Information Commissioner's Office: Registration Inbox AI
This algorithmic tool helps to categorise emails sent to the Information Commissioner’s Office (ICO)’s registration inbox and sends out auto-replies in specific cases.
Tier 1 - Overview
Name
Machine learning algorithm to categorise emails sent to the ICO’s registration inbox
Description
This algorithmic tool helps to categorise emails sent to the ICO’s registration inbox and sends out auto-replies in specific cases. The registration inbox generally receives queries from organisations or sole traders who are registered, or are looking to register, with the ICO. Every organisation or sole trader who processes personal information needs to pay a data protection fee to the ICO, unless they are exempt. Typical queries may be about registering with the ICO, how to make a payment, or how to change or update details about a registration.
The ICO’s registration team often manages high volumes of queries. Assigning members of the team to respond to every request takes time and can lead to high caseloads for Data Protection Fees Officers (DP Fees Officers).
To reduce the burden on caseloads and ensure we respond in a timely manner to customers, the ICO, alongside selected third parties, have developed an algorithmic tool that categorises emails that are sent to the inbox and sends out auto-replies in specific cases. The algorithm takes into account the content of the email being sent to the inbox and detects whether it is a request about changing a business address. In cases where it detects this kind of request, the algorithm sends out an autoreply that directs the customer to a new online service and points out further information required to process a change request. Only emails with an 80% certainty of a change of address request will be sent an email containing the link to the change of address form.
URL of the website
n/a
Contact email
For additional information, read the ICO’s privacy notice, contact the ICO’s data protection officer at dpo@ico.org.uk, or call our main helpline on 0303 123 1113.
Tier 2 - Ownership and responsibility
1.1 Organisation/ department
Information Commissioner’s Office (ICO)
1.2 Team
Business Services
1.3 Senior responsible owner
Project Manager for the Strategic Change and Transformation department
1.4 Supplier or developer of the algorithmic tool
The algorithm was developed by ICS.AI and Microsoft.
1.5 External supplier identifier
ICS.AI: 1134680
1.6 External supplier role
Members of ICS.AI were contracted to develop the algorithm for the ICO. It is not shared with any other organisation.
1.7 Terms of access to data for external supplier
ICS.AI acts as data processors which means that they cannot do anything with information we provide them unless we have instructed them to do it. They will not share information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.
Tier 2 - Description
2.1 Scope
This algorithmic tool has been designed to inspect emails sent to the ICO’s registration inbox and send out autoreplies to requests made about changing addresses. The tool has not been designed to automatically change addresses on the requester’s behalf. The tool has not been designed to categorise other types of requests sent to the inbox.
2.2 Benefit
Reading an email, understanding the request being made and adequately responding takes time. If more emails were received than the amount that could be sufficiently answered, a backlog would develop. This would lead to delayed responses and reduced customer satisfaction. In a significant proportion of emails received, a simple redirection to an online service is all that is required. However, sifting these types of emails out would also require time if done by a human. The algorithm helps to sift out some of these types of emails that it can then automatically respond to. This enables greater capacity for DP Fees Officers in the registration team, who can, consequently, spend more time on more complex requests.
Key benefits:
- Improves efficiency in answering requests sent to the registration inbox
- Helps to avoid backlog of emails
- Provides case officers with more time to respond to more complex requests
2.3 Alternatives considered
This process was previously done manually by reading and responding to emails.
2.4 Type of model
The classification model uses a Na‹ve Bayes classifier to determine the context of a request.
2.5 Frequency of usage
The tool classifies approximately 23,000 emails a month.
2.6 Phase
The tool has been in production since 19 May 2021.
2.7 Maintenance
The tool is reviewed monthly to understand where it may be missing some categories of request.
2.8 System architecture
See the attached diagram of the system’s architecture:
Tier 2 - Oversight
3.1 Process integration
The algorithmic tool does not make any decisions, but instead provides links in instances where it has calculated the customer has contacted the ICO about an address change, giving the customer the opportunity to self-serve.
3.2 Provided information
n/a as the process is fully automated
3.3 Human decisions
There is no manual intervention in the process - the links are provided to the customer in a fully automated manner.
3.4 Required training
n/a - no additional training required
3.5 Appeals and review
n/a - No need for review or appeal as no decision is being made. Incorrectly classified emails would receive the default response which is an acknowledgement.
Tier 2 - Information on data
4.1 Source data name
n/a - no specific name of dataset
4.2 Source data
The model was trained on a dataset that was collected from emails being sent to the ICO’s registration inbox. We provided information about this purpose in our privacy notice on our website. Data collected includes:
- Email address
- Subject title
- Contents of the email, which may contain information relating to registration queries around address of trader/trading name/contacts for the registrations/payment categories or any other information they included in the email body.
Email header information is removed and not processed by machine learning text classification service.
4.3 Source data URL
n/a - No URL available
4.4 Data collection
The model was trained on a dataset that was collected from emails being sent to the ICO’s registration inbox
4.5 Data sharing agreements
n/a - No further data sharing agreements in place
4.6 Data access and storage
Data access for the training data was restricted to those contracted at ICS.AI by the ICO. ICS.AI completed the work within an ICO-managed environment and did not hold or process any data outside of that environment. All training data was deleted after the model was created from the Azure Database while the original email will remain in the registration inbox for 12 months.
Tier 2 - Risk mitigation and impact assessment
5.1 Impact assessment name
Machine Learning - Text classification - Data Protection Impact Assessment
5.2 Impact assessment description
This assessment considered the risks to individual rights and freedoms caused by the introduction of this algorithmic tool and provided details on the organisational and technical measures taken to reduce any risks identified.
5.3 Impact assessment date
Date completed: 19th May 2021
5.4 Impact assessment link
n/a
5.5. Risk name
-
A customer receives an incorrect response because of the automated email response.
-
Failure to provide transparency information prior to starting the model training process.
5.6 Risk description
-
A customer receives an incorrect response because of the automated email response.
-
Failure to provide transparency information prior to starting the model training process.
5.7 Risk mitigation
-
The classification scope is limited to a change of address and a generic response stating that we have received the customer’s request and that it will be processed within an estimated timeframe. Incorrectly classified emails would receive the default response which is an acknowledgement. This will not have an impact on personal data. Only emails with an 80% certainty of a change of address request will be sent an email containing the link to the change of address form.
-
The ICO’s privacy notice has been updated to inform customers of the additional use of the data for training purposes including machine learning.