One of the most-anticipated sessions at our recent Employee Empowerment Summit was with Ali Shah, Head of Technology Policy at the UK Information Commissioner’s Office (ICO). As part of the UK’s regulatory body for information rights and data privacy for individuals, Ali is an expert on the legal issues that can arise when artificial intelligence and machine learning (AI/ML) technologies interact with personal data and we’re thankful he was able to share some of his insight with our attendees.

Many organizations considering AI/ML solutions (such as the Cultivate platform) pay close attention to how these solutions comply with and adapt to global privacy regulations. In a conversation with Cultivate Director of Global Privacy and Legal, Josh Pittel, Ali explained that focusing on employee empowerment can help organizations navigate privacy regulations successfully. You can watch the entire video session below, or continue reading for all the highlights (NOTE: all insights are from Ali unless noted otherwise).

The law doesn’t restrict innovation

Ali worked with AI/ML technologies before joining the ICO and maintains that the law still allows businesses to innovate with new technologies. In his words, there is a “pathway through” the law for companies that use AI/ML responsibly. After all, the point of regulation isn’t to stifle innovation – it’s to make sure issues like privacy don’t get left behind in pursuit of it.

Context matters

AI/ML technology doesn’t automatically constitute a privacy violation – according to Ali, the intent of the technology matters. Products intended to help the business at the expense of the employee will face more regulatory scrutiny for using personal data. For example, if technology is used to make inferences that affect hiring, firing, or calculating bonuses for employees, they will require much more documentation and face a higher bar to prove legality. If the AI/ML calculations are localized to employees and managers and focused on empowerment, the standards will likely be lower. To Ali, there are two main questions: is the use case appropriate, regardless of technology? And if so, is AI/ML the right tool for that particular use case?

Apply a design constraint to your thinking

One way businesses can anticipate legal or privacy issues with AI/ML technology is to apply a constraint to their thinking. Specifically, Ali recommends asking “To what degree do we need to process personal data to achieve this outcome?” For instance, if ML is being used to find patterns in data that are being provided to employees for their own knowledge and benefit, and the appropriate controls are placed around how that data is used, everything is likely fine. On the other hand, a situation where ML is being used to suss out things about employees personal lives that might affect their employment status, or affect them based on gender or race, is not appropriate.

Other questions that Ali recommends asking to make sure AI/ML is being used appropriately include:

    • How might we assess if this is in the best interest of the employee?
    • How might we assess if this data and any inferences we generate will be used for other purposes?
    • How might we include the consent of the employee, recognizing the power imbalance between employee and employer?
    • How might we understand how the solution would affect different types of employees – consider race, gender etc.
    • Who is the “they” that this product is meant to help?

    More detailed information from the ICO on how to comply with UK privacy regulations is available here.

    Think about unintended consequences

    Ali ended his talk by saying “If you’re not thinking about unintended consequences or the ways the systems can fail – the failure modes around the governance you’re putting in place – you’re not being responsible.” Everyone involved in developing or using AI/ML products should consider the ethical implications of the technology and take that into account in their decisions.

    Employee empowerment is the right mindset

    Ali emphasized more than once that thinking about employee empowerment is the right mindset when considering AI/ML. In fact, the event’s focus on empowerment was why he agreed to speak! Most tech employees are used to focusing heavily on the customer. To use AI/ML tools appropriately, companies need to apply that same level of obsession to their employees. That mindset will help them make good decisions about how to use the technology. In Ali’s words, ”things go wrong when the focus on the employee is not there.” Wise words that we all should take to heart as we explore the potential of AI/ML in the HR and People analytics space.

    Stay tuned over the coming weeks for more video recaps from Employee Empowerment Summit presentations from executives at SAP, Partners for Wellbeing, and more.


Cultivate is a digital leadership platform that leverages artificial intelligence (AI) to provide in-the-moment feedback and tools to enterprise employees. Our mission is to help build stronger workplace relationships, and empower people leaders and employees to be more effective, engaged, and balanced.