Alexandre Veronese, University of Brasília The right of explanation and the right to object automatic decisions: EU/GDPR and Brazilian GDPFA Alexandre Veronese, University of Brasília 1st July 2019 centrolatam.digital

 Context: data, information and its protection. CENTRO DE POLÍTICA DIGITAL PARA AMÉRICA LATINA Nombre de la presentación CONTENTS OF THE PRESENTATION  Context: data, information and its protection.  From regular data to Big Data.  The EU/GDPR.  The Brazilian GDPFA.  Solutions: technical, legal, or ethical.. 2 / 15

CONTEXT: DATA, INFORMATION AND ITS PROTECTION #CPRLATAM2019 The right of explanation and the right to object automatic decisions: EU/GDPR and Brazilian GDPFA

CENTRO DE POLÍTICA DIGITAL PARA AMÉRICA LATINA Nombre de la presentación DATA, INFORMATION AND ITS PROTECTION Most countries are passing into Law data protection statutes in order to grant legal standards to secure their citizens and enterprises. The US applies privacy legal standards. To commence, we must explain why data is a contemporary legal subject. 4 / 15

CENTRO DE POLÍTICA DIGITAL PARA AMÉRICA LATINA Nombre de la presentación “(…) as the plural form of the Latin word ‘datum’, means ‘things that have been given’; it is, therefore, an apt term for the sort of information-as-thing that has been processed in some way for use; commonly ‘data’ denotes whatever records are stored in a computer” (Michael Buckland, 1991: 45). 5 / 15

CENTRO DE POLÍTICA DIGITAL PARA AMÉRICA LATINA Nombre de la presentación In John Moore v. Regents of the University of California, the State Supreme Court ruled against the petitioner to recognize the absence of any entitlement to him from his own spleen cells. Those cells were considered as raw data. Something from nature and not from a person. How can we protect raw data? 6 / 15

THE EUROPEAN UNION GENERAL DATA PROTECTION REGULATION #CPRLATAM2019 The right of explanation and the right to object automatic decisions: EU/GDPR and Brazilian GDPFA

THE EUROPEAN UNION GDPR CENTRO DE POLÍTICA DIGITAL PARA AMÉRICA LATINA Nombre de la presentación THE EUROPEAN UNION GDPR There is a long tradition of data protection in some countries of the EU. One example is France. The ‘Loi informatique et libertés’ dates from 1978. This statute creates both legal standards for data protection and administrative control by a government agency (‘Commission nationale de l’informatique et libertés’). The GDPR is a Regulation, which means that it came into Law as a piece of legislation with direct application in all of the 28 Member States. The EU Parliament and Commission passed it into Law in 2016. Nevertheless, it came into force only in 2018. 8 / 15

THE EUROPEAN UNION GDPR CENTRO DE POLÍTICA DIGITAL PARA AMÉRICA LATINA Nombre de la presentación THE EUROPEAN UNION GDPR The idea is to build a EU comprehensive legal and administrative framework to data protection.  Uniform legal prescriptions and norms.  Court of Justice of the European Union to harmonize interpretation.  European Data Protection Board to harmonize technical and legal standards among Member States DPAs. The MACHINE-LEARNING process sets into motion an evolving complex environment. How can we grant legal, ethical or technical protection against ARTIFICIAL INTELLIGENCE unfair decisions? 9 / 15

RIGHTS OF EXPLANATION AND TO OBJECT DECISIONS CENTRO DE POLÍTICA DIGITAL PARA AMÉRICA LATINA Nombre de la presentación RIGHTS OF EXPLANATION AND TO OBJECT DECISIONS The GDPR has two sets of rights to protect citizens against totally automated decisions.  The first is the right to receive an explanation about how the machine makes the automated decision (Articles 35 and 47).  The second is the right to object the decisions (Articles 21 and 22). 10 / 15

THE BRAZILIAN GENERAL DATA PROTECTION FEDERAL ACT #CPRLATAM2019 The right of explanation and the right to object automatic decisions: EU/GDPR and Brazilian GDPFA

CENTRO DE POLÍTICA DIGITAL PARA AMÉRICA LATINA Nombre de la presentación THE BRAZILIAN STATUTE The Brazilian Federal statute is very recent – 2018 – and it will yet come into force in 2020. It has less detail than the EU GDPR. Nevertheless, the idea is to have a compatible legal standard with the European Union. The Act grants the right to receive explanation and to object automated-decisions in its Article 20. 12 / 15

SOLUTIONS? TECHNICAL LEGAL ETHICAL #CPRLATAM2019 The right of explanation and the right to object automatic decisions: EU/GDPR and Brazilian GDPFA

TECHNICAL, LEGAL OR ETHICAL? CENTRO DE POLÍTICA DIGITAL PARA AMÉRICA LATINA Nombre de la presentación TECHNICAL, LEGAL OR ETHICAL? It is very hard to create machine-learning systems that have the capability to limits themselves in relation of data-gathering and data-processing. Usually, the data is – by its own nature – multipurpose. There are also legal problems when it comes to creation of Big Data restrictions to enforce limits on experimentation about improbable inferences and discoveries. One thing is to ethically limit the use of information. That is manageable. Another is to limit to use of raw data, because it very hard to label it. 14 / 15

CONTACT ALEXANDRE VERONESE Full Professor of Legal and Social Theory CENTRO DE POLÍTICA DIGITAL PARA AMÉRICA LATINA Nombre de la presentación CONTACT ALEXANDRE VERONESE Full Professor of Legal and Social Theory University of Brasilia - UnB, Faculty of Law ( direito.unb.br ) CCOM UnB – Centre for Communication Policies ( ccom.unb.br )  veronese@ccom.unb.br  veronese@matrix.com.br  Academia.edu https://brasilia.academia.edu/AlexandreVeronese  Research-Gate https://www.researchgate.net/profile/Alexandre_Veronese 15 / 15

centrolatam.digital