BLOG

Considerations on Artificial Intelligence

Artificial intelligence has assumed such relevance in the global debate that not a day goes by without a multiplicity of articles and interviews, scientific reports, and interventions by authorities and public institutions. It is difficult to disentangle oneself from this flood of information and even more challenging to keep up with the analysis of the different critical profiles raised by artificial intelligence tools, or by machine learning or deep learning mechanisms. Profiles that do not only concern data protection, but involve many fundamental rights, security aspects, have social and even global policy implications in relation to the development of democratic societies.

In this article – having the GDPR regulation on automated decision-making processes as a reference horizon and taking some cues from the proposed AI Act whose legislative path should be in the final stage – we will try to highlight some basic considerations on the subject.

AI vs. applied statistics

In an interview that appeared in the Financial Times of 2 June 2023, Chinese American science fiction writer Ted Chiang, when asked by a journalist what alternative appellation to ‘artificial intelligence’ he would use, replied without hesitation: “applied statistics”. Chiang pointed out that computers (or algorithms) are not yet conscious, hence the incorrect use of the term ‘intelligence’.

Originally, AI system operations were predetermined by rules of logical deduction; later, predetermination gave way – as Luciano Floridi points out – to statistical ‘correlation’ of data. If we want to be reasonably confident that we will not be contradicted by technological evolution, we can generally define an algorithm as a sequence of logical steps that allows a certain result to be produced. In the case of machine learning or deep learning, the interaction between machines creates more complex processes that incorporate statistics and probability criteria.

AI as a decision-making tool

Chiang’s observation has the merit of facilitating the framing of the relationship between the individual and the AI: this relationship is not between entities (man and machine) that interact as equals but is representative of the human use of a cognitive tool. With the particularity that AI differs from traditional means that human beings use to examine the world around them, such as eyeglasses or measuring instruments or others. The difference lies in the fact that the algorithm – although not conscious in itself – can make decisions deduced from the correlation rules of which it is composed: conclusions that the person also uses to supplement them with his own decisions or evaluations.

Decision-making process

Any cognitive tool is capable of contributing to our decision-making processes; the traditional ones, passively, in that they merely transfer information to humans that is useful for the final decision or human evaluation: if the thermometer registers a high environmental temperature, I will be induced to dress light.

“Active” cognitive tools do not merely transfer information, but “participate” in decision making. The innovation of AI lies in the fact that, in a first stage, it provided logical deductions from predefined reasoning rules (if…then, i.e., “the temperature is high, I advise you to dress light”); in a second stage, through statistical correlation of data, AI tools help manage complex processes by enhancing human evaluative capacity.

Thus, AI does not merely provide elements of judgment but can participate, more or less extensively, in decision-making, however, without ever crossing the threshold of conscious evaluation that remains the exclusive domain of the individual.

Although it was originally conceived way back in 2012 (the year of publication of the proposal text by the EU Commission), the GDPR has the merit of having brought to the fore this “participatory” particularity of AI in decision-making by offering specific discipline for so-called “automated decision-making.” While this merit is acknowledged, some of its limitations can also be pointed out: the scope of application of the discipline on decision-making processes, with the safeguards provided therein, is triggered only if the algorithm exhausts the entire decision-making process, replacing the human being. Article 22 of the GDPR addresses the case of fully automated decision-making and, in that case, provides for the right of the person, towards whom the decision is directed, to have it reviewed by the human being.

In fact, AI can perform two distinct functions regarding decision making:

it can carry it out and implement it in its entirety (“fully automated”) or
it can support it, reserving the final decision to the human being.

Influence

The GDPR addresses the only case in which machines “can decide for themselves” as opposed to other scenarios in which the individual uses AI as a mere cognitive tool, without abdicating his or her own decision-making. Yet, the risks associated with these circumstances are equally high and concern the power of influence that the cognitive medium of AI can exert on human evaluation, in both cases of “fully” or only partially automated decision-making. Concerning the other extreme of “passive” cognitive tools, it should be noted that for them it is possible to adjust their calibration in order to achieve the accuracy of detection and, consequently, the objectivity of the elements of judgment; differently, in the case of “active” cognitive tools such as AI, the same operation is not realistically conceivable or, at least, it is to be excluded that it can be implemented with comparable simplicity; while taking into account the different level of aid (influence?) that the AI tool can offer to the decision-making process, depending on whether the latter is partially or fully automated.

These considerations suggest that, in general, AI affects the instrumental relationship that normally binds the subject to the tool used, giving the AI tool an unusual conditioning power toward those who take advantage of it. The checklist in the aforementioned High-Level expert paper is asked to assess-when AI interacts with human end-user decision-making-whether there is a risk that the AI system itself affects human autonomy.

Perhaps the tool may not be as “intelligent” as human capabilities – as Chiang points out – but it nevertheless conditions the individual’s evaluations to different degrees. The more sensitive these are to the context of reference, the more serious and impactful the algorithmic conditioning on the final evaluations themselves can become.

AI, GDPR and impact assessment

Regarding the analysis of the scope of the GDPR with regard to AI, it can be argued that the discipline on automated decision-making processes does not exhaust the scope of the GDPR in this context. AI, as demonstrated in some of the cases discussed below, must still meet the general principles (Art. 5), the legal bases (Art. 6) and must comply with the additional requirements of the General Regulation. The principles of data protection by design and by default indicate that GDPR rules must be implemented as early as the algorithm’s design conception phase, and that the impacts that the inevitable use of huge amounts of personal data (big data) may generate on individuals must be assessed. The obligation to take preventive security measures commensurate with the risk, imposes a relevant and judicious assessment that must necessarily offer maximum assurance toward foreseeable assumptions of violation. The adequacy of organizational measures induces the construction of a model of roles and procedures that harness the project within a regulatory framework that leaves little space for undesirable effects.

The conditioning impact of the AI system on the human evaluative process, in any case, is the subject of the risk assessment carried out within the impact assessment, which should always be considered mandatory in view of the inherent high risk to individual rights and freedoms resulting from the use of AI systems. The impact assessment is the preferred moment in which to properly assess the level of conditioning and impacts in terms of values resulting from the use of AI.

Trustworthiness

Because of the recalled risks regarding its multiple application solutions and in order for AI to develop and freely express its full vast potential, it is customary to say that it must be trustworthy.

According to the EU Commission (High Level Expert Group on AI), trustworthy AI is based on three cumulative components:

(1) lawfulness – i.e., compliance with all applicable laws (EU primary law such as the EU Treaties and Charter of Fundamental Rights; secondary law such as the GDPR, Regulation on the free movement of non-personal data, data strategy laws, consumer law, etc.; UN treaties and other international conventions such as the ECHR),
(2) ethicality – adherence to ethical principles and values
(3) robustness – both from a technical point of view and taking into account the social context.

Operationally, reliable AI is achieved by satisfying 7 guiding principles throughout the life cycle, to which correspond as many control criteria that are summarized here:

human intervention and oversight, ensuring human oversight and control of operational processes in AI systems; users should be able to make autonomous and informed decisions about AI systems; human oversight serves to ensure that the implementation of an AI system does not violate human autonomy or result in other negative consequences;
technical robustness and security, facilitating traceability and verifiability of AI systems, especially in critical contexts or situations in order to ultimately prevent harm. In this regard, checkpoints refer to resilience to attack and security from the perspective of prevention and integrity, contingency planning and overall security, the level of accuracy required for the target context, and reliability and reproducibility;
data management and confidentiality, in addition to data protection, assurance of data quality and integrity, proper data management and access;
transparency, informing and explaining clearly and proactively including about interaction with an AI system, providing insights into the degree to which an AI system influences and shapes decision-making; traceability of the various operational stages of the system and its outcomes
diversity, non-discrimination, and equity, the operation of the system cannot generate unfairly biased outcomes; identifying, evaluating, documenting, and continuously communicating the trade-offs made between interests and values; accessibility and system design that take into account the needs of people with special needs or disabilities; mechanisms for participation by different stakeholders
social and environmental well-being, AI systems must be designed to augment, integrate, and enhance human cognitive, social, and cultural abilities; reduction of environmental impact; proper and transparent interaction of the system with humans; evaluation of overall impact on society and democratic arrangements; and
accountability, verifiability, minimization of adverse effects and their reporting; documentation of any adopted trade-offs between values and interests; redress mechanisms in case of harm or adverse effects.

Ethical dimension

For reliable AI, therefore, the ethical dimension must be considered.

Ethics presides over the space of what is beyond legality, in the awareness of the latter’s inevitable inadequacy to meet exhaustive regulation of phenomena arising from the application of AI. The law cannot reasonably foresee all conceivable cases, assess a priori their impacts, identify appropriate solutions to be transposed into prescriptions binding on all. Technology imparts to its development a speed that cannot be commensurate with the process of regulatory training and, moreover, it generates a multiplicity of variables that are impossible to map and regulate exhaustively. This space that is outside the application scope of the norm must be covered with recourse to ethics and the moral values that are its content.

It is through ethics that the use of technology is dropped into an anthropocentric system that is also considered as a role model and guiding star: it is technology that serves humans rather than the other way around. This leads to the stipulation – as summarized by the Group of High-Level Experts – that AI application must ensure human autonomy, equity, and explicability, pay attention to situations involving vulnerable groups of people, and identify a priori and adequately manage risks of adverse effects by taking appropriate measures to mitigate them.

AI Act

Commission and European institutions are rightly proud to have introduced the first regulatory proposal on artificial intelligence, globally.
The AI Act bases its general approach on risk and expressly incorporates the ethics guidelines published by the High-Level Expert Group mentioned above, although enforcement effects, especially on consumer rights, should follow from the general pronouncement, which are not clearly discernible in the document.

According to the accompanying explanatory memorandum, the proposal aims to contribute “to the Union’s goal of being a world leader in the development of safe, reliable and ethical artificial intelligence, as stated by the European Council(European Council, Extraordinary meeting of the European Council (October 1-2, 2020) – Conclusions , EUCO 13/20, 2020, p. 7), and ensure the protection of ethical principles, as specifically requested by the European Parliament(Resolution of 20/10/2020, cit.).” In addition, the widespread and common international approach also suggests that “the development and use of AI should be guided by some essential value-oriented principles.”

As with the GDPR, the AI Act proposal follows a proportionate risk-based approach but with conclusions that are expected to be clarified during the trilogue negotiations, such as the interplay between risk assessment under the AI Act and that under the GDPR. The proposal differentiates between the uses of AI that create:

an unacceptable risk (Title II); the unacceptability of the risk results in an outright ban on AI systems that fall into this category
a high risk (Title III); the proposal establishes a methodology for determining when the risk is high because the systems under consideration pose significant risks to the health and safety or fundamental rights of individuals. In such cases, a set of mandatory horizontal requirements will need to be met and preliminary conformity assessment procedures followed
a low or minimal risk (Title IV); in which case only very limited transparency requirements are imposed, such as in terms of providing information to report the use of an AI system in interactions with humans.

Code of conduct

While waiting for the AI Act to officially become an EU regulation to complete the still ongoing legislative process, EU Commission Vice-President Margrethe Vestager – according to Reuters news agency – has promoted the creation of a voluntary code of conduct, a preliminary version of which could already be seen in June 2023. The code of conduct could address the burning issue of generative AI, considering that full implementation of the AI Act, once it becomes law, will take between two to three years.

Compliance survey

On the side of AI compliance with data protection regulations, the Schleswig-Holstein State Data Protection Authority in April 2023 forwarded a questionnaire to OpenAI to assess ChatGPT’s compliance with the GDPR.

The submission letter highlighted concerns about compliance

with the fundamental principles of data protection in Article 5 and Article 25 of the GDPR
regarding a valid legal basis under Art. 6 of the GDPR
regarding the specific requirements of Art. 8 for the processing of children’s data, and
in relation to Articles 13 and 14 of the GDPR for the provision of information to data subjects.

According to the German authority, “this concerns in particular the collection of personal data from publicly available sources, the use of such personal data as training data in the context of machine learning, the storage of personal data as a result of machine learning, and the processing of ChatGPT users’ personal data.“

ChatGPT block and European task force

Back in March 2023, following a data breach concerning “users’ conversations and payment information of service subscribers,” the Italian authority issued a blocking order (provisional restriction of processing), effective immediately. The Italian authority’s objections are similar to those later covered by the German authority’s survey.

At the end of March, the Italian authority ordered OpenAI to take a series of measures to bring itself into compliance, pending the formal conclusion of the investigation:

publication on the company’s website of a privacy policy stating the methods and logic of processing for the operation of ChatGPT; together with an indication of the rights attributed to data subjects
the indication of consent or legitimate interest as a prerequisite (legal basis) for using users’ personal data for algorithm training
the provision of tools to enable data subjects to request the rectification or deletion of inaccurate data generated by the service or to exercise opposition to processing
the implementation of an age verification system for excluding access to children under the age of 13 without parental consent
the promotion of an information campaign.

Following the Italian Data Protection Authority’s measure, the EDPB launched a task force on ChatGPT in order “to promote cooperation and exchange of information on possible initiatives to implement the” GDPR.

International developments

The G7 in Hiroshima in May 2023 acknowledged in an official statement the need to “promote international discussions on inclusive AI governance and interoperability” for trustworthy AI “in line with our shared democratic values. (…) These include fairness, accountability, transparency, security, protection from online harassment, hate and abuse, and respect for privacy and human rights, fundamental freedoms, and protection of personal data.” But it was also acknowledged that approaches to achieve this “common vision and goal of trustworthy AI may change.”
In the private international arena, in March 2023 and with reference to OpenAI’s ChatGPT, Elon Musk and a group of experts called for a six-month pause in the development of more powerful systems to better understand their potential risks to society.

Fake news

Finally, on the side of countering fake news, it is of concern that advanced chatbots such as ChatGPT can create content, authentic-looking images, and even imitate a person’s voice based on a sample, although what is represented is all fake. Generative AI is able to accomplish all this in a matter of seconds.
Aware of these problems, the EU Commission has asked technology platforms including Google, Facebook, YouTube and TikTok to clearly label for users’ photos, videos and text generated by artificial intelligence. But the EU request has two distinct frailties:
– it is based on moral suasion in that it lacks binding force
– it is questionable whether large players are technically capable of ascertaining the outputs of generative AI applications in real time and, therefore, applying the required labeling.