AI or Not To AI: That is the (Legal) Question

This client alert is available for download with the bibliography in English and in Spanish.

What Artificial Intelligence Is and Why It Matters

Artificial intelligence (AI) plays a key role in our society, providing “opportunities for economic, social, and cultural development; energy sustainability; better health care; and the spread of knowledge” (European Parliamentary Research Service, 2020). The term “AI” was first coined by John McCarthy in 1956 and refers to “systems that display intelligent behaviour by analysing their environment and taking actions – with some degree of autonomy – to achieve specific goals” (European Commission, 2021). AI‑based systems can consist solely of software acting in the virtual world (e.g., voice assistants, image analysis software, search engines, voice and facial recognition systems); or embedded AI in hardware devices (e.g., advanced robots, self-driving cars, drones or Internet of Things applications) (Commission, 2018). The increase in computing power and data availability and advances in algorithms have made AI one of the most strategic technologies of the 21^st century (id.).

AI is a reality and has woven its way into everyday life (EDPS, 2021), helping to solve complex problems and boost the green and digital transformation of businesses and societies (European Commission, 2021). So far AI has helped, inter alia, the healthcare sector, enabling fast and effective diagnosis of COVID-19; the energy sector, allowing a cheaper and more sustainable production; and even the security sector, by anticipating cyber-attacks.

AI and the European Union Upcoming Legal Framework

Following the publication of the European AI Strategy presented in April 2018, the President of the European Commission, Ursula von der Leyen, led the European Digital Strategy addressing AI regulation, which resulted in the publication of the European Commission’s first White Paper on Artificial Intelligence in February 2020. The strategy consists of no less than 70 actions aimed at creating synergies between Member States and the European Commission in key areas, including research, investment, data, and international cooperation, with an expected target end date of 2027 and subject to constant review.

Two of the key aspects highlighted by the Commission are: (i) the creation of an “ecosystem of excellence” through a partnership between the public and private sectors, with the aim of mobilising resources along the entire value chain, starting with research and innovation, and creating the right incentives to accelerate the adoption of AI-based solutions, including by small and medium-sized enterprises (SMEs); and (ii) the establishment of a future regulatory framework for AI in Europe that will create a unique “ecosystem of trust,” following an anthropocentric approach, to give citizens the confidence to adopt AI applications and businesses and public organisations the legal certainty they need to innovate using AI (Commission, 2020). The aim is to attract more than €20 billion of total annual investment in AI in the EU over the next ten years. To stimulate public and private investment, the EU will make available resources from the Digital Europe programme, Horizon Europe and the European Structural and Investment Funds to address the needs of less-developed regions and rural areas (id.).

To advance the Commission’s proposal, the European Parliament formed the Special Committee on Artificial Intelligence in a Digital Age (AIDA) to analyze the impact of AI on the EU economy, and adopted three recommendations on what the AI standards should include in the areas of Ethics, Liability and Intellectual Property Rights (IPR).

1. Ethics: The Parliament stressed that future AI regulation should necessarily be anthropocentric, guided by principles of security, transparency and accountability to ensure against bias and discrimination, including a right to redress and social, environmental, privacy and data protection responsibility.

2. Liability: The Parliament calls for a legal framework on liability that makes high-risk AI operators objectively liable for the damage they may cause, providing legal certainty to businesses and citizens to increase their confidence in AI technologies.

3. IPR: The Parliament strived to ensure an effective system of intellectual property rights including safeguards within the European patent system to protect innovative developers. In the MEPs’ intentions, it will be important to distinguish between human creations obtained with the assistance of AI and those generated autonomously by AI by not recognising any legal personality to AI (Parliament, 2020)

AI and Data Protection

Many AI applications process personal data and, thanks to AI, all kinds of personal data can be used to analyse, forecast and influence human behaviour. The AI-based processing of data on individuals and their interactions provides “opportunities for social knowledge and better governance, but it risks leading to the extremes of ‘surveillance capitalism’ and ‘surveillance state’” (European Parliamentary Research Service, 2020). An adequate normative framework must be ensured “where individual interests and the social good are preserved and enhanced” (id.).

AI and the GDPR

AI is not explicitly mentioned in the GDPR; however, many of its provisions are relevant to, and even challenged by, the new ways of processing personal data that are enabled by AI. There is a “tension between the traditional data protection principles – purpose limitation, data minimisation, the special treatment of ‘sensitive data’, the limitation on automated decisions – and the full deployment of the power of AI and big data” (id.). The latter involves the collection of massive amounts of data concerning individuals and their social relations and processing it for purposes that were not fully determined at the time of collection. However, there are ways to interpret, apply, and develop the data protection principles that are consistent with the beneficial uses of AI and big data (see European Parliamentary Research Service, 2020).

Regarding this issue, the Commission aims “to ensure legal clarity in AI-based applications, especially regarding data. Thus the proposed regulation on data governance will help by boosting data sharing across sectors and Member States, while the General Data Protection Regulation (GDPR) is a major step towards building trust” (European Commission, 2021).

On November 25, 2020, the European Commission published a Proposal for a Regulation on European Data Governance (the “Data Governance Act”), part of a set of measures related to the European Data Strategy, that aims at making the EU a leader in a data-driven society (Commission, 2021). The Data Governance Act provides the basis for a new way of managing data at the European level that respects EU values and principles, such as data protection (GDPR), consumer protection and competition rules. The aim is to improve the conditions and mechanisms for data sharing in the internal market by creating a harmonised framework for data exchange, both for access and re-use. In particular, the new regulation will establish a common legal framework by intervening on data sharing in the public sector, on intermediary services for sharing data between businesses and data subjects provided against remuneration, and on “data altruism,” i.e., the collection and processing of data made available for altruistic purposes by natural and legal persons (id.).

However, during the regulation’s approval process, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) intervened on the European Commission’s proposal for a Data Governance Act, pointing out some inconsistencies with the GDPR (EDPB, 2021), namely: (i) definitions (e.g., “data holder,” “data user,” “data sharing” and “permission”); (ii) obscure expressions (e.g., “consent or permission of data holders”); and (iii) ambiguities (e.g., the processing of personal data and non-personal data, and the absence of a clear reference to the possible conditions of re-use of personal data by public entities) (id.).

Next Steps Towards a Digitally Empowered Europe

Following the in-depth analysis of the open public consultation on the Commission’s AI White Paper, President Ursula von der Leyen announced, on the occasion of the “Masters of Digital 2021” event, that the Commission will publish its proposal for regulating AI on April 21, 2021. The President stated that the horizontal proposal (i.e., with a cross-sectoral application) would establish “some requirements for high-risk AI (artificial intelligence) applications, from using high-quality data to ensuring human control. At the same time, we will present a new plan to promote European excellence in AI” (Commission, 2021). In line with what the European Parliament has already envisaged, the proposal will safeguard fundamental EU values and rights, including user safety by obliging high-risk AI systems to meet certain mandatory requirements (Rechtsanwälte, 2020), such as ensuring there is human oversight, and clear information on the capabilities and limitations of AI.

In the meantime, on the occasion of the Digital Day 2021 held on March 19, EU Member States signed three Declarations to pool efforts and resources to “promote international connectivity, incentivise the rollout of clean digital technologies and improve the regulatory environment for start-ups and scale-ups” (Commission, 2021). These tangible commitments will help accelerate Europe’s green and digital transformation and will contribute to the vision and goals of Europe’s Digital Decade, presented by the Commission on March 9, 2021, to set the course towards a digitally empowered Europe by 2030 (Commission, 2021).

Needless to say, technologies such as AI and digitisation of infrastructure, services and economic activities will be at the heart of the European regulatory and investment framework in the coming years.

Conclusion

That AI is already a crucial part of our everyday lives is a fact, and regulation is on its way. The pandemic has shown how pivotal digital technologies and skills have been to maintaining economic and social life throughout the pandemic crisis. Most businesses recognize that AI is the key differentiating factor in a successful transition to a sustainable, post-pandemic economy and society. (Id.)

Curtis is here to assist companies engaged or interested in AI, and to encourage following closely the Parliament’s and Commission’s next moves in the upcoming months and adapt effectively to a knowledge- and data-driven new economy.

Attorney advertising. The material contained in this Client Alert is only a general review of the subjects covered and does not constitute legal advice. No legal or business decision should be based on its contents.