At Rise of AI 2023 in Berlin, Marian Gläser, co-founder and CEO of brighter AI, argues that data privacy regulation is a permanent, worldwide feature of AI development rather than a temporary obstacle. He traces privacy's legal history from a 1361 anti-stalking law and 1888 camera-driven concerns through the UN's 1948 recognition of privacy as a fundamental right to the 2018 GDPR and today's landscape, where Gartner predicts 75% of the world's population will be covered by some data privacy regulation. Using the example of a tier-one automotive company collecting camera data in Europe, labeling it in Brazil, training models in the US and validating them in Japan, he shows how GDPR, Brazil's LGPD, US state laws and Japanese norms each impose different, non-consent-based compliance burdens on the same data pipeline. He describes brighter AI's own anonymization work, including replacing faces and license plates with artificial ones for a public Valeo dataset, and argues that companies like his let clients forget about regulation by handling privacy continuously, so that innovation and privacy can be pursued together rather than traded off against each other.
Key takeaways
- Gartner predicts 75% of the world's population will eventually be covered by some form of data privacy regulation, according to Gläser.
- Violations of data privacy regulation have already resulted in almost 3 billion euros in fines.
- A single automotive AI data pipeline can cross GDPR, Brazil's privacy law, US state laws and Japanese norms as data moves through collection, labeling, training and validation.
- brighter AI anonymized about 15,000 images with artificial faces and license plates so Valeo could publish a fisheye camera dataset in 2019.
- Gläser defines effective anonymization as data from which an individual cannot feasibly be reconstructed given realistic time, effort and resources, rather than absolute unidentifiability.
Detailed notes
Why privacy still matters
Gläser opens by asking whether privacy is still "a thing" given how routinely people click away consent forms, then traces the history of its legal recognition: a 1361 law against stalking, the norm against opening others' letters, the 1888 introduction of cameras as a spark for privacy concerns, and the UN's 1948 recognition of privacy as a fundamental human right. He contrasts this with 2010, when Facebook defaulted user data to public and Mark Zuckerberg said privacy was no longer a social norm, the 2011 rise of smartphone tracking, and the 2012 shutdown of the "Girls Around Me" app. He argues privacy matters concretely beyond accepting terms, using the example of an app called PimEyes that can identify a person and surface their online profile, meetups and private details from a single photo of their face, an identifier that, unlike a password, cannot be changed.
GDPR and a worldwide regulatory landscape
Gläser notes that by 2018 the GDPR was in place, targeting data breaches and principles like data minimization, and that critics call it too restrictive for Europe's competitiveness. He states that violations of data privacy regulation have resulted in almost 3 billion euros in fines, and that Gartner predicts 75% of the world's population will eventually be covered by some form of data privacy regulation, making it, in his view, as unavoidable a cost of doing business as firewalls or access management.
The global data journey of an automotive AI company
Gläser walks through a hypothetical but representative case of a tier-one automotive supplier building self-driving assistance features: data collection in Europe, labeling in Brazil, model training in Silicon Valley, and validation in Japan. He explains that GDPR compliance for on-street data collection is difficult because it is consent-driven and consent from passersby is impractical to obtain, with penalties up to 4% of annual turnover. He notes Brazil's privacy law, introduced around 2020, imposes similarly heavy risk assessments regardless of whether the data is Brazilian or European, US states such as California and increasingly Virginia have their own rules, and Japanese partners, in his company's experience working there earlier that year, tend to approach data privacy as an ethical commitment to their country rather than as regulatory compliance.
Anonymization as a practical solution: the Valeo example
Gläser describes brighter AI's approach to enabling large-scale data use without compromising privacy, including synthetic data, federated learning, differential privacy and k-anonymity as a broader industry toolkit. As his one concrete example, he describes supporting the French tier-one Valeo in 2019 to publicly release a dataset of roughly 15,000 images by anonymizing faces and license plates with artificial replacements, since Valeo's fisheye camera data needed to remain realistic. He quotes his CTO's view that data must be "as raw as possible," arguing that traditional blurring or black bars degrade data too much for training self-driving systems, whereas artificial replacement preserves usability while achieving compliance. He cites Siemens and a US tier-two company as examples of firms building anonymization directly into their data pipelines.
Q&A highlights
Asked whether anonymization affects labeling and model outcomes, Gläser says true anonymization is contested even internally, illustrating with a case involving Deutsche Bahn's 40,000 cameras where a single unblurred point in an image could still identify a staff member if cross-referenced with shift schedules. He offers a practical definition used in the field: data is sufficiently anonymized if it is not feasible to reconstruct an individual's identity given realistic time, effort and resources, and says in automotive datasets with hundreds of thousands of hours of footage, reconstructing identities from artificial faces is not feasible. Asked whether Europe can catch up to the US and China in AI despite GDPR, he argues regulation is not the main cause of Europe's lag, and predicts privacy regulation will stop being a competitive disadvantage as more countries, including the US and Canada, adopt similar rules.
Questions answered in this talk
Why is complying with data privacy regulation difficult for global AI training pipelines?
According to Marian Gläser at Rise of AI 2023, a single pipeline, such as an automotive company collecting data in Europe, labeling it in Brazil, training in the US and validating in Japan, must satisfy different regulations at each step, including GDPR's consent requirements, Brazil's risk assessments, US state laws and Japanese ethical norms.
How does brighter AI make camera data compliant without ruining it for AI training?
Gläser explains that instead of blurring or blacking out faces and license plates, brighter AI replaces them with artificial versions that preserve realistic, usable data for training, as it did for a public dataset released by Valeo in 2019.
What counts as truly anonymized data?
Gläser states that the practical definition used in the field is whether it remains feasible to reconstruct an individual's identity within realistic time, effort and resources; if not, the data counts as anonymized by best practice.