AI, ETHICS AND THE FUTURE OF HEALTH Jean-Philippe Walter Vice-Chair of the Committee of Convention 108 26 January 2017

Setting the scene The Universal Declaration of Human Rights takes as its starting point the inviolability of human dignity The European Convention on Human Rights: Right to private life (article 8) Prohibition of discrimination (article 14)

Setting the scene Big data: 3 Vs Data sets characterised by the Volume, Velocity and Variety of data that may be analysed to extract inferences, patterns, trends and correlations. Big data in health would involve  the fusion and connection of existing databases for the purpose of improving health and health system performance (Study on Big Data in Public Health, Telemedecine and Healthcare, European Commission, December 2016).

Setting the scene The World Health Organisation (WHO) Constitution enshrines “…the highest attainable standard of health as a fundamental right of every human being.” The right to health includes access to timely, acceptable, and affordable health care of appropriate quality.

Setting the scene – Oviedo Convention The Council of Europe Convention on Human Rights and Biomedecine “Article 2 – Primacy of the human being The interests and welfare of the human being shall prevail over the sole interest of society or science.” “Article 4 – Professional standards Any intervention in the health field, including research, must be carried out in accordance with relevant professional obligations and standards.”

Oviedo Convention Additional Protocol concerning Genetic Testing for Health Purposes “Article 19 – Genetic screening programmes for health purposes A health screening programme involving the use of genetic tests may only be implemented if it has been approved by the competent body. This approval may only be given after independent evaluation of its ethical acceptability and fulfilment of the following specific conditions …

Oviedo Convention a. the programme is recognised for its health relevance; b. the scientific validity and effectiveness of the programme have been established; e. the programme provides measures to adequately inform the population or section of population concerned of the existence, purposes and means of accessing the screening programme as well as the voluntary nature of participation in it.

Health data and insurances Recommendation (2016)8 on the processing of personal health-related data for insurance purposes, including data resulting from genetic tests identifying high-risk patients…v. identifying high costs patients

Data protection standards Convention 108 - Sole legally binding international instrument 36 years old: 50 Parties (including Uruguay, Mauritius, Senegal) Pending: Morocco,Tunisia, Cape Verde Burkina-Faso ? Next ?

Convention 108 modernised Sensitive data (article 6) Health data, genetic data, biometric data uniquely identifying a person, “for the information they reveal” – only allowed where appropriate safeguards are enshrined in law, complementing those of the Convention.

Convention 108 modernised Rights of the data subject (article 8) “Every individual shall have a right: not to be subject to a decision significantly affecting him or her based solely on an automated processing of data without having his or her views taken into consideration; c. to obtain, on request, knowledge of the reasoning underlying data processing where the results of such processing are applied to him or her”

Convention 108 modernised Additional obligations (article 8 bis) “... take all appropriate measures to comply with the obligations of this Convention and be able to demonstrate…compliance” “examine the likely impact … prior to the commencement … and design the processing to prevent or minimise the risk”. “ implement technical and organisational measures at all stages of the processing. Adapt, according to …

Recommendation on medical data (1997) Recommendation on health data Draft recommendation Major challenges today, relating to the processing of health-related data, which now takes place in an environment that has changed considerably since the adoption of the 1997 Recommendation on the protection of medical data.

Recommendation on medical data (1997) Recommendation on health data This changed environment is due to the phenomenon of data digitisation, made possible by the computerisation of the health sector and to the proliferation of exchanges of information arising from the development of the Internet. Geographical mobility + development of medical devices and connected objects = rapidly growing volume of data.

Recommendation on medical data (1997) Recommendation on health data Health-related data may be processed for the following purposes where such processing is not forbidden by law and appropriate safeguards are provided: - for processing for scientific or historical research purposes or for archiving purposes in the public interest or statistical purposes under the conditions defined by domestic law in order to guarantee protection of the data subject’s legitimate interests.

Recommendation on medical data (1997) Recommendation on health data Health-related data may also be processed if the data subject has given his or her consent and appropriate safeguards are provided. In all cases, suitable safeguards should be established in order to guarantee, in particular, the security of the data and respect for the rights of the individual.

Big data / algorithmic impact Guidelines on big data General guidance – to be complemented in sector-specific applications, e.g. Health data Ethical and socially aware use of data Preventive policies and risk assessment Purpose limitation and transparency By-design Consent Anonymisation

Big data / algorithmic impact “Of data and men" – fundamental rights and freedoms in a world of big data Report by Antoinette Rouvroy “expectations generated by Big Data all converge on the prospect of improvement” “Deloitte accordingly explains that it is possible, using a supermarket shopping database, to determine a person’s current and future health status with a degree of accuracy comparable to that of a medical examination”.

Big data / algorithmic impact “In the hyper-connected world we live in, according to calculations performed by IBM, each person generates more than one million gigabytes of health-related data over their lifetime.” Data no longer produced only by doctors, hospitals or health insurers.. BUT also by the individuals themselves, whether they are ill or not (e-health, self-quantified devices and data about diet, gym attendance, or how often health-related websites are visited)

Technological convergence, AI and human rights Work of the Parliamentary Assembly of the Council of Europe Preparation of an expert Report (Resolution and Recommendation).

International Conference of Data protection and Privacy Commissioners Paper of the EDPS on Artificial intelligence, Robotics, Privacy and Data Protection The ethical dimension and the technical dimension

To conclude Privacy and data protection are / must be a platform for a sustainable and dynamic digital environment Privacy and data protection are not an obstacle, but a necessary condition for a fair and comprehensive processing of personal data, e.g. health data and to guarantee to all individuals the control of their personal information

Thank you for your attention www.coe.int/dataprotection dataprotection@coe.int