How does ISO 27563 support privacy in AI systems?

ISO/IEC TR 27563:2023 is a Technical Report titled "Information security, cybersecurity and privacy protection — Artificial intelligence — Privacy-enhancing technologies." Its primary purpose is to provide an overview and guidance on the selection and implementation of various Privacy-Enhancing Technologies (PETs) for Artificial Intelligence systems that process Personally Identifiable Information (PII). The document describes different PETs, such as differential privacy and homomorphic encryption, from a technical perspective, helping organizations mitigate privacy risks associated with AI applications without mandating specific tools.

B. As a Technical Report (TR), this standard provides informative guidance and recommendations; it does not mandate the use of specific encryption algorithms, which would be overly prescriptive.

C. The standard is explicitly designed to provide guidance for AI systems that do process personally identifiable information (PII), rather than limiting their use to non-personal data.

D. The core focus of ISO 27563 is to enhance privacy protection in AI systems, which is contrary to prioritizing performance metrics at the expense of privacy.

1. International Organization for Standardization (ISO). (2023). ISO/IEC TR 27563:2023: Information security

cybersecurity and privacy protection — Artificial intelligence — Privacy-enhancing technologies. Geneva

Switzerland: ISO.

Reference: The scope statement in Section 1 explicitly states

"This document provides an overview of privacy-enhancing technologies (PETs) that can be applied to artificial intelligence (AI) systems which process personally identifiable information (PII)... This document provides guidance on selecting and implementing PETs for AI systems."

2. Stübing

H.

& Kuper

P. (2023). Standardization Landscape for Secure and Trustworthy AI. 2023 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)

310-315.

DOI: https://doi.org/10.1109/EuroSPW59978.2023.00041

Reference: In Section IV

"STANDARDS FOR AI SECURITY AND PRIVACY

" the paper notes: "ISO/IEC TR 27563 provides an overview of privacy-enhancing technologies (PETs) that can be applied to AI systems which process PII." This confirms the standard's role in guiding the use of PETs.