FPF Submits Comments to the Office of Management and Budget on AI and Privacy Impact Assessments

On April 1, 2024, the Future of Privacy Forum filed comments to the Office of Management and Budget (OMB) in response to the agency’s Request for Information on how privacy impact assessments (PIAs) may mitigate privacy risks exacerbated by AI and other advances in technology. The OMB issued the RFI pursuant to the White House’s Executive Order 14110 on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence.

As privacy impact assessments are a well-established means for both public and private entities to assess privacy risks in their services, products, and programs, there is a tremendous opportunity for federal agencies to apply learnings from existing data privacy to the challenges that AI presents as a rapidly evolving technology.

In our submission, FPF provides several recommendations to the OMB, including:

1. Clearly defining the scope of PIAs for AI to explicitly encompass considerations of all risks posed by the processing of personal data, including algorithmic discrimination;

2. Recognizing that risks addressed in a PIA, including discrimination risks, should be complementary to, and neither a replacement nor a repetition of, a comprehensive AI risk assessment or other AI-related assessment; and

3. Ensuring that the scope and substance of a PIA for AI tools account for role-specific responsibilities and capabilities in the AI system lifecycle.

Given that AI can create risks for individuals, communities, and societies, it is imperative to ensure that organizations perform a risk analysis on their use of AI tools, especially when such tools are used to make consequential decisions.

The comments highlight FPF’s long-standing work in the area of AI and risk assessments, including FPF’s Best Practices for AI and Workplace Assessment Technologies and Unfairness by Algorithm: Distilling the Harms of Automated Decision-Making.

“Whether conducted by the public sector, private companies, or other entities, privacy impact assessments can play an important role in evaluating and mitigating certain risks associated with technology. As the federal government now looks to determine the usefulness of privacy impact assessments for responsible AI governance and development, FPF looks forward to continuing to provide insights to policymakers and companies alike as they grapple with the unique privacy challenges associated with the use of AI tools and other emerging technologies.”

– Anne J. Flanagan, FPF Vice President for Artificial Intelligence