Crash course on the Act · Part 8 of 12
Artificial intelligence, big data and blockchain
The FADP is technology-neutral: processing means any handling of personal data, “irrespective of the means and procedures used” (Art. 5 let. d). New technologies therefore do not need a data protection act of their own – the existing rules apply to them too.
Artificial intelligence
The FDPIC has stated that the FADP is directly applicable to AI-supported data processing. This means, among other things:
- Transparency: providers must disclose the purpose for which they process your data (Art. 19) – including whether your inputs are used for training.
- Automated decisions: if an AI alone makes a decision about you, you have the rights under Art. 21 (information, the opportunity to state your view, review by a human).
- Impact assessment: the use of new technologies in particular may entail a high risk that requires a data protection impact assessment (Art. 22 para. 2).
- Accuracy: information that an AI generates about you must also be accurate; you can request correction (Art. 6 para. 5, Art. 32).
Tip: do not enter health data, passwords or confidential documents into chatbots, and check in the settings whether your inputs may be used for training.
Big data
Large-scale data analysis often involves creating profiles in order to predict behaviour or preferences (profiling, Art. 5 let. f). The following are important here:
- Purpose limitation: data may not simply be reused for new purposes that are not recognisable (Art. 6 para. 3).
- Anonymisation: truly anonymous data does not fall under the FADP. However, if a person can be identified again by combining data, it is still personal data.
- Research and statistics: relaxed rules apply for purposes not related to specific persons, provided the data is anonymised and the results are published without reference to individuals (Art. 31 para. 2 let. e).
Blockchain
Even pseudonymous wallet addresses can be personal data if they can be attributed to a person. Because entries in a blockchain can hardly be changed or deleted, this creates tension with the obligations to correct or delete inaccurate data or data that is no longer needed. Privacy-compliant applications therefore avoid storing personal data directly on the blockchain as far as possible. In decentralised networks, it can also be difficult to determine who the controller is.
Read the legal text: Art. 21 FADP – Automated individual decisions.