隱含式數據收集與不透明同意
Deployment
Risk Description
Many AI systems collect behavioral data through embedded SDKs, browser extensions, or background services without user awareness or adequate understanding. Consent mechanisms are often presented as lengthy legal documents, making it practically difficult for users to understand data usage scope. More seriously, some data collection is hidden behind vague descriptions like "service quality improvement," exceeding users reasonable expectations.
Framework Mappings
iso 23894R1
tw principle隱私保護與數據治理
tw principle透明與可解釋
tw risk type部署互動問題（Deployment Interaction）
Controls English translation pending
- 透明化數據收集揭露
- 分層同意機制
Implementation Steps English translation pending
- 實施分層同意機制，以簡明語言說明數據收集範圍和用途
- 提供細粒度的數據共享控制選項（opt-in/opt-out）
- 建立數據收集透明度報告，定期公開數據使用統計
- 進行隱私影響評估（PIA），確保數據收集符合比例原則