Position Statement on Usage of Confidential Data by Private AI Companies to Tackle COVID19

Submitted by Sameer Samal, Nodal Advisor to the Chairperson.

---

An Artificial Intelligence firm, Faculty, that previously worked with the Vote Leave campaign has been awarded a government contract worth £400,000 by the Ministry of Housing, Communities and Local Government to assist the government in tackling the coronavirus pandemic. The company will analyse social media data, credit rating scores and utility bills data which will be procured from social media platforms, credit rating agencies, utility providers and the government to monitor the impact of the pandemic on local communities and react at a higher pace. Political analysts have been questioning the method of granting such government contracts without giving reasonable opportunity to other firms for making competitive bids. In response, ministers have stated that public bodies have been allowed to grant government contracts without competitive bids to swiftly deal with the pandemic and avoid any possible delay. Meanwhile, civil liberties groups are also questioning the way private AI companies are processing confidential data.

This development has highlighted the growing concerns of increasing involvement of private companies in pandemic-related government decisions and its impact on the processing of confidential data by private entities. The EU General Data Protection Regulations and the UK Data Protection Act, 2018 do not inhibit the use of confidential data for coronavirus pandemic response and are covered under regulatory exemptions. Therefore, the controversial collaboration between private AI companies such as Faculty and the government under the garb of coronavirus pandemic raise data privacy concerns.

Faculty has been in the public eye after working with the Vote Leave campaign that supported the “leave” vote in the UK European Union membership referendum. One of the Faculty’s data scientist, Ben Warner, has been working with Dominic Cummings, the chief executive of Vote Leave campaign who is now a chief advisor to Boris Johnson, the Prime Minister of UK on work related to coronavirus pandemic. The private company has already received two government contracts in the past relating to the work on pandemic and such developments, solely, do not raise any suspicion. However, reports reveal that Dominic Cummings, chief advisor to the PM, Ben Warner, a data scientist at Faculty and his brother Marc Warner, chief executive of Faculty, has been attending SAGE (scientific advisory group for emergencies) meetings. SAGE is the UK government’s scientific advisors committee. These incidents do not suggest any controversial issues but when all the developments are integrated, they raise serious questions. The meetings of Faculty’s senior members with governmental committees, grants of government contracts to Faculty without providing the opportunity to other private AI companies for competitive bids and the long-standing association of these individuals, including Boris Johnson, who was a key figurehead in the “leave” campaign, raise serious speculations against the system’s just claims. The government contracts and other political developments surrounding the method adopted by the government in awarding such contracts are issues of consideration in the House of Commons. Therefore, this Position Statement will restrict itself in considering only the impact of such developments over-processing of confidential data.

As the contents of the contract are not made public yet, third-parties do not know what is permissible under the contract in relation to the processing of confidential data. Regardless of the contents of the contract, a brief understanding of the UK’s data protection laws would demystify the situation. The EU General Data Protection Regulation is transposed into the Data Protection Act, 2018 to better suit the UK laws. As the latter is drafted on the same basis of the GDPR, they share similar exceptions to the rights of data principles. The Data Protection Act provides for exceptions to the provisions safeguarding the individual’s right to data privacy in emergency situations such as the coronavirus pandemic. The UK Supervisory Authority (ICO) has issued various guidelines and statements regarding coronavirus and data protection which states that ICO will take “reasonable and pragmatic” approach in these time and research guidelines have also been published that further the same approach. It has been clarified that legal and regulatory provisions do not interrupt the fight against coronavirus pandemic. Personal data may be processed for the purpose of scientific research and health data may also be collected.

The citizens of EU and UK indeed stand together in the fight against this pandemic on all fronts but such developments create speculations against fair conduct. When regulatory and legal exceptions to the right to data privacy in situations of healthcare emergencies are coupled with controversial methods of awarding government contracts to process such data to private AI companies, the speculations do hold a reasonable ground.

To understand the development, please refer to:

1. https://www.theguardian.com/technology/2020/jun/02/ai-firm-that-worked-with-vote-leave-wins-new-coronavirus-contract

2. https://www.computing.co.uk/news/4012654/coronavirus-gdpr

3. https://www.insideprivacy.com/covid-19/uk-supervisory-authority-issues-statement-on-data-protection-and-coronavirus/

For queries, mail us at editorial@isail.in