when the data was collected.
- Use your rights. Where your local law allows it, ask for access to, or deletion of, the data a company holds about you.
- Decline tracking. Where the option exists, refuse consent to tracking or the sale of your data.
Organisations have their own list. The NIST profile summary mentions curating high-quality datasets, running periodic audits, and considering synthetic data in place of real-world data so models can match statistical properties without disclosing personally identifiable information.
The March 2024 commentary adds that new laws may require a privacy impact assessment before sensitive or novel data processing begins. This guide is general education, not legal advice.
Frequently asked questions
Is the NIST AI framework a law?
Show answer
No. The March 2024 commentary describes the AI Risk Management Framework as voluntary guidance for using, designing or deploying AI systems.
Do privacy laws apply if a company is based abroad?
Show answer
Often, yes. The March 2024 commentary says such laws tend to apply to any company that processes personal data of covered residents, even without a physical presence in that jurisdiction.
What is synthetic data?
Show answer
In NIST’s generative AI actions, synthetic data is used in place of real-world data to train models. The aim is to match the statistical properties of real data without disclosing personally identifiable information.
Can I ask a company to delete my data?
Show answer
Laws described in the March 2024 commentary let individuals request deletion of the information companies hold about them. Whether you have that right depends on where you live, so check your local rules.
