دانلود کتاب RAG از اصول اولیه

The rise of AI has made it emphatically clear that the individual control model is doomed. AI is far too vast and complicated for individuals to understand and to assess the impact on their privacy. Instead of trying to provide individuals with control over their data, the law should bring the collection and use of data under control. Although in some circumstances privacy rights can be helpful, privacy laws should stop relying on them so heavily and focus more on structural measures that don’t place the burden on individuals. Effective privacy protection must focus on the architecture of the modern digital economy; it must impose meaningful duties on organizations to avoid risks and harms; and it must hold organizations accountable in meaningful ways.
The purpose of this book is to provide practical and actionable guidance to organizations on how to implement structural measures to protect the privacy of individuals whose personal information is contained in the data the organizations collect and use in order to comply with a fundamental yet often ambiguous principle of global data protection regulations: the principle of data minimization. The ambition is to develop industry best practices that, if followed, guarantee that there is no unnecessary personal information in the data. For this purpose, we bring together industry and academic experts contributing their knowledge to this effort.
The best practices take the form of lists of identifiers commonly present in data sets for different use cases across different industries and recommendations as to which ones do and do not need to be included in the data for each use case.
We hope for the downstream consequences to be (1) that organizations are confident that, when following the practices we set out here, they will be compliant with data protection laws and regulations as far as data minimization requirements are concerned; (2) reducing the burden on individuals by making optimal data protection the default without individuals having to request it; and (3) a guide for regulators to rely on when setting out meaningful rules specifying data minimization requirements across different use cases and industries.
The motivation for this book stems from the gap we observe between the legal requirements and the operationalization of personal data minimization, on the one hand, and the misconception that personal data minimization and the age of Big Data and Artificial Intelligence (AI) are in an unsolvable tension and that data anonymization is impossible in this context. The best practices set out here aim to close this gap and debunk these misconceptions. The worry around these misconceptions is that robust data protection mechanisms, such as data minimization and anonymization, are dismissed outright based on mistaken assumptions about these techniques, leaving personal data exposed unnecessarily. This would be an unfortunate outcome for individuals as well as for businesses that have missed opportunities to build customer trust and protect themselves against non-compliance claims, litigation, and data breach costs.
To start things off, we take a close look at the concepts of personally identifiable information and data minimization, clarifying what direct and indirect identifiers are and which ones should be considered sensitive and hence worthy of special protection. We cover how data minimization and purpose limitation go hand in hand and provide more details on why data minimization is important from a business perspective.