Module 12 Lesson 5: Compliance (GDPR, CCPA) in the age of AI

AI doesn't exist in a legal vacuum. Traditional privacy laws still apply, and new laws (like the EU AI Act) are being written specifically for the AI era.

1. GDPR: The "Explainability" Requirement

Under GDPR, users have a right to "Meaningful information about the logic involved" in automated decision-making.

The Conflict: Deep learning is a "Black Box." If an AI denies someone a loan, the "Logic" is millions of matrix multiplications.
The Compliance: You must implement Explainable AI (XAI) techniques (like SHAP or LIME) to show which factors influenced a specific outcome.

2. CCPA: The "Data Sale" Definition

In California, "Selling Data" is strictly regulated.

The Conflict: If you feed customer data into a third-party AI (like OpenAI) to "Process" it, is that a "Sale"?
The Compliance: You must have a Data Processing Agreement (DPA) that explicitly states the AI provider is a "Service Provider" and cannot use the data for their own independent training purposes.

3. The EU AI Act (The Global Standard)

The new EU AI Act categorizes AI into Risk Levels:

Unacceptable Risk: (e.g., Social Scoring) -> BANNED.
High Risk: (e.g., Hiring, Credit, Policing) -> Strict audit and data quality rules.
Low Risk: (e.g., Chatbots, Spam filters) -> Transparency rules (users must know they are talking to an AI).

4. Record-Keeping and Transparency

To stay compliant, an AI system must maintain:

Logs of all outputs: To audit for bias or errors.
Impact Assessments (DPIA): A document explaining how the AI was tested for privacy and security before it was launched.
Watermarking: Content generated by AI should (in the future) be technically marked so it can't be confused with human-generated "Truth."

Exercise: The Compliance Officer

You are launching a "Recruitment AI." Under the EU AI Act, is this "High Risk" or "Low Risk"?
Why is "Hallucination" a compliance risk? (Hint: Think about the "Right to Accuracy" under GDPR).
If your AI is trained on "Public Data" from Twitter, does that data still fall under GDPR protections?
Research: What is "Section 230" and why is there a debate about whether it protects AI companies from the things their models say?

Summary

You have completed Module 12: Privacy and Data Protection in AI. You now understand that privacy is more than just data protection—it's about memorization, math (Differential Privacy), consent, and the evolving global legal landscape.

Next Module: The Guardrail System: Module 13: Monitoring, Logging, and Incident Response.

Module 12 Lesson 5: AI Compliance