🚨 [AI & PRIVACY] Singapore's Data Protection Authority publishes its "Proposed Guide on Synthetic Data Generation," and it's an interesting read for everyone in AI & privacy. Info & quotes: ➡ Among other topics, the proposed guide discusses a five-step approach to generating synthetic data, especially in the context of a Privacy-Enhancing Technologies (PETs) perspective: ➡ Step 1: Know your data "Before embarking on any synthetic data project, it is necessary to have a clear understanding of the purpose and use cases of the synthetic data and the source data that the synthetic data is to mimic. This will help to determine whether use of synthetic data might be relevant and identify the possible risks of using the synthetic data." ➡ Step 2: Prepare your data "To ensure that the synthetic data can meet the business objectives, organisations need to understand and identify the trends, key statistical properties, and attributerelationships in the source data that need to be preserved for analysis e.g., identify relationships between demographic characteristics of population and their health conditions." ➡ Step 3: Generate synthetic data "There are many different methods to generate synthetic data, for example, sequential tree-based synthesisers, copulas, and deep generative models (DGMs). Organisations need to consider which methods are most appropriate, based on their use cases, data objectives, and types of data. (...)Thereafter, organisations may consider splitting the source data into two separate sets e.g., 80% as training dataset, and 20% as control dataset for assessing re-identification risks of the synthetic data." ➡ Step 4: Assess re-identification risks "After the synthetic data is generated and utility measurement is assessed to be acceptable, organisations should assess and perform the re-identification risk assessment based on their internal acceptance criteria. (...). As synthetic data generally does not replicate its training data points, re-identification risk cannot be deduced directly from scrutinising whether the generated synthetic data contains any personal data." ➡ Step 5: Manage residual risks "In this final step, organisations should identify all potential residual risks and implement appropriate mitigation controls (technical, governance, and contractual) to minimise the identified risks. These risks and controls should be documented and approved by the management and key stakeholders as part of the organisation’s enterprise risk framework." ➡ It's an interesting guide, especially for those involved with AI development and Privacy-Enhancing Technologies (PETs). There is much more to read in this guide by the @PDPCSingapore, make sure to check it out below. ➡ To stay up to date with the latest developments in AI policy & regulation, join 29,300+ people who subscribe to my weekly newsletter (link below).