Calls for oversight of Artificial Intelligence (AI) and algorithms are growing stronger in politics and society. And not without reason. The AP believes that citizens should be able to trust that their personal data is handled with care. As the regulator, we are responsible for supervising the processing of personal data, and thus also the application of AI and algorithms that use personal data.
According to Aleid Wolfsen (chairman of the AP), the use of algorithms is now taking place on a large scale. This applies not only to private organizations, but also to the government: from the tax authorities and the police to various municipalities.
Wolfsen: "The use of algorithms offers many opportunities, but there are also serious risks. In a democratic state under the rule of law, for example, you are entitled to an understandable justification for a decision that is unfavorable to you. Otherwise you cannot defend yourself and a judge cannot review it. That's why transparency is so crucial."
The AVG principles of legality, propriety and transparency provide a good basis for the use of AI and algorithms to contribute positively to society. Some basic conditions must be met when using algorithms that process personal data.
For example, there must be a basis for processing, such as consent or performance of a contract. In addition, data processed for one purpose may not simply be used for another purpose at a later time (purpose limitation).
Furthermore, standards - depending on the type of personal data - also apply, for example, around the storage and security of personal data.
Aleid Wolfsen: "Especially when applying new technologies, companies and governments have the responsibility to make an insightful and verifiable trade-off between, in this case, the use of these systems and the protection of privacy.
The line between "how wonderful that this is possible" and "what is happening here is extremely dangerous" can sometimes come awfully close together. The line between selecting job applicants with honesty and integrity and... discriminating, between refusing customers after a concrete (payment) risk has been demonstrated and refusing customers because they have only been profiled as a risk in advance, between conducting elections fairly and... manipulating, between apprehending suspects after there is a concrete suspicion or profiling people as suspects before any suspicion.
Everyone responsible for deploying algorithms and AI must know what they are doing and be transparent about it."
Accountability provides important guidance for monitoring algorithms and is elaborated in the AVG in various instruments. For example, a controller is required to keep a register, which describes activities involving the processing of personal data, including the purposes of such processing.
In addition, prior to any particular processing, a controller must conduct an assessment of its impact on the protection of personal data. This so-called data protection impact assessment (DPIA) is usually mandatory when using algorithms.
Herein, a processor must properly justify why he or she uses certain data in an algorithm, what the purpose of using an algorithm is, as well as why it is necessary to work with that algorithm.
When these risks cannot be sufficiently eliminated, it is mandatory to submit a prior consultation to the AP for advice.
In the coming period, the AP will focus on further developing its supervision of AI and algorithms in which personal data are used. In this we are cooperating with other relevant parties within and outside the Netherlands.
See also: report monitoring AI & Algorithms
