Inadequate Data Retention and Deletion Practices

AI relies heavily on data; large amounts of data are required to train and fine-tune systems. In addition to ordinary business operations, you will likely also be collecting and storing large amounts of data to help power AI systems. Depending on your jurisdiction, you may be subject to data privacy rules and regulations. There are two key data issues to consider as part of AI development and deployment: collection and retention. This entry refers specifically to retention. Please see "inadequate data collection" for more information about proper data practices.

Collecting data on any scale also requires robust data retention policies and procedures. Data retention can be seen as both the storage and appropriate deletion of collected data. Retaining data for a number of years requires measures to protect it from theft or unauthorised access. For instance, in the US, several states have laws that require organisations to implement reasonable safeguards to protect collected data. Additionally, organisations should consider how they securely delete data when it is no longer needed. Depending on where your organisation is located, this may be legally required. For instance, the EU’s GDPR requires organisations to have policies in place to delete data after it is no longer reasonably needed.

The Equifax data breach exposed the personal information of approximately 147 million Americans and led to a settlement of $425 million with consumers and regulatory bodies (including the FTC and CFPB). Equifax were required to pay and improve its security practices.