The information displayed in the AIM should not be reported as representing the official views of the OECD or of its member countries.
Doctolib, a French medical appointment platform, launched an AI clinical research project using pseudonymized health data from users and their relatives without explicit consent. Users are included by default and must manually opt out. This practice constitutes a violation of data protection and privacy rights under applicable law.[AI generated]
Why's our monitor labelling this an incident or hazard?
An AI system is clearly involved, as the project uses AI models for clinical research and health data analysis. The use of sensitive medical data without explicit consent (opt-out default) implicates potential violations of data protection rights and privacy, which are human rights concerns. The data is pseudonymized, not anonymized, so re-identification risk exists. However, no actual harm such as data breaches, misuse, or health injury is reported. The event describes a plausible future risk of harm due to the AI system's use of personal data under these conditions. Hence, it fits the definition of an AI Hazard, not an AI Incident. It is not Complementary Information because the article is not about a response or update to a prior incident but about the announcement and implications of a new AI project. It is not Beneficial Use because the AI system is the source of potential harm (privacy risk), not solely a countermeasure to external harm. It is not Unrelated because the AI system and data use are central to the event.[AI generated]