1. THE 6TH ANNUAL BCLT PRIVACY LAW FORUM: Silicon Valley
Artificial Intelligence and the Right to an Explanation – A EU perspective
Dr. Andreas Splittgerber, Olswang Germany LLP, Munich Friday, March 24, 2017, East Palo Alto, CA

2. The "Old" Law: Data Protection Directive
The 6th annual BCLT Privacy Law Forum: Silicon Valley
AI and Directive 95/46/EC
The "Old" Law: Data Protection Directive
Article 15: Automated individual decisions
Right of every person not to be subject to a decision
which is based solely on automated processing of data,
and produces legal effects concerning him or significantly affects him
Exceptions:
Decision is taken in the course of entering into or performance of a contract, or
Decision is authorized by a law
Article 12: Right of access of data subject
Knowledge of the logic involved in any automatic processing of data at least in the case of the automated decisions referred to in Article 15 (1)
Splittgerber
March 24, 2017

3. The "New Law": EU General Data Protection Regulation (GDPR)
The 6th annual BCLT Privacy Law Forum: Silicon Valley
AI and Regulation 2016/679 (1)
The "New Law": EU General Data Protection Regulation (GDPR)
Article 4 (4): Definition of "Profiling"
Article 22: Automated decision-making
Right of data subject not to be subject to a decision
which is based solely on automated processing, including profiling,
and produces legal effects concerning him or similarly significantly affects him
Exceptions:
Decision is necessary for entering into or performance of a contract, or
Decision is authorized by Union or Member State law, or
Decision is based on data subject's explicit consent
Article 15 (1) (h): Right of access by data subject
Meaningful information about the logic involved, as well as the significance and the envisaged consequences
Splittgerber
March 24, 2017

4. The "New Law": EU General Data Protection Regulation (GDPR)
The 6th annual BCLT Privacy Law Forum: Silicon Valley
AI and Regulation 2016/679 (2)
The "New Law": EU General Data Protection Regulation (GDPR)
Article 13 (2) (f) and Article 14 (2) (g): Obligation to inform data subject
Meaningful information about the logic involved, as well as the significance and the envisaged consequences
Article 21 (1): Right of data subject to object
Article 35 (1) and (3) (a): Requirement of data protection impact assessment
Article 83 (5) (b): Fines up to 20 mio. € or 4 % of total worldwide annual turnover
Article 70 (1) (f): Board shall issue guidelines for exceptions in Article 22 (2)
Splittgerber
March 24, 2017

5. Personal Data in AI AI and Automated Decision-Making under GDPR
The 6th annual BCLT Privacy Law Forum: Silicon Valley
AI and Automated Decision-Making under GDPR
Personal Data in AI
Collection
Processing
Analytics
Use
Splittgerber
March 24, 2017

6. Old Law and New Law similar Personal Data vs. Anonymous Data
The 6th annual BCLT Privacy Law Forum: Silicon Valley
AI and Transparency
Old Law and New Law similar
Personal Data vs. Anonymous Data
Who is controller?
Transparency ("meaningful logic") vs. Trade Secrets, e.g., obligation to explain
General system functionality
Weighing of factors
Logic of the decision tree
External / other data used
Not: Algorithm, code or other trade secrets
No "ex-post" right to explanation
Other general information obligations under Article 13 and 14 (above all data categories, purpose of processing)
Always keep in mind: GDPR is not intended to block development of AI
Splittgerber
March 24, 2017

7. General Data Protection Regulation Draft ePrivacy Regulation
The 6th annual BCLT Privacy Law Forum: Silicon Valley
Selected Guidance
General Data Protection Regulation
Draft ePrivacy Regulation
European Parliament: Resolution on fundamental rights implications of Big Data and AI
European Data Protection Supervisor: AI, robotics, privacy and data protection
European Data Protection Supervisor: Meeting the challenges of Big Data
European Data Protection Supervisor: Coherent enforcement of fundamental rights in the age of Big Data
Council of Europe: Recommendation regarding automatic processing of personal data in the context of profiling
ICO: Big Data, AI, machine learning and data protection
ICO: Rights related to automated decision making and profiling
Splittgerber
March 24, 2017

8. Thank you! Olswang. Data mattters. www.olswang.com
Dr. Andreas Splittgerber, Partner
OLSWANG Germany LLP Rosental Munich Germany
Munich
Brussels
London
Singapore
Thames Valley
Olswang.
Data mattters.