UK data guardian challenges government proposals on automated decision-making
- Reference: 1637674393
- News link: https://www.theregister.co.uk/2021/11/23/uk_automated_decision_making/
- Source link:
The independent healthcare data rights watchdog also said the government's consultation on changes to data protection law following the UK's departure from the EU makes proposals that would represent a "significant departure" from the General Data Protection Regulation (GDPR), potentially jeopardising data-sharing arrangements.
The UK's current implementation of the GDPR, the Data Protection Act 2018, stipulates in [1]Article 22 that people have a right not to be made subject to a solely automated decision-making process if that decision has significant effects.
[2]
These rights should be reviewed, according to [3]the consultation launched by the Department for Digital, Culture, Media and Sport (DCMS) in September. The proposals state that the need "to provide human review [of AI decisions] may, in future, not be practicable or proportionate."
[4]
[5]
In her [6]response to DCMS's consultation, [7]Data: a new direction , NDG Dr Nicola Byrne said: "The NDG has significant concerns about proposed reductions to existing protections and the ability of professionals, patients, and the public to be actively informed about decisions that can have significant impacts for them.
"Further, it may negatively impact people's trust in decisions made about them by solely automated means if the safeguards in Article 22 are not retained. In the health and care context, any removal of the ability to contest or ask for human intervention in relation to a decision could significantly affect the quality of care.
[8]
"As elements of healthcare become more efficiently managed through AI, the importance of the human nature of the relationship through which care is provided must not be lost."
Dr Byrne also said that government proposals – such as amendments to research provisions, rules on automated decision making, and changes to data subject rights – would represent a significant departure from EU data protection law.
The opinion gives weight to the view that changes to data protection law risk the [9]EU's "adequacy" decision , which allows continued data sharing between the trading bloc and the UK.
[10]
The UK's previous digital secretary, Oliver Dowden, said the UK would continue to align with the GDPR and that Britain would set a "gold standard" in data regulation, "but do so in a way that is as light touch as possible."
[11]CIOs across Europe add their VOICE to chorus of calls to regulate cloud gatekeepers
[12]Belgium watchdog reckons online advertisers should be data controllers under GDPR
[13]UK data spillers fined, but enforcement slows: £5m in ICO penalties not yet paid
[14]Data transfers between the EU and the US: Still unclear on what you're supposed to do? Here's an explainer
Lawyers [15]have pointed out that there is no specific end date to the adequacy decision and the EU could choose to review it at any time.
Other opinions slammed the whole consultation process. [16]A blog from legal training firm Amberhawk said the consultation provided no evidence for most of the legislative changes it claims were needed.
It pointed out the consultation asks respondents to answer the same question many times. "Roughly speaking, this question goes: 'We know that controllers find the following data protection elements a right pain in the arse; please explain your answer, and provide supporting evidence where possible'.
"The consultation is largely drafted from a position where the controller becomes entitled to process the data subject's personal data without consideration of how the data subject's wishes or interests are protected."
Meanwhile, the UK's outgoing Information Commissioner [17]has said there were reasons to be concerned about proposed changes to data regulations in the UK.
"Despite... broad support for the proposals to reform the ICO's constitution, there are some important specific proposals where I have strong concerns because of their risk to regulatory independence," Elizabeth Denham said in [18]a statement in July.
DCMS is examining feedback on its consultation, which closed on 19 November. ®
Get our [19]Tech Resources
[1] https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/rights-related-to-automated-decision-making-including-profiling/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YZ0eO7JmpUISb0@w5kcv4wAAAMI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2021/09/10/right_to_contest_automated_ai_uk_consult/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YZ0eO7JmpUISb0@w5kcv4wAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YZ0eO7JmpUISb0@w5kcv4wAAAMI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.gov.uk/government/publications/national-data-guardian-feedback-on-data-a-new-direction-proposed-government-reforms-to-the-uk-data-protection-regime
[7] https://www.gov.uk/government/consultations/data-a-new-direction
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YZ0eO7JmpUISb0@w5kcv4wAAAMI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2021/06/22/uk_eu_data_sharing_adequacy/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/aiml&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YZ0eO7JmpUISb0@w5kcv4wAAAMI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2021/11/18/cio_cispe/
[12] https://www.theregister.com/2021/11/08/realtime_bidding_in_online_advertising/
[13] https://www.theregister.com/2021/11/03/ico_fines_5m_pounds_outstanding/
[14] https://www.theregister.com/2021/11/01/data_transfers_europe/
[15] https://www.theregister.com/2021/06/22/uk_eu_data_sharing_adequacy/
[16] https://amberhawk.typepad.com/amberhawk/2021/11/how-privacy-protection-is-much-diminished-by-proposals-to-change-the-uk_gdpr.html
[17] https://www.theregister.com/2021/10/07/outgoing_ico_warns_independence_of_role/
[18] https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2021/10/response-to-dcms-consultation-foreword/
[19] https://whitepapers.theregister.com/
Elements of healthcare become more efficiently managed through AI
I hope someone paused to think whether efficiency of decision making is the right thing to strive for in regard to healthcare.
Re: Elements of healthcare become more efficiently managed through AI
@pavel.petrman
"right thing to strive for in regard to healthcare."
Considering the state of UK healthcare a bit more efficiency might be a step in the right direction.
Re: Elements of healthcare become more efficiently managed through AI
It's more efficient to let people die at birth, as this results in tremendous savings in time, effort and money for the NHS over the next 80 or so years.
Maybe efficiency isn't the only metric.
Re: Elements of healthcare become more efficiently managed through AI
possibly the metric should be selfish cunts are left to die, as that is what they want for the rest of us!.
you know who you are.....
Re: Elements of healthcare become more efficiently managed through AI
@Cederic
"Maybe efficiency isn't the only metric."
True. But seeing patients more timely would be useful. Filtering A&E could be useful, although that would require GP's to see patients.
As for letting people die at birth, it would cut their source of funding considerably :D
There is no specific end date to the adequacy decision
I think the present government genuinely believes that the EU care as little about the rules as they do and the worst they will suffer will be some kind of temporary performative objection that will be waived if we tell them about our lovable porcine cartoon characters.
Even if the European Commission and the EU Council and European Parliament chose to somehow all sit on their hands, there’s a *very* strong likelihood of individual citizens taking a challenge to court and an ECJ ruling eventually rendering processing of EU citizens data in the U.K. highly problematic, if not impossible.
People seem to imagine the EU operates like a US presidency or a U.K. national government with broad executive powers being exercised by a single party or individual. It does not. It’s all about decentralised powers, subsidiary, finding consensus etc.
It would be extremely naïve to assume this will just bump along as if nothing happened or that some diplomatic nods and winks by HM Gov can smooth it all over and make it go away.
GDPR is actually very popular amongst European citizens too. There’s strong political support for it and a sensitivity about data snooping in many countries that have a much clearer understanding of why it’s a risk due to their own 20 th century histories. A lot of people are very protective of the concept of a right to privacy.
People may believe that. The prime movers behind Brexit knew otherwise. They didn't like the idea of not being above the law..
Where the rot started
The framers of the adequacy decision actually started the rot, when they set the requirement for transparency (paragraph 49) as " Data subjects should be informed of the main features of the processing of their personal data. " [emphasis added]. The GDPR actually requires full and complete details of processing to be provided.
One ocassion where I really REALLY wish I was wrong
I said right along that this sort of thing would rapidly follow Brexit, and the family said I was being melodramtic.
Re: One ocassion where I really REALLY wish I was wrong
I really wish you were wrong too, and I had hoped the Government wouldn't be stupid enough to jeopardise adequacy due to the economic damage that's going to happen.
To be fair I also hoped the Government would respect the people of the UK but as with ID cards, ubiquitous surveillance, freedom of speech and several other areas, the Government prefers a more authoritarian approach that also allows businesses to run rampant over peoples' rights.
We used to be trend settings in consumer law, now we're following China's lead. It's concerning.
English, not UK, National Data Guardian
> UK's National Data Guardian (NDG)
Except she's not the UK National Data Guardian, she's the English National Data Guardian - she appears to have no responsibilities regarding Northern Ireland, Scotland, and Wales:
https://www.gov.uk/government/organisations/national-data-guardian/about
the UK would continue to align with the GDPR and that Britain would set a "gold standard" in data regulation, "but do so in a way that is as light touch as possible."
Translation: "We'll pay gold-plated lip-service to GDPR"
@Doctor Syntax
"Translation: "We'll pay gold-plated lip-service to GDPR""
Works for the US
> "but do so in a way that is as light touch as possible."
Translation: ICO will take no action against anyone breaking GDPR as they do not have the "regulatory appetite" (a phrase actually used by a ICO Case Officer).
Is it though...?
Is it AI though... or just a refined set of scripted questions with no more complex logic to it than a choose your own adventure book? I.e. IF this, THEN that...
All designed to hit quotas and massage KPI figures than to provide any real public service.
Well said Amberhawk!
' "The consultation is largely drafted from a position where the controller becomes entitled to process the data subject's personal data without consideration of how the data subject's wishes or interests are protected." '
I came to the same conclusion. Completing a robust response to the 170 loaded questions that pointed out the inadmissibility of this position took 20 days and it finally ran to over 25,000 words. I wonder if they'll read it.
Nothing to see here ...
Actually, it wasn't the Government but the AI system that decided to share all your data with a massive multi-national in return for a huge fee paid in a brown crypto-envelope and a peerage for Malcolm, so I'm afraid you can't sue us...
Computer says no... end of!
> the need "to provide human review [of AI decisions] may, in future, not be practicable or proportionate."
E.g. for trivial things like motoring offences.
So for example you wouldn't ever get a fine for being in a bus lane because the AI mistook a logo on someone's top for your reg number, no, couldn't ever happen.
Anyway HMG won't be wasting valuable AI time on things like that. It'll be used to decide if you're entitled to benefits, or asylum, or whether your tax avoidance scheme is actually a tax evasion scheme, or how much HS2 compensation for knocking your house down (or not). Don't want pesky lawyers dragging things out and costing the Government money.
Article 22
Catch-22. It's the best there is.
(c) Joseph Heller