Pels Rijcken's Innovation, Privacy & Technology team recently published the whitepaper Legal aspects of AI & machine learning. Over the next few weeks, they will be providing insight into the various areas of law covered in our whitepaper with a number of blogs. In this article, they take a closer look at Artificial Intelligence in combination with privacy law.
Machine learning
Machine learning is a form of Artificial Intelligence (AI) in which technology is able to develop itself through data analysis and then make its own decisions that are not pre-programmed. Machine learning technology uses self-learning algorithms for this purpose. Deep learning, a more advanced form of machine learning, is capable of making its own connections between data and drawing conclusions based on them. It is often not clear how deep learning technology arrives at its output.
Meaning AVG for AI
If personal data is processed in the development and/or application of an algorithm, the General Data Protection Regulation (AVG) applies.
What does the AVG mean for the development and application of AI? Some points:
Controller/Processor
It must be determined who is/are a controller and who is/are a processor(s). Who is a controller or processor in the context of AI is not easily answered. Who determines the purpose for which an algorithm will be used may play a role, but also who is the data controller for the personal data used in the development of a self-learning algorithm will be relevant. For example, if a client provides the data on the basis of which the developer - for the benefit of the client - develops a self-learning algorithm, then the client could be the data controller and the developer the processor. But if an (engaged) developer (also) makes use of his "own" data, then it could well be that that developer usually (also) qualifies as a data controller.
Principles of Data Processing
A data controller must take into account a number of principles of data processing. For example, in principle, personal data may not be processed for a purpose that is incompatible with the purpose for which the personal data were originally obtained. The input (data) in the initial development of a self-learning algorithm will in many cases not have been obtained for the development of that algorithm. In that case, it will have to be assessed on the basis of the criteria in Article 6(4) AVG whether there are compatible purposes. It is good to know that further processing with a view to, among other things, scientific purposes (which may also include technological developments) is considered compatible lawful processing. Of course, the scientific research must meet certain criteria. Another principle is: ensure that the personal data being processed is accurate. This also applies to newly generated data from existing data sets. Thus, the correctness principle forces the limitation of ´hidden biases´ in input and generated output (think of the circumstance that racial differences (will) form an important weighting factor in the self-learning algorithm). And finally, the principle of data minimization: no more personal data should be processed than necessary.
Basis / ground for breach
Is there a basis for processing personal data and, if special personal data are involved, a ground for breach? With AI applications, it will always be necessary to consider the context in which AI is used and what purpose that use serves.
Transparency
In order to give data subjects as much insight as possible into the processing of their personal data, the AVG contains various (transparency) provisions aimed at this. For example, data subjects must, in principle, be proactively informed about the processing of their personal data, and if automated decision-making is involved (see below), the logic underlying that decision-making must be made clear.
Automated individual decision-making
If an AI application involves a decision based solely on the automated processing of personal data, depending on the AI application, special rules applicable to certain forms of automated individual decision-making may have to be complied with. This can sometimes still be a challenge.
More articles by Pels Rijcken
This article can also be found in the AVG file
