A Community Charter on Data & AI

People and organisations should prioritise public benefit in all data and AI projects. Public good can mean a lot of things, from operational efficiencies to saving lives. Residents especially want to see data and AI used to improve existing services. While projects should focus on the City Region first, residents would like to see other areas benefit from the research and projects developed here.

It is expected that personal data about residents is kept safe. Projects and organisations should keep personal data secure when stored, transmitted and processed. The Five Safes should be core principles for personal and identifiable data safety and security. All organisations must already follow UK General Data Protection Regulations for information security.

Design in accountability from the start. It should be clear who takes responsibility when something goes wrong in data and AI development and decision-making. That means defining who is responsible for: addressing bias in datasets and algorithms; correcting and updating algorithms; monitoring algorithms that are in use; and training front-line staff on algorithm use, benefits and limits. Make it clear to service users who should be contacted if someone wants to challenge a decision made by an algorithm.

Residents want to be able to know what is happening with their data at scale. Transparency is a key building block of trustworthy practice. It is expected that data and AI projects, and how they use data, are reported in a publicly accessible register. Descriptions of projects must be written in plain English and understandable to residents.

Residents want everyone to benefit from data and AI projects. State clearly who data and AI projects are intended to benefit. When relevant, consult and engage that community throughout the project. Ensure data and AI projects do not reinforce existing inequities.

Privacy, in this case, is about residents’ ability to live a life free of the negative impacts of data and AI. There should always be an option to opt out of data sharing and AI use. This also includes keeping sensitive information private. Make sure that data re-identification does not harm communities. Data and AI usage in the LCR should not make community hardships and inequities worse.

Data and AI law are constantly developing in the UK. Under existing law, data breaches and misuse must be reported within organisations. They must then be escalated to the Information Commissioner’s Office where appropriate. All organisations are expected to meet the existing legal requirements for secure and safe data sharing. Examples include UK GDPR, the Common Law Duty of Confidentiality for health, and broader legislation like the Equality Act 2010.

It is expected that organisations and projects report back on the outcomes of their data and AI use in a publicly accessible register. This is a key way to demonstrate trustworthy practice as it shows alignment to the other principles. For residents to trust organisational use of data and AI it must be understandable. That means flagging deployed projects which use AI.

Project descriptions should include sharing information on risks and mitigations. Projects could lose the stamp of the Charter if they do not report on the risks and mitigations of their data use. The three original signing bodies are responsible for publicly reporting on these data and AI projects, including risks, in the aforementioned public register. They should create processes for overseeing this requirement.

Residents want the LCR to lead the way in community-led data innovation. Data silos and bureaucratic process should not prevent this progress. However, innovation should not cause harm. While AI may mean job losses, every effort should be made to retrain and upskill the local workforce. Residents want to see their community and environment protected. Environmental sustainability should be addressed in digital and physical data infrastructure.

Data and AI technologies are constantly evolving. It is expected that the Charter evolves with them as a living document. A review of the Charter and signing organisations’ use of data and AI is expected at least every two years. Organisations and projects will be kitemarked to the 11 principles. This review must be independent of signing organisations and inclusive of residents to ensure external oversight.