The use of artificial intelligence (AI) technologies by state structures without prior risk analysis can lead to serious and large-scale violations in personal data protection and confidential information, Andres Ojaver, data privacy legal consultant at Hedman and lecturer on AI and personal data protection at Tallinn University of Technology, stated at the 8th Summit of IT Leaders of State Institutions in Baku, Report informs.
"When a human makes a mistake, they are unable to commit it at high speed and on a significant scale. But AI technologies amplify such missteps manifold, which risks a complete loss of control over the situation," A. Ojaver emphasized.
As the expert noted, when integrating AI systems into public sector operations, key priorities include ensuring cybersecurity, complying with personal data protection laws, maintaining confidentiality, as well as addressing issues related to public procurement and the allocation of organizational responsibility.
The specialist stressed that artificial intelligence does not alter fundamental legal principles in the field of data protection, but it creates conditions for their mass violation. He paid special attention to the need for strict regulation of contractual relationships with software developers and vendors.
Ojaver believes that state agencies must clearly specify the location of data processing as early as the contract signing stage, establish a ban on using citizens' data to train third-party neural networks, and define procedures for the transfer and destruction of information in the event of an IT contractor change. Otherwise, full responsibility for potential incidents and leaks falls directly on the state institution. In addition, the expert pointed out that the integration of AI systems forms a new "attack surface," requiring relevant agencies to continuously build up technical and information protection measures.