Privacy & AI: Living in Harmony | In Conversation with Manisha Aurora & PD

Hello.
The Privacy and Security Innovator Circle
recently introduced their introductory book called Privacy,
API, that stands for Privacy, applied,
proactive, and Innovative.
I'm Peter Psad, co-founder of lightbeam.ai.
And with me, I have the pleasure
of speaking today with minutia.
Aurora Minutia is an experienced general council,
and currently the Global Privacy Council at Verizon
Mana has panned an article in the book on privacy
and artificial intelligence, living and harmony.
Mana, welcome to this podcast.
Thank you so much for having me. My pleasure.
And Manisha, of course, uh, you wanted me
to remind everyone that, um, everything
that you would be speaking would be on your behalf
and would not reflect anything, uh, from your employer.
So with that disclaimer, uh, let's get started.
Misha, the, uh, the topic that you chose for the privacy,
API book, which is Privacy
and Artificial Intelligence, living in Harmony.
I must say it's a very topical subject every other day,
at least I come across one
or the other article around artificial intelligence
and how it tends to kind of impact user privacy.
May I ask you to elaborate a little bit more around what,
uh, drove you to kind
of choose this topic, uh, for this book?
So, um, I'm a big fan of, uh, science fiction
and AI is as close to science fiction as it comes.
Uh, and a lot of things that were en massaged,
like way back, uh, the sci-fi books
and, um, cinema of books are now becoming reality, right.
Um, a Tesla just, um, unveiled their robot optimist,
and this is something that you would only think that it is,
uh, available in a fiction book.
So that has always fascinated me.
And now, uh, being like a subject matter expert in privacy,
I can see, uh, the dark side of ai, the things
and the part, uh, it has to do good,
but also how it can be used for things
that can really impact society adversely.
And the thing is that now it's used everywhere
and by anyone, and there isn't much regulation to make sure
that, uh, we are doing it right.
The challenge is that tech moves like a hundred steps
before legislation.
So even if legislation comes around,
I think we are already too late
because they already one step ahead.
Uh, like when Mark Zuckerberg is giving the interviews at
the Senate and, you know, other places,
like he's talking terms that not many even comprehend,
like what is he even saying?
Mm-hmm. So in terms of that, it's challenging.
I think, uh, the users need to be more savvy.
Uh, they, so innocuously give the data everywhere.
Like, uh, I'm privacy council, I have a deep understanding
of engineering, but if I have
to go buy something on a website, you know,
you have all these consents popping up
and like a whack-a-mole.
I'm just clicking Yes, yes, yes.
Like, right, I, I don't even care, right?
What am I consenting to?
So in terms of that, there is like, uh, yes, AI needs a lot
of data, but then how are they ethically collecting it?
How are they using it? How are they purging it?
And then what is the impact to the consumer?
Like when I like just clicked on a checkbox, did I know
that I have like, uh, sold my soul, so to speak?
So, so it is just interesting.
And the thing is, by the time I sent you the article
and when it was published, I think it's already outdated
because AI and everything in AI moves so fast.
It's just a fascinating place to be in.
Yeah, we are, we are certainly doing our bit
to keep AI moving at a rapid base, obviously,
but believe me, the, the, the, the duration
between you sending the article
and republishing, it was not long enough, um, uh,
that it, everything changed.
But, you know, it's a wonderful piece of article, really.
And actually I personally learned, uh, from it a lot.
Uh, threading back to the point that you were making, uh,
which is we, I think a, a number of the grew up reading, uh,
science fiction and, uh,
just having a wondrous world of science fiction.
Uh, one of the quotes from Arthur C. Clark was actually
that any sufficiently advanced technology is
indistinguishable from magic.
And it's so well captures what the point
that you were making, which is, uh, AI is rapidly
progressing and every day or every week
or every month, we are seeing some new
innovative stuff coming out.
The question that you
as a privacy council obviously are grappling with is, well,
you know, all the data that we are collecting, do
consumers have a, the understanding of
what we are collecting, and B you know, when they consent,
do they actually know what they're consenting to?
Now you, uh, in your opinion, obviously big tech, Facebook,
Microsoft, Google, uh, they all can, uh,
are doing really good work on the, on, uh, on ai, which is,
which is really good.
Uh, I think, uh, as you said, it has, it can have a very,
very negative, uh, after effect as well.
Uh, but uh, that's one of the ways we have
to keep guardrails in some sense for AI to adhere to, uh,
consumer privacy regulations.
Uh, that would be one of the guardrails.
Now, in your experience
and in your opinion, how are big tech companies
managing privacy considerations?
So I think, uh, big tech already is sitting on loads
and loads of data, which they have collected ethically
or not, but they have a lot of data, right?
And I, I think, uh, there is like, um, the, um,
conscious about the fact that, you know, it can be used
for things that was not intended.
So most companies have built like some kind of, uh,
committee or team that look at the AI models
and look at what data goes in.
They are looking at ethically using that data,
and they are looking at making sure, uh, that the impact,
like you can, you know, take data
and you can like, put it in models,
and then you can see the impact of it,
and they'll also analyze the impact to make sure
that there is no deviation, that there is no adverse impact,
um, unknowingly.
So I think data modeling
and ethics in the data modeling are something
that is being espoused by most companies.
Like Microsoft has listed six principles for responsible ai.
One is fairness, one is reliability and safety.
The third is privacy and security.
Uh, four is inclusiveness.
Uh, and then there's transparency and accountability.
So, you know, people are coming with white papers
and guidelines and policies to make sure that AI is used,
uh, to include everyone.
Uh, and because I'll give you an example of, uh, some
of the tools that, uh,
I think a while back there was an employment, uh,
related database,
and, uh, what it did is it went through the thousands
of resumes and it, uh, gave the results as who are the most,
uh, you know, good candidates so
that you can interview them.
And, uh, the funny thing is
that it did not have data for minorities.
It did not have data for women.
So none of those candidates was even given a shot at an
interview for such disparities can come in
because the initial data for modeling was existing data,
and it just perpetuates, uh, the ills of society.
If like so far, like, you know, your DEI is not strong,
and you are using the data for modeling,
your results will result
and perpetuate, uh, the ills of society.
So there has to be some intervention by people
and they need to check, uh, the data quality, like
what is going in for these models.
Also, they need to do like some kind
of analysis post facto saying that, okay, uh,
this was not the intent, but this is the result.
We are le uh, leaving like a large part
of society out of it.
And companies, when they do the modeling,
the intent may be very benign.
They may be looking at, say, houses
or products within a certain range, right?
And, uh, they want to make sure that this is
what we wanna leverage, this is what we wanna sell.
But, uh, the consequence could be
that like you are leaving a huge part of society
or a certain race or ethnicity
because of this criteria,
which is completely driven by business.
Mm-hmm. No, I mean, not be driven by business,
but the impact is that you're le
leaving a lot of people behind.
So to make sure that, you know, you introduce synthetic data
to represent that ethnicity or that race
or that excluded group is very essential when you do the
data modeling and make sure that it's okay.
Also, I think what's critical is that, um, you know,
it's not just like add when you build the model
and then you just like send it out and maybe it works,
but then you have to do it periodically
because things change
and, you know, uh, the impact changes and everything.
Uh, so it needs to be iterative.
It can be like one and done, and okay, I've got a good model
and I'm gonna just go ahead with it.
So, uh, I think there's a lot of work to be done.
AI can do a lot of good,
but at the same time, uh, if there are no guardrails,
there is, there's a lot of harm.
And I like how EU has segregated, um, the risk, right?
Like not all risk is equal.
So they have said that there are,
there's something called unacceptable risk,
and that's, you know, public surveillance that has
to be highly regulated
and some which are high risk, like in employment
or education or whenever you're using these data sets.
Mm-hmm. And then some is limited risk,
like maybe e-commerce is pushing you higher order values,
uh, yeah, not ideal, but that will kill you.
And then there is like minimal risk.
So then we should have the risk gradients
and use it effectively.
But in your experience as an entrepreneur, do you think
that having so much regulation is going
to stifle innovation?
Uh, it's a great question. Back at me.
Uh, so there's always a balance.
Uh, no regulation, having complete Wild, wild West
actually perpetuates the historical ELs of society
as you very eloquently put over there.
So the answer is not no regulation.
At the same time, the answer is not having
so much regulation that only big
tech companies can handle them.
As, as we all understand, the more,
the more regulation there are, there kind
of becomes a barrier to entry for smaller,
more nimble organizations
because they don't have the army of people who, uh,
to require to manage those regulations.
Obviously, in my experience, uh, the frameworks
that are being, uh, espoused right now,
and I particularly like the way GDPR was written, uh,
and the way things have been done with GDPR essentially,
where it is always being positioned as, Hey,
this is the right thing to do.
It's a framework. Um, if you,
and if you're a big organization,
you have a greater responsibility to adhere
to this framework, in which case if you, you know, go out
of line, you probably might get penalized more severely.
But, you know, if you're a small organization, a startup,
uh, you should do your best to adhere to this,
this framework, obviously.
But we are not going to be, we are not the watch talks,
the police that will penalize you in
and all that, uh, as severely
as we would for the large organization.
So I think that inbuilt mechanism,
the error correct correcting mechanism where, you know,
as you grow show should your, you know,
with great power con great responsibility is kind of
that it, is, it, it the way of doing that.
And, and I think that looks really reasonable to me.
Um, here, what we are doing, uh, in California, again,
very good from a consumer standpoint.
I, as a consumer, I'm very thankful, um, to my legislators
for, uh, going all the way out, making sure
that my digital identity, my data belongs to me,
and I have complete control over that data.
And that's where it can become really hard
for organizations large
and small to adhere to such regulations.
But that is why there are technologies available, uh,
which can then help people and organizations large
and small to actually adhere
to those regulations without kind of having an army
of people doing everything manually.
So it's kind of, in some sense, uh, some
of these regulations, uh,
the regulations are invariably good in my mind right now,
where we are at, we are not, I don't think we are at a stage
where everything has become a police state.
The where we are at right now, it kind
of helps more innovation actually in some sense, which is,
which is good again, for the startup, um, ecosystem.
Yeah, hopefully that's
An interesting take.
So now AI is like everywhere
and, uh, you know, uh, I'm a big Star Wars fan,
so even the voice of Elevator,
the original actor is retiring,
but he has given rights, uh, so that they can use AI
and create the dialogue, uh mm-hmm.
And like, you know, the ledger lives on.
So it's interesting times to be in
Indeed, indeed, indeed.
Um, so, uh, there are a number of, uh, budding,
uh, privacy councils
and engineers actually who also have been
or have become infatuated by this topic of privacy, AI
or not, but privacy for sure, and compliance
and regulatory, uh, considerations and so on.
When I talk, uh, I'm often actually no longer surprised
that sometimes people, we just, like,
we just started their privacy journey,
their privacy careers, that they're,
they've been there maybe just under a,
for just under a year actually, as a professional
who has been looking at this
for some time across multiple organizations,
um, large and small.
What advice, if any, would you have, uh, for them?
So, to be very honest, I am an
accidental privacy specialist, right?
Uh, I, uh, was a CEO of a startup and the general counsel,
and given how, uh, you know, lean startups are, I had
to work very closely with engineering teams and designers
and DevOps and I, I was just forced
to learn the lingo, right?
So, uh, having that experience, uh, really, um,
clued me in on privacy, how it marries with engineering,
how it marries with, uh, the legislation and the law.
And I think there is room for experts of every kind, right?
So you could be an engineer
and then you could take your IAPP certifications,
and you could also be leaning
and doing regulatory work, right?
Or you could be an attorney
and then, uh, you could lean into your engineering,
you know, instincts or like be curious about it,
and then that's something that you could leverage.
So it has room
and, you know, there are many talents that can marry
and, uh, pave the path forwards.
The good news is it's so nascent, it's so new
that we need all kinds of talents,
and it's, it's like, uh, right now, uh,
we are all like groping to the way forward.
We don't know what it is.
And we can use like a di a diverse perspective of people
and talents from many fields, not the traditional,
like I'm an engineer, I am a, you know, regulator, I am
a legal person when I'm an attorney.
You know, uh, a lot of these skills can marry
and make you the best privacy professional.
So my advice to anyone who's starting out
or who's keen on this is stay hungry, stay foolish,
Stay hungry, stay foolish, famous, famous words, actually.
Uh, this is lovely.
Thank you so much, uh, Manisha, this is, uh, uh,
an extremely important topic
and great to have your perspective on such a topic.
We actually look forward to hearing from you again
as we do the second edition
or feature editions of the privacy API book.
Until then, um, uh, thank you so much Manisha again,
and folks, uh,
will talk again on a different PO podcast. Thank
You. Thank you so much for
having me. Bye.