Course overview

This course examines the implications of AI data poisoning in the insurance sector under South Africa's Protection of Personal Information Act (POPIA). It focuses on the challenges posed by cyber attacks on AI systems, their effects on policyholders, and the obligations of responsible parties under Sections 14 and 14(6). Participants will explore response strategies, scalability for mass data subject requests, and lessons from global precedents, emphasizing the need for automation and proactive compliance to maintain trust and data integrity.

.

Course objectives

By the end of this course, participants will be able to:

1. Understand AI Data Poisoning: Identify techniques such as data injection, mislabeling, and manipulation, and their impacts on AI-driven risk assessments.
2. Assess Policyholder Impacts: Evaluate financial consequences like inflated premiums and denied claims due to compromised data.
3. Apply POPIA Requirements: Implement data restriction (Section 14) and portability (Section 14(6)) in post-poisoning scenarios.
4. Manage Mass Requests: Develop scalable processes for handling large volumes of data subject requests using automation.
5. Conduct Impact Assessments: Perform Personal Information Impact Assessments (PIIAs) to mitigate risks.
6. Draw Global Lessons: Analyze GDPR-inspired precedents and apply insights to POPIA compliance.

Course outline

Participants will learn about:

Module 1: Introduction to AI Data Poisoning

Scenario Overview: High-stakes insurance AI systems processing data for 1 million policyholders.

Poisoning Techniques: Injection, mislabeling, and manipulation of sensitive personal information.

Module 2: Impacts and Implications

Policyholder Harm: Skewed risk profiles leading to financial repercussions.

Insurer Challenges: Operational, legal, and reputational risks under POPIA.

Module 3: POPIA Obligations

Section 14: Data Restriction: Suspending processing of compromised data.

Section 14(6): Data Portability: Providing machine-readable formats like JSON/CSV.

Module 4: Response Strategies

Automated Systems: Handling mass requests, verification, and secure transfers.

PIIAs and Mitigation: Conducting assessments and implementing safeguards.

Module 5: Scalability and Global Precedents

Mass Request Management: Cost-effective automation and logging.

GDPR Lessons: Fines for inadequate responses and parallels to POPIA.

Module 6: Building Trust for the Future

Proactive Design: Safeguarding against poisoning and ensuring compliance.

Ethical Considerations: Fostering trust in digital processes.