Everything Is Not Terminator Public-facing Artificial Intelligence Policies—part Ii

• Jurisdiction: United States,Federal,European Union
• Publication year: 2019
• Citation: Vol. 2 No. 2

John Frank Weaver^*

In my last column,¹ I explored the first two components that I recommend clients address in their public-facing AI policies: disclosure of AI that interacts with customers and disclosure of the decisions AI makes. In light of the California bot bill (the "California Bot Bill")² that became law last fall, I advised businesses that rely on AI-based customer service to include a statement in their AI policies disclosing the existence of any chat bots and explaining the requirements of the new law. In light of the EU's General Data Protection Regulation (the "GDPR"),³ I advised that organizations conduct a two-part self-analysis of their business practices: (1) determine if they rely on AI for profiling or automated decision making, as the GDPR defines it;⁴ and (2) isolate those decisions and classify them as either (a) decisions that produce legal effects concerning data subjects or similarly significantly affects data subjects, or (b) decisions that produce no legal effects concerning data subjects or do not similarly significantly affects data subjects. I then recommended that your AI policy be drafted to reflect how your answers comply with Article 22(1) of the GDPR, which states that each "data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her."⁵

In this second part, I review the final two components that should be standard considerations when preparing an AI policy: disclosure of the types of data relied on and disclosure of how AI reaches decisions.

Types of Data Relied On

This topic bridges the last part of the previous column—disclosure of the decisions your organization relies on AI to make— and the last part of this column—disclosure of how AI in your

[Page 141]

organization reaches decisions. Those two sections of an AI policy are governed by AI-specific sections of the GDPR. In contrast, Article 15 of the GDPR grants data subjects the right to obtain from controllers the categories of data being processed, a requirement that applies to all processing of data, not just automated decision making. Similarly, American laws like the California Online Privacy Protect Act of 2003 ("CalOPPA")⁶ and California Consumer Privacy Act of 2018 (the "CCPA")⁷ also address disclosure of the types of data organizations have collected.

The central issue in including this information in your AI policy is transparency. Most companies that collect personal data or personally identifiable information on the internet maintain a privacy policy that discloses the categories of that data or information collected, consistent with the GDPR⁸ and CalOPPA.⁹ Why restate this information in an AI policy or make a new disclosure in an AI policy?

The biggest reason is to stay ahead of the trend of required and preferred disclosures. The GDPR and CCPA are the most current and widely applicable privacy laws that your organization is likely to encounter in the near future. They not only require the disclosure of the categories of data your organization relies on, but upon the request of an individual, they also require your organization to release a copy of the personal data and personal information from that person that your organization has processed¹⁰ and to disclose the purposes for which you are using that person's information.¹¹ Canada's Personal Information Protection and Electronic Documents Act contains similar requirements.¹² The legal trend is toward requiring greater disclosure of the data you rely on; more transparency, not less.

This is true for AI as well, both in terms of public policy recommendations and advice from industry groups, even if the black letter law does not reflect this yet. For example, the National Science and Technology Council's 2016 report, Preparing for the Future of Artificial Intelligence, called for the establishment of open data sets to train AI and for the private sector AI to rely on.¹³ Other entities emphasize that not only should data be more available, but the algorithms the AI relies on when analyzing the data should also be reviewable in some way. The Institute of Electrical and Electronic Engineers has warned about the dangers of the "black box," the locked up algorithm that produces decisions in response to data it receives, but without public scrutiny.¹⁴ Similarly, although there is

[Page 142]

no federal law addressing disclosure of AI data sets or algorithms, the Office of Technology Research and Investigation in the Federal Trade Commission relies on the Commission's power to prevent deceptive trade practices to investigate algorithmic transparency issues that are potentially...