Corrales Compagnucci, Marcelo

Meszaros, Janos

English

Copenhagen University Research Information System

u n i ve r s i t y  o f  co pe n h ag e n  The Interaction Between the GDPR Research Exemption and the Development of AIProducts and ServicesMeszaros, Janos; Corrales Compagnucci, MarceloPublication date:2019Citation for published version (APA):Meszaros, J., & Corrales Compagnucci, M. (2019). The Interaction Between the GDPR Research Exemptionand the Development of AI Products and Services. Abstract from Multidisciplinary Perspectives on Algorithms, Fukuoka, Japan.Download date: 27. maj. 2020The GDPR research exemption and the development of AI products and servicesJanos MeszarosMarcelo CorralesThe Issue1. A company can use your data without consent for scientific research (for public interest). 2. The company uses AI to process the data under the cover of black box.3. Data and results are used for new purposes (without public interest).1. Google gets your health data from the government to research and develop a medical software\application.          (UK, Italy)2. Google delivers the app. ☺But, later…..1. Google can use the results (IP and pseudonymized data) to research and develop a smart watch.2. Google already has data about you. 3. You are easily identified and targeted with new Google services.☺ Or  ?Exceptions and special rules for scientific research in the GDPR•Broad definition of research •Further processing •Processing sensitive data without consent •Exemptions from the new rights (e.g. right to be forgotten) Processing personal data for research purposes without consent in the GDPRDefinition of scientific research in the GDPRinterpreted in a broad mannerBoth basic and applied researchincluding privately funded research(Recital 159) – legally not bindingThe problemThere is no EU law defining scientific research.We contacted all the data protection authorities in the EU: How do they interpret this exemption?None of them had a clear interpretation of this rule.FORUM SHOPPING?Is AI research scientific research?basic research in computer science e.g. quantum computation and quantum information theoryapplied researchdeveloping a new operating system or programming languageIs AI research scientific research?Yes, AI research is part of computer scienceIt can be both basic and applied research.Limits?Since the Regulation provides this broad exemption, it would be crucial to clarify the limits and requirements of scientific research and public interest.The line between scientific research and commercial activity is not sharp. An exampleYour car (Tesla) collects information about yourdriving skills (e.g., speed, reaction times) toimprove the system.The information and improvement will also beintegrated into new cars.LET`S THINK TOGETHERIs this data processing1.Scientific researchOR 2.Commercial activityWhat if….Later, Tesla offers you to buy a safety package?(driving assistance, self parking)Issues with AI research• ‘black box’ - right to explanation• In many cases, the reason for funding and permitting research activities is public interest, which will be hard to demonstrate in a black box situation.• regulation, safety, funding, and patentability…The connection between public interest and the scientific research exemption in the GDPRBarriers for AI in the GDPR?Profilingdecision-makingautomated decision-makingThe impact of AI Research on the individual and societyConclusion, suggestions1. Define `scientific research` on EU level.2. Processing personal data for public interest cannot result in a product which negatively effects the data subjects’ rights. 1. the prohibition on automated decision-making does not pose a significant hurdle for AIresearch, just on the application AI products andservices.2. Similar to medical research, stricter regulationand oversight would be necessary.Conclusion, suggestionsThank you for your attention!

The Interaction Between the GDPR Research Exemption and the Development of AI Products and Services

https://curis.ku.dk/portal/files/241414686/TheInteractionBetweenTheGDPR.pdf

The Interaction Between the GDPR Research Exemption and the Development of AI Products and Services

Abstract

Similar works

Full text

Available Versions

Copenhagen University Research Information System