AI and Data Protection

Kuvaus

Being a self-proclaimed technological-neutral regulation, the GDPR does not ever mention AI by name. However, it is clear that the drafters were very concerned about AI-related technologies. In addition to the clear discussions in the preparatory materials, the GDPR, art. 22 regulates “automated individual decision-making, including profiling”—a thinly veiled reference to decisions made by AI and other autonomous computer systems.

However, while this right has been hotly debated in the academic press (particularly in relation to what kind of processing falls under this provision and what kind of information data subjects should be given), it is unlikely that they will actually form a hotspot for legal enforcement. Despite the ambiguities in the law, the Data Protection Directive contained an almost identical provision, which remained relatively obscure and did not form the basis of any meaningful litigation or enforcement proceedings. We must look, then, at how bots and AI fit into the general data protection regime. When we do this, it is interesting to look at the possible justifications for processing activities involving bots and AI, particularly in regards to processing on the basis of a controller’s legitimate interest.

These less-discussed topics contain issues which are very different to those discussed under art. 22 processing, but which are still incredibly important. How does a controller ensure that they are using bots and AI in a fair and responsible way? The law contains some provisions to help guide them (e.g. the principle of lawfulness, fairness and transparency under art. 5(1)(a) and the concept of data protection by design and by default under art. 25), but these can be seen as simply begging the question.

There are, then, many unanswered questions that we need to address – and we must be very careful not to fall into the trap of assuming that just because the processing is not dramatic enough to fall under art. 22 means that it is not important enough to warrant serious consideration.

Aikajakso	21 marraskuuta 2018
Tapahtuman otsikko	Seminar on Artificial Intelligence, Regulation and Business
Tapahtuman tyyppi	Seminaari
Sijainti	Rovaniemi, Suomi
Tunnustuksen arvo	Kansallinen