Right to contest automated AI decision under review as part of UK government data protection consultation
(2021/09/10)
- Reference: 1631284511
- News link: https://www.theregister.co.uk/2021/09/10/right_to_contest_automated_ai_uk_consult/
- Source link:
The UK government has launched a consultation that suggests it could water down individuals' rights to challenge decisions made about them by artificial intelligence.
In documents released today, the Department for Digital, Culture, Media & Sport (DCMS) said that the need “to provide human review [of AI decisions] may, in future, not be practicable or proportionate.”
In the UK’s current implementation of the EU’s General Data Protection Directive (via the Data Protection Act 2018), people have a right to not be subject to a solely automated decision-making process with significant effects. However, these rights should be reviewed, according to [1]a consultation [PDF] launched by the DCMS.
[2]
In a comprehensive review of UK data protection law and data strategy, the department said the “issues need to be viewed in the context that the use of automated decision making is likely to increase greatly in many industries in the coming years."
[3]
Are you there, AI? It's me, Oliver
The DCMS went on: “The need to maintain a capability to provide human review may, in future, not be practicable or proportionate, and it is important to assess when this safeguard is needed and how it works in practice."
Removing the current provisions entirely are likely to look odd when both the EU and China are seeking to regulate this area, to protect consumers better
“It is critical that UK GDPR's provisions for automated decision-making and profiling work for organisations and for individuals. It is therefore important to examine whether Article 22 and its provisions are keeping pace with the likely evolution of a data-driven economy and society, and whether it provides the necessary protection,” it continued.
The consultation then points to [4]the much-derided Taskforce on Innovation, Growth and Regulatory Reform (TIGRR) document from May this year, which recommended that Article 22 of UK Data Protection Act 2018 (which brought GDPR into UK law) should be removed.
[5]
[6]
Instead, use of solely automated AI systems should be allowed on the basis of “legitimate interests or public interests”. The government consultation went on to ask participants whether they agree.
Richard Cumbley, partner and global head of law firm Linklaters’ technology practice said: "Removing the current provisions entirely are likely to look odd when both the EU and China are seeking to regulate this area, to protect consumers better.
[7]
"Rather than removing the provisions in UK GDPR, it would however be possible to focus the area where the regulation applies to those areas of real potential harm, and in particular remove concerns over the creation of training sets, without removing the current provisions. That would avoid throwing the baby out with the bath water."
The UK law is currently in line with the EU's GDPR such [8]that a ruling from the political and trading bloc allows data sharing between the UK and the EU post-Brexit.
[9]UK promises big data law shake-up... while also keeping the EU happy, of course. What could go wrong?
[10]European Commission airs out new IoT device security draft law – interested parties have a week to weigh in
[11]Facebook apologises after its AI system branded Black people as primates
[12]Facebook used facial recognition without consent 200,000 times, says South Korea's data watchdog
[13]Alan Turing Institute to spend UK.gov grants on AI for air traffic control and banking
Any divergence from the EU data protection principles could have have serious consequences, including the loss of data adequacy, Cumbley pointed out.
“A loss of adequacy for the UK would, in data terms, largely cut us off from the EU. This would have immediate and significant real-world effects and result in costly new compliance measures,” he said.
The consultation paper also takes a swipe at Article 5, which states among other things that data should be "collected for specified, explicit and legitimate purposes" and be "adequate, relevant and limited to what is necessary."
[14]
The UK government is proposing to implement “a more flexible and risk-based accountability framework which is based on privacy management programmes”.
“Under this framework, organisations would be required to implement a privacy management programme tailored to their processing activities and ensure data privacy management is embraced holistically rather than just as a 'box-ticking' exercise,” he said.
However, Georgina Kon, technology and media partner at law firm Linklaters, pointed out earlier this year that the EU would likely take a dim view of any tampering with Article 5, which is fundamental to its principles, and undermine that adequacy decision.
Incidentally, article 5 was also a target in the [15]TIGRR report , which was penned by a group of pro-Brexit MPs headed up Iain Duncan Smith in June this year.
Secretary of state Oliver Dowden said: “Now that we have left the EU, we have the freedom to create a bold new data regime: one that unleashes data’s power across the economy and society for the benefit of British citizens and British businesses whilst maintaining high standards of data protection.”
The launch of the consultation coincides with plans for a new governance model for the Information Commissioners Office – the UK’s data watchdog – including an independent board and chief executive to mirror the governance structure.
“Reforms will broaden the remit of the ICO and empower the Information Commissioner to champion sectors and businesses that are using personal data in new, innovative and responsible ways to benefit people’s lives in areas such as healthcare - building on the use of data in tackling Covid-19 - and financial services,” the ICO release said.
The move follows the selection of [16]John Edwards as the government’s preferred candidate as the new Information Commissioner. He is set to replace Elizabeth Denham.
Jim Killock, executive director of campaigners at the Open Rights Group, said: "The government's proposal would make it easier for companies to use and abuse your heath data, and easier for government to run so-called 'mutant algorithms' to decide your future.
"They are inviting thousands of health, insurance, and advertising lobbyists to rip up your rights in the name of innovation.
"And to top it all they want to stitch up the way the commissioner of the ICO is appointed in future so they can keep it controlled by Conservative-friendly industry executives," Killock said. ®
Get our [17]Tech Resources
[1] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1016395/Data_Reform_Consultation_Document__Accessible_.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YTuBOiKVjAcx1mviHQ3n5AAAAI4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://regmedia.co.uk/2021/09/09/oliver_dowden2.jpg
[4] https://www.theregister.com/2021/06/17/post_brexit_laws_mps_wishlist/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTuBOiKVjAcx1mviHQ3n5AAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTuBOiKVjAcx1mviHQ3n5AAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTuBOiKVjAcx1mviHQ3n5AAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/06/22/uk_eu_data_sharing_adequacy/
[9] https://www.theregister.com/2021/08/26/uk_privacy_law_shakeup_information_commissioner/
[10] https://www.theregister.com/2021/08/23/eu_device_security_regulations_comment_period/
[11] https://www.theregister.com/2021/09/06/in_brief_ai/
[12] https://www.theregister.com/2021/08/26/facebook_fined_by_south_korea/
[13] https://www.theregister.com/2021/07/23/turing_ai_grant/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTuBOiKVjAcx1mviHQ3n5AAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2021/06/17/post_brexit_laws_mps_wishlist/
[16] https://www.theregister.com/2021/08/26/uk_privacy_law_shakeup_information_commissioner/
[17] https://whitepapers.theregister.com/
In documents released today, the Department for Digital, Culture, Media & Sport (DCMS) said that the need “to provide human review [of AI decisions] may, in future, not be practicable or proportionate.”
In the UK’s current implementation of the EU’s General Data Protection Directive (via the Data Protection Act 2018), people have a right to not be subject to a solely automated decision-making process with significant effects. However, these rights should be reviewed, according to [1]a consultation [PDF] launched by the DCMS.
[2]
In a comprehensive review of UK data protection law and data strategy, the department said the “issues need to be viewed in the context that the use of automated decision making is likely to increase greatly in many industries in the coming years."
[3]
Are you there, AI? It's me, Oliver
The DCMS went on: “The need to maintain a capability to provide human review may, in future, not be practicable or proportionate, and it is important to assess when this safeguard is needed and how it works in practice."
Removing the current provisions entirely are likely to look odd when both the EU and China are seeking to regulate this area, to protect consumers better
“It is critical that UK GDPR's provisions for automated decision-making and profiling work for organisations and for individuals. It is therefore important to examine whether Article 22 and its provisions are keeping pace with the likely evolution of a data-driven economy and society, and whether it provides the necessary protection,” it continued.
The consultation then points to [4]the much-derided Taskforce on Innovation, Growth and Regulatory Reform (TIGRR) document from May this year, which recommended that Article 22 of UK Data Protection Act 2018 (which brought GDPR into UK law) should be removed.
[5]
[6]
Instead, use of solely automated AI systems should be allowed on the basis of “legitimate interests or public interests”. The government consultation went on to ask participants whether they agree.
Richard Cumbley, partner and global head of law firm Linklaters’ technology practice said: "Removing the current provisions entirely are likely to look odd when both the EU and China are seeking to regulate this area, to protect consumers better.
[7]
"Rather than removing the provisions in UK GDPR, it would however be possible to focus the area where the regulation applies to those areas of real potential harm, and in particular remove concerns over the creation of training sets, without removing the current provisions. That would avoid throwing the baby out with the bath water."
The UK law is currently in line with the EU's GDPR such [8]that a ruling from the political and trading bloc allows data sharing between the UK and the EU post-Brexit.
[9]UK promises big data law shake-up... while also keeping the EU happy, of course. What could go wrong?
[10]European Commission airs out new IoT device security draft law – interested parties have a week to weigh in
[11]Facebook apologises after its AI system branded Black people as primates
[12]Facebook used facial recognition without consent 200,000 times, says South Korea's data watchdog
[13]Alan Turing Institute to spend UK.gov grants on AI for air traffic control and banking
Any divergence from the EU data protection principles could have have serious consequences, including the loss of data adequacy, Cumbley pointed out.
“A loss of adequacy for the UK would, in data terms, largely cut us off from the EU. This would have immediate and significant real-world effects and result in costly new compliance measures,” he said.
The consultation paper also takes a swipe at Article 5, which states among other things that data should be "collected for specified, explicit and legitimate purposes" and be "adequate, relevant and limited to what is necessary."
[14]
The UK government is proposing to implement “a more flexible and risk-based accountability framework which is based on privacy management programmes”.
“Under this framework, organisations would be required to implement a privacy management programme tailored to their processing activities and ensure data privacy management is embraced holistically rather than just as a 'box-ticking' exercise,” he said.
However, Georgina Kon, technology and media partner at law firm Linklaters, pointed out earlier this year that the EU would likely take a dim view of any tampering with Article 5, which is fundamental to its principles, and undermine that adequacy decision.
Incidentally, article 5 was also a target in the [15]TIGRR report , which was penned by a group of pro-Brexit MPs headed up Iain Duncan Smith in June this year.
Secretary of state Oliver Dowden said: “Now that we have left the EU, we have the freedom to create a bold new data regime: one that unleashes data’s power across the economy and society for the benefit of British citizens and British businesses whilst maintaining high standards of data protection.”
The launch of the consultation coincides with plans for a new governance model for the Information Commissioners Office – the UK’s data watchdog – including an independent board and chief executive to mirror the governance structure.
“Reforms will broaden the remit of the ICO and empower the Information Commissioner to champion sectors and businesses that are using personal data in new, innovative and responsible ways to benefit people’s lives in areas such as healthcare - building on the use of data in tackling Covid-19 - and financial services,” the ICO release said.
The move follows the selection of [16]John Edwards as the government’s preferred candidate as the new Information Commissioner. He is set to replace Elizabeth Denham.
Jim Killock, executive director of campaigners at the Open Rights Group, said: "The government's proposal would make it easier for companies to use and abuse your heath data, and easier for government to run so-called 'mutant algorithms' to decide your future.
"They are inviting thousands of health, insurance, and advertising lobbyists to rip up your rights in the name of innovation.
"And to top it all they want to stitch up the way the commissioner of the ICO is appointed in future so they can keep it controlled by Conservative-friendly industry executives," Killock said. ®
Get our [17]Tech Resources
[1] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1016395/Data_Reform_Consultation_Document__Accessible_.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YTuBOiKVjAcx1mviHQ3n5AAAAI4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://regmedia.co.uk/2021/09/09/oliver_dowden2.jpg
[4] https://www.theregister.com/2021/06/17/post_brexit_laws_mps_wishlist/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTuBOiKVjAcx1mviHQ3n5AAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTuBOiKVjAcx1mviHQ3n5AAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTuBOiKVjAcx1mviHQ3n5AAAAI4&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/06/22/uk_eu_data_sharing_adequacy/
[9] https://www.theregister.com/2021/08/26/uk_privacy_law_shakeup_information_commissioner/
[10] https://www.theregister.com/2021/08/23/eu_device_security_regulations_comment_period/
[11] https://www.theregister.com/2021/09/06/in_brief_ai/
[12] https://www.theregister.com/2021/08/26/facebook_fined_by_south_korea/
[13] https://www.theregister.com/2021/07/23/turing_ai_grant/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTuBOiKVjAcx1mviHQ3n5AAAAI4&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2021/06/17/post_brexit_laws_mps_wishlist/
[16] https://www.theregister.com/2021/08/26/uk_privacy_law_shakeup_information_commissioner/
[17] https://whitepapers.theregister.com/
Community AI project
b0llchit
Lets all put our heads together and make an AI to use a data driven approach with current affairs as input and output the AI decision: UK government, you are fired!
There will be no appeal. There will be no further discussions. The decision is final. Please leave now.
That would sound fair, wouldn't it?
This is the stupidiest decision that has ever been made
Anonymous Coward
just saying.
Re: This is the stupidiest decision that has ever been made
b0llchit
It was made by AI.
Naive
teebie
I saw the headline and thought we were going to get more rights to challenge bad decisions made by AI.
The week must have tired my brain out.
The Dictator pronounces
Mike 137
' the need “to provide human review [of AI decisions] may, in future, not be practicable or proportionate.” '
If (as the above suggests) it will be deemed impossible to establish the basis of an automated decision, the ability to challenge it and have it reviewed by a mechanism open to discovery as to basis (e.g. a reasoning human) is fundamental to human rights (if not the limited legal ones, then the wider moral ones). Otherwise it's in constitutional terms no better than the whim of a dictator.
"Computer says No" was intended as a jocular warning. If this proposal gets accepted, we have the prospect of it becoming a legally binding fearsome reality.
Yes, Minister?
Eclectic Man
"
The UK government is proposing to implement “a more flexible and risk-based accountability framework which is based on privacy management programmes”.
“Under this framework, organisations would be required to implement a privacy management programme tailored to their processing activities and ensure data privacy management is embraced holistically rather than just as a 'box-ticking' exercise,” he said.
"
\begin{RANT}
So soon after the data breach by McDonalds (https://www.theregister.com/2021/09/09/mcdonalds_database_credentials_blunder/). the idea of a 'holistic approach' to security sounds like an episode of 'Yes, Minister'.
As for a 'risk-based accountability framework', WTF is one of those? OH, hang on, we had one of those for dealing with the Covid-19 pandemic didn't we? So far about 134,000 deaths, although arguably the dominating risk guiding policy and decisions was Boris Johnson's popularity, rather than the risk to life for vulnerable people in care homes.
I need a drink.
\end{RANT}
Data economy?
...likely evolution of a data-driven economy and society
Many of us see no need for, and don't want to be part of, a "data-driven economy". I see that as pretty much identical to having a "crime-driven economy" - why would I want one of those?
Concentrate the economy on real stuff and services that we want. Not on processing data about us.
If the services are attractive enough, and really beneficial to people (instead of exploiting them), then there will be no problem getting people to agree to the data processing that supports them. But different people will make different tradeoffs so everything still has to be based on personal agreement to permit the processing.