Normative Guidelines for Artificial Intelligence

Normative Guidelines for Artificial Intelligence Presented by: Dr. Djeffal Date: 29 June 2023 Is The Law Outpacing Technology? - Art. 2 Act No. 78-17 on Information Technology, Data Files and Civil Liberties, Journal Officiel de la Republique Française 1978, 227 • No judicial decision involving an assessment of human behaviors may be based on automated processing of information giving a profile or personality definition of the person concerned. • No administrative or private decision involving an assessment of human behaviors may be based solely on automated processing of information giving a profile or personality definition of the person concerned. Structure - Law by design norms - Art. 22 GDPR - Discussion - Conclusion Law By Design Norms Art. 25 sec. 1 GDPR: data protection by design - Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, the controller shall, both at the time of the determination of the means for processing and at the time of the processing itself, implement appropriate technical and organizational measures, such as pseudonymization, which are designed to implement data-protection principles, such as data minimization, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of data subjects. What Is Special About Law By Design Norms? - Design norms • Interdisciplinarity: legal principles as goals in the development process • Intertemporally: stretching the process • Goal orientation: obligation of result Structure Of Legal Doctrinal Argument - Ascertainment • - Interpretation • - Is there a valid rule? What is the content of the rule? Application • How does the content relate to the facts? The Structure Of Law By Design - Design of measures - Impact assessment Art. 22 GDPR Structure of Art. 22 GDPR - Regulates automated individual decision making including profiling • Section 1: scope of application • Section 2: formal requirements • Section 3 & section 2 subsection b: material requirements What Is Special About Law By Design Norms? - - Art. 22 GDPR • Goals: rights, freedoms and legitimate interests • Intertemporally: openness • Goal-orientation: suitable measures to safeguard Design norms • Interdisciplinarity: legal principles as goals in the development process • Intertemporally: stretching the process • Goal-orientation: obligation of result The Structure Of Law By Design - How does the application impact rights, freedoms and legitimate interests of data subjects? - How can these impact mitigated by measures? Minimum measures Art. 22 Section 3/Section 2b GDPR, exemplary fashion: Recital 71 - How does the application impact rights, freedoms and legitimate interests of data subjects? Transparency And Explanations - Law By Design • Look at the specific automated decision making system. • How does it impact rights, freedoms and legitimate interests of the respective data subject? • Can measures concerning explanations and transparency mitigate the impacts? • How should those measures concerning explanations and transparency be designed? • How does the reconfigured automated decision making system impact on rights, freedoms and legitimate interests of the respective data subject Discussion Legal Arguments: Wording - Art. 22 GDPR section 3 • Wording can accommodate a law by design norms • Measure mentioned explicitly non-exhaust • Measure mentioned explicitly minimum guarantees • Recital 71 also not exhaustive Other Law By Design Norms - Art. 5 Sec. 2 Directive 2019/1024 on open data and the re-use of public sector information - Art. 51 Regulation (EU) 2019/881 Cybersecurity Act Legal Arguments: Legal History - Art. 2 Act No. 78-17 on Information Technology, Data Files and Civil Liberties, Journal Official Republique Française 1978, 227 Legal Arguments: Purpose - Purpose of this norm goes beyond data protection and the protection of privacy. - It is to protect data subjects effectively from the adverse consequences of automated decisions. - The specific challenge relates to the nature of the underlying technologies, specifically artificial intelligence. Socio-Political Component Of Purpose - Al as set of emerging technologies: challenges and opportunities continue to evolve and might not be foreseen - Al as set of general purpose technologies: Al can be applied in every sector of society for very different purposes Recognizing Sensitive Data - Doc byte has an anonymization tool that automatically blurs sensitive data on documents. - Takes GDPR and other data compliances into consideration - Can also remove metadata, distort audio and always saves locally. - Applied in: client work where companies need to adhere to the GDPR. Prevents the risk of sensitive data entering systems of companies Critical Questions - Can we burden lawyers with interdisciplinary design tasks? - Does this stifle innovation and prohibit increased efficiency and effectiveness? - Is the context specificity to burdensome? Would rules of general applicability not be preferable? - Will such a norm become obsolete in the face of legislative projects concerning Al? Conclusion - The design function of law - Law by design norms as tools for the governance of technologies - Art. 22 GDPR as example for norms that are not yet acknowledged. - Another instance in which the law and lawyers are not outpaced by technology