Skip to main content

Advertisement

Log in

Comparative legal study on privacy and personal data protection for robots equipped with artificial intelligence: looking at functional and technological aspects

  • Original Article
  • Published:
AI & SOCIETY Aims and scope Submit manuscript

Abstract

This paper undertakes a comparative legal study to analyze the challenges of privacy and personal data protection posed by Artificial Intelligence (“AI”) embedded in Robots, and to offer policy suggestions. After identifying the benefits from various AI usages and the risks posed by AI-related technologies, I then analyze legal frameworks and relevant discussions in the EU, USA, Canada, and Japan, and further consider the efforts of Privacy by Design (“PbD”) originating in Ontario, Canada. While various AI usages provide great convenience, many issues, including profiling, discriminatory decisions, lack of transparency, and impeding consent, have emerged. The unpredictability arising from the AI machine learning function poses further difficulties, which have only been partially addressed by legal frameworks in the aforementioned jurisdictions. However, analyzing the relevant discussions yielded several suggestions. The first priority is adopting PbD as the most flexible, soft-legal, and preferable approach toward AI-oriented issues. Implementing PbD will protect individual privacy and personal data without specific efforts, and achieve both the development of AI and the advancement of privacy and personal data protection. Technical measures that can adapt to an individual’s dynamic choices according to the “context” should be further developed. Furthermore, alternative technical measures, including those to solve the “algorithmic black box” or achieve differential privacy, warrant thorough examination. If AI surpasses human intelligence, a terminating function, such as a “kill switch” will be the last resort to preserve individual choice. Despite numerous difficulties, we must prepare for the coming AI-prevalent society by taking a flexible approach.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1

Source: G7 ICT Ministers’ Meeting in Takamatsu, Kagawa, Proposal of Discussion toward Formulation of AI R&D Guideline, extracted from http://www.soumu.go.jp/joho_kokusai/g7ict/english/main_content/ai.pdf

Similar content being viewed by others

Notes

  1. Igo is defined as “a Japanese game for two persons, played on a board having 361 intersections on which black and white stones or counters are alternately placed, the object being to block off and capture the opponent's stones and control the larger part of the board” (http://www.dictionary.com/browse/igo).

  2. “Artificial intelligence, through machine learning, needs a vast amount of data to learn: data in the realm of big data considerations. On the other direction, big data uses artificial intelligence techniques to extract value from big datasets” (European Data Protection Supervisor 2016, p. 4).

  3. The report referenced a more detailed history in the Appendix of the AI 100 Report (Stone et al. 2016).

  4. He announced the achievement in a tweet: see https://twitter.com/JeffBezos/status/809034847121350657.

  5. The Nevada Revised Statutes Chapter 482A and the Nevada Administrative Code Chapter 482A include provisions for autonomous vehicles.

  6. The EDPS states: “It is important to remark that the models created by machine learning will not be human understandable in most cases. The criteria a machine learning algorithm may find to classify input data, or the memory as weights in a neural network, will most probably lack expressivity as correct as they may be. This has a big impact when discussing algorithmic transparency” (European Data Protection Supervisor 2016, p. 19).

  7. Pagallo cites Gianmarco V (2006) Euron Roboethics Roadmap. In: Proceedings Euron Roboethics Atelier, February 27 to March 3, Genoa, Italy.

  8. 1995 O.J. (L 281) 31–50.

  9. 2016 O.J. (L 119) 1–88.

  10. GDPR Article 6 conditions the lawfulness of processing. Article 6(1)(e) provides that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Article 6(1)(f) provides that processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject that require the protection of personal data, in particular where the data subject is a child.

  11. This concerns the so-called “sensitive data.” Article 9(1) prohibits processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

  12. The basic privacy principles of national application are the: Collection Limitation Principle; Data Quality Principle; Purpose Specification Principle; Use Limitation Principle; Security Safeguards Principle; Openness Principle; Individual Participation Principle; Accountability Principle. Retrieved from https://www.oecd.org/internet/ieconomy/privacy-guidelines.htm.

  13. The EDPS paper cites Frank Pasquale’s “The Black Box Society” (Harvard University Press 2015).

  14. The Transportation Security Administration is a division of the Department of Homeland Security. Founded in 2001 in response to terrorism, the entity is responsible for handling traveler screening for all of passengers. See Criminal Justice Degree Hub.com, http://www.criminaljusticedegreehub.com/tsa/.

  15. “Context” is thought to be important in the PbD (see Sect. 3.3.3).

  16. “Covered entity” means a person that collects, creates, processes, retains, uses, or discloses personal data in or affecting interstate commerce in Section 4(b) of the Consumer Privacy Bill of Rights Act (White House 2015, p. 3).

  17. See Kyllo v. United States, 533 U.S. 27 (2001).

  18. It provides that the “the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized”.

  19. Katz v. United States, 389 U.S. 347 (1967). In his concurring opinion, Justice Harlan stated that “[…] there is a twofold requirement, first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as "reasonable".

  20. United States v. Jones, 132 S.Ct. 945 (2012).

  21. The overall laws and cases on privacy are organized in McIsaac et al. (2016).

  22. Approximately 250 federal government institutions are listed in Schedule Three.

  23. It also applies to personal information of employees of federally regulated works, undertakings, or businesses (organizations that are federally regulated, such as banks, airlines, and telecommunications companies).

  24. The Canadian Standards Association originally developed a set of privacy protection principles that, in 1996, were approved as national standards by the Standards Council of Canada. The Model Code for the Protection of Personal Information was incorporated into PIPEDA. Meanwhile, the EU Directive gave impetus for privacy legislation in the private sector. Article 25 of the Directive prohibits member countries from transferring personal information to any non-member country that does not provide an adequate level of data protection.

  25. Article 8 provides that everyone has the right to be secure against unreasonable search or seizure.

  26. PbD is translated into 38 languages as of 2016.

  27. The House of Representatives Cabinet Committee’s supplementary resolution on May 20, 2015 and the House of Councilors Cabinet Committee’s supplementary resolution on August 27, 2015 stated the importance of implementing PbD in the areas in which personal data are handled. Retrieved from https://www.oecd.org/internet/ieconomy/privacy-guidelines.htm.

  28. Article 24 restricts data provision to a third party in a foreign country, which was introduced through the amendment in 2015.

  29. The English translation can be retrieved from http://www.ppc.go.jp/files/pdf/Act_on_the_Protection_of_Personal_Infomration.pdf.

  30. The author was solely responsible for English translation of the MIC Report.

  31. Controlling the invasion by robots into private spheres, controlling the surveillance by robots in private spheres, controlling unauthorized access to robots, etc.

  32. Controlling data collection, analysis, and use; implementing anonymization, encryption, and access control functions, etc.

  33. Appropriate control of collection; analysis and use of biological information, including brain information, etc.

  34. The author was solely responsible for English translation.

References

Judgments

  • Bundesverfassungsgericht [BVerfG], Dec. 15, 1983, 65 Entscheidungen des Bundesverfassungsgerichts [BVerfGE] 1

  • Katz v. United States, 389 U.S. 347 (1967)

  • Kyllo v. United States, 533 U.S. 27 (2001)

  • United States v. Jones, 132 S.Ct. 945 (2012)

Online news article and magazines

Other online sources

Video

  • Roques-Bonnet MC, Louveaux S, Brill J, Cannataci J, Ikonomou D, Wong SK, Wood S (2017) AI and GDPR: Concretely, what are the obligations and steps to take? In: CPDP 2017 (This article referred the speech made by Brill J.). https://www.youtube.com/watch?v=PWIeyNYQbm8. Accessed 12 July 2017

Download references

Acknowledgements

This research is supported by the research program “Human-Information Technology Ecosystem” within the Research Institute of Science and Technology for Society, Japan Science and Technology Agency.

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Kaori Ishii.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Ishii, K. Comparative legal study on privacy and personal data protection for robots equipped with artificial intelligence: looking at functional and technological aspects. AI & Soc 34, 509–533 (2019). https://doi.org/10.1007/s00146-017-0758-8

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s00146-017-0758-8

Keywords

Navigation