Privacy and AI in research
Personal data must be processed in a way that protects the integrity, confidentiality and availability of the data. You must also act in accordance with the rules for processing personal data and research ethics.
Are you allowed to process personal data in an AI tool?
When you register your project with Sikt Personal Data Services, you must provide information about the planned use of AI and which tool you intend to use. In addition, this must be clearly stated in the information letter to the participants, so that they can make an informed decision about participating in the project.
For example: Before the research begins, you should consider whether you want to use AI and whether you want to anonymize the data. If this is the case, this must be stated in the Sikt registration form and in the information letter to the participants.
What kind of personal data can you enter into an AI tool?
If you want to enter personally identifiable information into an AI tool, you must be aware of two things:
- You should only use AI tools that have a data processing agreement with AHO. Currently, these are UiO GPT-4 and Copilot Enterprise. Read more about using UiO GPT-4 and Copilot via AHO here. Data processing agreements with the providers of these two tools are a legal requirement when other actors are to process personal data on our behalf. UiO GPT-4 and Copilot Enterprise have also promised not to use the data you enter to train the algorithm.
- These two AI tools are only approved for use on green and yellow data. Red and black data (i.e. confidential and strictly confidential information) cannot be safely input into either these AI tools or others.
Green data is open or freely available information.
Yellow data is restricted information that should not be open to everyone, such as many types of personal data or unpublished research.
Red data is confidential information where access should be limited, such as health information or personnel files.
Black data is strictly confidential data that could cause significant damage if the information becomes known to unauthorized parties or is accidentally changed.
Evaluate what the AI tool produces
Generative artificial intelligence is - contrary to what its name suggests - not intelligent. It gives you the most likely answer, based on the data it has access to. This means that AI can make mistakes. As a researcher, you are responsible for ensuring that the content of your research is ethical and correct, regardless of whether an AI tool contributes to errors. You should therefore include your own use of AI in both the ethical assessments and risk assessments you make in your project.
Anonymization of personal data before entering it into an AI tool
Anonymous data can be entered into a KI tool and will not be covered by the regulations surrounding personal data. It is important that the anonymization is done in line with what you have reported to Sikt + the information you have provided to the participants in the research project.
If you did not specify the anonymization or use of AI when you registered the project with Sikt, a change notification to Sikt is required. You must also provide new information to the participants if you still want to keep and/or anonymize the data.
Copyright and AI
Not all types of content can be shared with an AI tool. As a general rule, you cannot upload entire books, articles, music, or images that you do not have the rights to.
What you can share with an AI tool
You can share files or content with an AI tool if:
- You own the content yourself. For example, your own reports, article drafts or notes.
- The content is freely available. For example, books that have fallen into the open or articles with open publication and a free use license (such as CC BY) that accepts that the text is used for AI training.
- You have received permission from the copyright holder.
Why you should be careful
When it comes to sharing content from books and articles, please be aware that:
- Most are copyrighted (unless they are openly published and marked with a free use license (such as CC BY) that allows this).
- Uploading to AI can be considered a reproduction of an intellectual work and thus a violation of copyright.
- Many AI tools will store and use the material further, including in further training the AI model. Therefore, familiarize yourself with the tool's terms of use before sharing content with it.
Tips for researchers on using AI
It is up to you as a researcher to assess whether the way you use AI tools is legitimate and in line with current regulations and legislation.
Accountability and transparency
Being transparent is a central principle in research. You should always be able to refer to what you have done during a research process (method), also when it comes to using AI.
If you for instance use AI to write text, you are responsible for ensuring that the information you reproduce is correct and that you credit and refer to the work of others where it has been used. Remember that it is also considered plagiarism to publish a text written by a machine as your own.
Evaluate the AI tool before use
Training data and sources
How is the tool trained and/or what sources does it obtain information from? For example, is it trained on texts from the internet up to a certain point in time? What does it mean for your use that the tool does not know the world after this point in time? Are the sources from selected databases, where certain fields of study, countries or similar may be underrepresented? Or only from research that is openly available online? Is the tool trained on sources it had legal access to?
Characteristics of the data
What characterizes this type of data? Are there any weaknesses or biases in these data that you need to be aware of when using the tool? Most generative AIs are trained on texts from the internet, which are rarely completely neutral. This will be reflected in the results the tool produces.
Tool functionality
How does the tool work? How are the answers produced, what does the tool actually do? What are the tool's limitations?
For example, is it a language model and chatbot that generates answers based on a prediction algorithm? If so, the algorithm compiles words as answers based on a probability calculation of the words you used in your question/instruction.
Data security
Who is behind the tool? What do others say about the tool?
What do they write about how they use your information and data/texts you share with them? Read the terms of use.
How do they relate to legislation on privacy (GDPR) and copyright and the like?
Check the journals' AI guidelines
Once you know which journal you want to publish in, check if the journal or publisher has guidelines for AI use. For example, if you have used AI in the development of your work, you may be required to sign a declaration that is published with the article or need to include documentation of how you have used AI during the research process.
Responsibility for AI at AHO
Det formelle ansvaret for opplæring av KI ligger ved biblioteket, du kan be om veiledning fra biblioteket i bruk av KI-verktøy. Ved spørsmål om muligheter og restriksjoner på bruk osv., kan du altså kontakte biblioteket og be om en veiledningstime.
The formal responsibility for AI training at AHO lies with the library. If you have questions about possibilities and restrictions on use or request guidance from the library in using AI tools etc., you can contact the library.
All questions related to security and privacy can be directed to the CISO (Chief Information Security Officer) via the IT Support system.