# A Systematic Review of Responsible Artificial Intelligence Principles and Practice
## 7 Finding 5: Principles of Responsible AI
### Privacy and Data Protection  
Privacy and data protection by design are critical principles, especially when AI systems rely on data. This principle ensures the protection of individuals' personal information and promotes secure data practices, addressing privacy concerns and mitigating potential data breaches or unauthorized access [83]. Ethical AI guidelines highlight the need for privacy to build trust in AI systems [31; 65]. The increasing reliance on AI systems that utilize vast amounts of personal data raises significant ethical concerns [71]. Organizations take extra precautions, including adding roles specific to data privacy, such as data privacy officers, to mitigate privacy risks, which can severely damage a company's reputation [31]. Not only that, there are role-level accountability contracts in place by some organizations where they define boundaries for responsibility and identify who should be held accountable when an AI system misbehaves [75]. Complying with policies and standards is considered the best approach to reduce privacy risks [31]. Application domains involving highly sensitive data, such as healthcare innovations, must align with legislation, rules, and privacy standards to ensure privacy while benefiting the public [31]. With the growing number of data breaches, governments are actively working on forming policies to regulate data privacy [72]. The European Union (EU) led the policy-making process with the General Data Protection Regulation (GDPR), which includes strict measures and hefty fines to protect user privacy [79]. The data protection impact assessment (DPIA) is a mandate for any application that poses a risk to data privacy in many privacy policies, including GDPR [79]. Privacy risks exist across multiple phases of the AI lifecycle [76; 85]. Data-hungry deep neural networks require continuous data collection processes to capture massive amounts of training data. For example, [86] discussed the privacy leakages and vulnerabilities in ChatGPT, which was trained on massive amounts of data scraped from the internet. Even though organizations such as OpenAI adopt privacy policies, perfect compliance with these policies remains a significant challenge [86]. Key privacy protection measures include data anonymization and encryption [74], stringent data protection protocols [71], and robust data governance practices [74]. Privacy-preserving machine learning techniques like federated learning enable AI models to be trained across multiple decentralized data sources while maintaining security and privacy guarantees [76]. Organizations must ensure informed consent about data usage [71; 74] and implement data minimization practices to collect only necessary information [70]. By embracing privacy by design and implementing comprehensive data protection measures, responsible AI frameworks uphold individuals' rights and contribute to the establishment of a secure and trustworthy AI ecosystem [71]. Beyond privacy preserving, it allows users to have absolute control over how their data is being used, and they are paid accordingly, achieving data dignity [58]. This approach helps maintain public trust while ensuring compliance with evolving privacy regulations and ethical standards.