UK Information Commissioner responds to Government's AI White Paper

On 11 April 2023, the UK Information Commissioner (ICO) published its response to the UK Government's consultation in respect of the Office for Artificial Intelligence's White Paper entitled "A pro-innovation approach to AI regulation" and the related UK AI regulation impact assessment.

The role of regulators

The ICO's response highlights a number of issues including the role of regulators. While welcoming the Government's intention to create a central function to oversee the AI regulatory landscape and bring together regulators to collaborate on certain activities such as joint regulatory guidance, the response observes that it is the regulators who will be responsible for producing guidance and advice which conforms with the laws that they supervise separately from the Government.  

In view of this, the response calls for clarification on the specific tasks of both the regulators and the Government in issuing such guidance and advice and encourages the Government to collaborate with regulators to achieve its aims, especially through the Digital Regulation Cooperation Forum (DRCF), which is already involved in considering the ramifications of new AI applications, coordinating regulatory positions in respect of AI and establishing integrated support to AI developers, among other things.

Proposed statutory duty and suggested AI principles

The proposed statutory duty and suggested AI principles outlined in the White Paper, which are similar to the principles underpinning the UK data protection framework, are also highlighted.  The ICO notes its willingness to work closely with the Government to make sure that the suggested principles are elucidated in a way that ensures consistency with the data protection principles to minimise additional complexities and difficulties for businesses.

Regarding the White Paper's proposed "fairness" principle, the ICO believes that this should cover the stages of development and deployment of AI systems as well as their use and suggests certain amendments to the definition of the principle to clarify this. 

The ICO notes that the "contestability and redress" principle requires regulators both to clarify existing avenues to contestability and redress and to put in place proportionate measures to ensure the contestability of the outcome of the use of AI where relevant, but observes that usually organisations using AI that have oversight of their own systems are expected to do this.  Clarification of this point is requested, with the ICO suggesting that the role of regulators (including the ICO) may be more akin to raising the awareness of individuals regarding their rights in the context of AI.

UK GDPR Article 22 (which relates to automated individual decision-making, including profiling) is also discussed.  The response observes that the White Paper requires regulators, where decisions involving the use of AI systems have legal or similarly significant effects on individuals, to consider requiring AI system operators to provide appropriate justifications for such decisions to affected parties.  The ICO stresses that, if AI systems are using personal data and if Article 22 of the UK GDPR is relevant, then it is already a requirement for relevant AI system operators to be able to provide such a justification, not just a consideration, so clarification of this point is suggested.

The need for regulators to apply the AI principles set out in the White Paper in a way which is consistent with the UK data protection principles is also emphasised, especially as many AI systems process personal data, to reduce unnecessary burdens and complexities for businesses.

The format of proposed guidance

The response notes that the White Paper proposes that regulators produce joint guidance for businesses to promote clarity.  The ICO suggests that the Government should investigate the type of guidance that would be helpful to a broad cross section of AI developers before going ahead and opines that sector-specific or use-case-specific guidance will probably be more useful to AI developers than joined-up guidance on each non-statutory principle.

The design of the proposed sandbox

The White Paper's proposal to create a joint regulatory sandbox to coordinate cross-sectoral regulatory advice, which could help AI developers to clarify how the law will apply to them, is welcomed.  Again, the ICO suggests investigating the type of service that a wide range of AI developers would find useful before proceeding and makes a number of recommendations in this regard.  These include: 

• extending the scope of the sandbox to cover all digital innovation, rather than just AI; 
• designing the sandbox to provide timely advice that aligns with AI development lifecycles to assist businesses requiring clarity on the law; and
• prioritising support to innovators consistent with international best practice, focusing on: (i) the degree of innovation relative to existing products or business models; (ii) the level of regulatory barriers faced or support required; and (iii) the potential for wider economic, social or environmental benefits.  This should ensure that resources reach the most impactful innovations.

The ICO suggests that the Government should work closely with the DRCF to develop its ideas, noting that the ICO and DRCF are already engaged in a project to research, design and pilot a multi-agency advice service that responds to the needs of digital innovators.

Cost implications of the proposals

Finally, while the ICO endorses the Government's intention to provide greater clarity to businesses on how AI regulations apply in their respective sectors or to their respective use cases, it notes that this will result in additional costs to the relevant regulators and requests further discussions with the Government regarding the funding which will be needed to ensure that the proposals can be successfully implemented.

The ICO's response makes it clear that it is supportive of the Government's aims of making the UK a global leader in developing AI businesses and realising the growth and many potential benefits that AI can bring, endorsing the Government's context-specific, risk-based, proportionate and agile approach to AI.  The Government consultation is due to close on 21 June 2023.  It will be interesting to see what other responses are received and what impact such responses will ultimately have on the Government's pro-innovation approach to AI regulation in the UK.