Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / The Convergence of AI, Privacy and Crypto

Transcript

The Convergence of AI, Privacy and Crypto · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  Indeed, which can be used, but what about privacy when it comes
• 0:03
  to crypto, AI and all these things combined?
• 0:05
  Because AI creates privacy concerns and then crypto was
• 0:10
  alleviating privacy concerns. So crypto was being seen as
• 0:13
  something protecting privacy. So what is happening with the
• 0:15
  crypto AI combined? OK, it's a good question, but
• 0:21
  beforehand I have to I it, it will be better to to approach
• 0:26
  this topic from another approach.
• 0:29
  As I I, I explained, I made Ms brief explanation about KYC AM L
• 0:34
  for the KYC AM L or on boarding process, you should collect a
• 0:38
  lot of personal data. OK, but this contradicts with
• 0:45
  the GDPR or Turkish version KVKK data protection legislation.
• 0:51
  Because these registrations also enforce you data minimization.
• 0:57
  You should collect minimal data for your business process,
• 1:02
  right? Or according to contract or
• 1:04
  according to the agreement you did you do with your customers.
• 1:09
  This contradicts I mean FATF or rules and forced you to collect
• 1:15
  a lot of information data to analyse the frozen activity.
• 1:21
  But GT Park or other data protection rules stops you or
• 1:28
  minimal or minimal minimise you and force you to to get minimise
• 1:34
  information data from the customer.
• 1:37
  And now we are adding another dimension.
• 1:40
  AIAI systems using should be trained as a vast amount of
• 1:50
  data. And if you want a strong AI
• 1:54
  tool, you should train train them with similar features with
• 2:00
  real data. In this in this regard, if you
• 2:06
  want to comply with data protection KYC rules and if you
• 2:14
  implement AI systems into the process, you should be define
• 2:23
  the context of your business requirements.
• 2:28
  In the context all we know we have organisation, vision,
• 2:32
  mission, legislative requirements, restrictions, the
• 2:38
  ecosystem you're operating, you should first know and then
• 2:42
  define the baseline control baseline.
• 2:47
  I am trying to explain that it you have there's a
• 2:51
  contradiction, there's a problem because you need data, but GDPR
• 2:55
  or other data protection authorities or legislation wants
• 3:01
  you to be careful about using collecting the data.
• 3:07
  Now you should find an optimum point, the help of understanding
• 3:15
  your business context. In the business context, there
• 3:18
  are different factors, some of them are extremely valuable and
• 3:24
  necessary. Some of them are you should
• 3:28
  leave them behind. And legislative requirements are
• 3:32
  extremely important nowadays because legislative authorities,
• 3:36
  some cases may stop all your business process and protecting
• 3:43
  or respecting the privacy issues now is extremely important in
• 3:48
  digital trust understanding. All we know of there is an
• 3:52
  organisation Edelman and from 2001, Edelman is publishing or
• 3:59
  publishing a report Edelman trust parameter in parameter in
• 4:04
  this report, it says in a few years before when I was reading,
• 4:08
  I saw it, the customers now claiming 65% of customers sees
• 4:16
  data privacy as a factor which effects their decision to go
• 4:24
  with the service or not. If they if they if they don't
• 4:28
  believe the company does not respect their data, they may not
• 4:34
  go to buy your service or your protection.
• 4:39
  And it's extremely important in crypto ecosystem too.
• 4:43
  If they and the clients in this sector, clients are very
• 4:47
  curious, they are more technology oriented, they use
• 4:51
  social media very efficiently. You can see a lot of clients
• 4:56
  spending time in Discord channels, select channels or
• 5:01
  Twitter. If they suspect you are
• 5:05
  violating their data privacy issue or their rights in data
• 5:10
  assets protection, you'll see your company's name in Twitter.
• 5:16
  High what you said. Hi, what do you say in Punit?
• 5:23
  I think higher in in the rankings and basically the
• 5:27
  concept you're saying is let's say I'm browsing a site and
• 5:31
  later on I see an ad in Twitter. So customers see that this
• 5:35
  company is not protecting my data because they were sharing
• 5:39
  with Twitter. Because otherwise how does
• 5:40
  Twitter or Facebook or LinkedIn know that I was on website XYZ?
• 5:46
  But you're saying it exactly right.
• 5:48
  I think ISO 27,701 or 42,001 also talk about when you're
• 5:54
  applying AI or privacy or anything in your organisation.
• 5:58
  Look at the external context. What is the company, what is the
• 6:02
  regulatory landscape, what is the society landscape, What is
• 6:06
  the legal landscape, What is the environmental landscape in which
• 6:10
  you are? Then look at the organisational,
• 6:12
  the values, the behaviours, the differentiation you want to make
• 6:17
  in the market and then decide on your strategy, whether it's for
• 6:21
  privacy or AI, and then build your privacy policy or AI
• 6:24
  policy. That's what we teach in the ISO
• 6:27
  42,001. We teach when we talk about in
• 6:30
  ISO 27,701. Let's start with that
• 6:33
  contextualization and then apply because GDPR, for example, as
• 6:37
  you said, it allows you to do the business, but with the
• 6:40
  necessary data, not too much, not too little.
• 6:44
  Choose the right data and then you have to do KYCKYC is another
• 6:47
  legislation. So apply KYC and GDPR in tandem,
• 6:51
  collect the right amount of data.
• 6:52
  And of course your AI is data hungry, needs vast amount of
• 6:56
  data, yes. So for that you train it, as you
• 6:59
  rightly said, with the vast amount of data, but synthetic
• 7:03
  data, not real data. Use synthetic data created based
• 7:07
  on probably your actual data. Train it, train it well, test
• 7:11
  it, and then when you launch, allow it to read the necessary
• 7:15
  data.