Robotul Ion, a software application based on artificial intelligence technology, and its operator, the Ministry of Digital Technology, are required to comply with the EU Data Protection Regulation, officials from the National Data Protection Authority (ANSPDCP) told HotNews. .ro on Wednesday, which said “these aspects will be analyzed in accordance with the legal powers of control”.

• “Although there are currently no legislative provisions in Romania to regulate artificial intelligence, since personal data is processed in connection with the mentioned project, the principles and rules for the processing of personal data are established by Regulation (EU) 2016/679 (GDPR).” Representatives of the ANSPDCP sent HotNews.ro on Wednesday.

In a two-page document, the National Data Protection Authority explains what rules should be followed in terms of the EU Data Protection Regulation.

• “Thus, Robotul Ion, software based on technology and artificial intelligence, and its operator are obliged to comply with Regulation (EU) no. 2016/679.
• Therefore, in relation to the content of your queries, we state that the National Supervisory Authority has retained the issues reported to the Ministry of Research, Innovation and Digitalization (“MCID”), the organization that operates the AI-based solution called “Ion Robot” (“The Solution Ion”), they are subject to analysis in accordance with the legal powers of control.”, this is shown in the answers of the authorities.

SEE ANSPDCP SPECIFICATIONS HERE

Does ION collect personal data or not?

The authority responded on Wednesday to a request sent last week by HotNews.ro, in which we pointed out that, although the authorities assured that they do not process the personal data of Romanians who send messages to the government, the privacy policy on the ion.gov.ro website specified , that the Ministry of Digitization also processes the Facebook username of those who post using the @noisuntemion tag.

• Read: How anonymous the Romanian who writes to the government’s ION robot remains / Problem partially fixed, after HotNews.ro report

After HotNews.ro flagged this aspect and asked for a point of view, the ION team corrected on Saturday, March 4, the documents with the Terms of Use as well as the Privacy Policy published on the ION website, removing the paragraphs in which they said, which processes Facebook usernames.

• “It is very important and very clear that the ION AI solution has not taken over and will never take over the personal identification data of Romanians. ION is an AI solution designed to tackle Romanians’ pressing issues in a neutral and non-influential way, to be able to inform governors in a balanced and impartial manner which issues need to be addressed.
• Their identification data is not stored.
• Given that at the moment the ION project is not intended to collect any personal data, there is no question of a violation of the law on personal rights.” sent the ION team after correcting the documents on the site.

The ION team claims that only messages are taken, keeping the source anonymous

Currently on website ion.gov.ro who collects messages from Romanians, writes the following:

• “All messages and data sent through both the ion.gov.ro website and the @noisuntemion social media tag are removed and forwarded, preserving the anonymity of the source. In this way, using artificial intelligence, the citizens of Romania will have a common voice – the voice of the citizens – enabling the governors to implement appropriate public policies according to the evolution of society.” it is shown on the website ion.gov.ro.

The site also says that ION has also received a lot of questions in the first days after launch and that it is in the process of learning: “With your help, ION will learn quickly and will be able to answer you soon.”

Out of 500,000 messages, only positive ones are filtered and displayed

On Wednesday, on the occasion of March 8, was developed by representatives of the Ministry of Digitization and a team of volunteers of the ION project text on behalf of IONwhich states that Romanians sent 500,000 messages.

• “You have asked me a lot this week, and I have kept some questions and some concerns, such as those related to the protection of personal data,” the text on the ministry’s website reads without further details.

The only messages are on the website ion.gov.ro, where only positive ones are filtered and published, for example: “Ionika, learn only good things!” or “I hope you will be the fire that ignites the digitization of Romania!” Or at least the Romanian government!

In addition, new guarantees are provided that personal data is not collected:

• “I want to tell you that the only information I have taken from myself is what you want to convey in the message posted on my website. Neither the administrator nor any other involved person will receive your personal data. My system is designed in such a way that the location data or IP addresses of those who send me messages are not collected.
• In addition, in the case of receiving information from social media, the technology has been designed in such a way as to receive only the message published by the user using “@noisuntemion”, without receiving other data related to the identification of the user (profile identification, first name, last name, etc.). The technology scans and retrieves messages containing “@noisuntemion” without performing web crawling on the social platforms where the message is posted.”, this is also stated in the text on the website of the ministry.

Tudor Galosh, GDPR consultant: Posting on social networks, even without information about the person who posted it, can lead to personal identification

On the other hand, GDPR experts consulted by HotNews.ro have shown that a post on Facebook, even without obtaining details related to the person who posted it, can lead to the identification of that person.

• “A social media post, even without details about the person who posted it, can lead to the identification of the relevant person by simply searching the text of the post, which will lead to the person who first posted it.
• As a result, a post on social networks is a personal meeting.
• Indeed, the risk to data subjects is significantly reduced if the data subject’s account name is not processed, but I believe that a full DPIA should be carried out that can clearly identify all the risks associated with data processing. items in order to be able to at the appropriate address.” Tudor Galosh, GDPR consultant, told HotNews.ro on Saturday.

He also pointed out other aspects that still raise questions related to data processing with the ION Artificial Intelligence solution.

• “From the new privacy policy of the ION technology, details about the data retention policy (time for which personal data is stored), details about third parties involved in the processing (for example, if STS – a special telecommunications service) provide part of the hosting should be mentioned), the rights of interested persons (access, correction, deletion, restriction, objection, export, withdrawal of consent, etc.) and the method of their implementation,” added Tudor Galosh.

ION will also collect voice data, which is also personal data under the GDPR

In addition, in the future, the ION decision will also collect the vote of those who want to send messages through the ion.gov.ro website.

• “The data we receive through the Site, including but not limited to text messages, social media posts, your voice, is not accompanied by any identifier, so it is anonymized at the time it is received to remain anonymous.” says the new document with conditions.

And the voice is considered personal data according to the EU Data Protection Regulation.

• VIEW THE TERMS AND CONDITIONS DOCUMENT HERE

Other articles about the ION robot:

• PHOTO/VIDEO Ciucă received artificial intelligence. “Surprise” announced by the Prime Minister: Advisor “Ion”, the first 100% Romanian AI project
• The ION robot, accused of theft, apologizes / the reaction of the City Hall of Syugud and the opinions of experts