6 ms·

Personally, I think many people and organizations currently exaggerate the possible changes and risks (for companies) brought on by the GDPR, often with the goa

Personally, I think many people and organizations currently exaggerate the possible changes and risks (for companies) brought on by the GDPR, often with the goal to instill fear (and generate business) or get press coverage. The relevant article (https://gdpr-info.eu/art-22-gdpr/ https://gdpr-info.eu/art-22-gdpr/) clearly states that automated decision making is allowed under the GDPR, it just gives the data subject the right to demand a manual assessment of that decision. In practice, this means that you're absolutely free to use any kind of automated algorithm (AI-based or not) to make decisions on individuals, but if people complain and demand an explanation you need to review the decision manually. Addendum: If you want to learn more about the motivations behind article 22 as well as articles 13 & 14 (that concern the transparency requirements), I highly recommend the official document of the Article 29 working party: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612053 http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_...

dcd0101 9y ago
It sounds like they're suggesting that, assuming those rights exist in these situations (they claim there's ambiguity there), that there are big questions around what qualifies as an acceptable explanation. Did I misunderstand?
- ThePhysicist 9y ago
  Yes, but reading the official guidelines should clarify this ([1], p. 14 ff.): > The controller should find simple ways to tell the data subject about the rationale behind, or the criteria relied on in reaching the decision without necessarily always attempting a complex explanation of the algorithms used or disclosure of the full algorithm. The information provided should, however, be meaningful to the data subject. There's also a detailed example in the document that should make it clearer what kind of explanation is required (and what is not required). Again, personally I understand that it's not clear what exactly will be required here, but titling an article "Will GDPR Make Machine Learning Illegal?" is just an attempt to garner attention by instilling (unfounded) fear. [1]: http://ec.europa.eu/newsroom/just/document.cfm?doc_id=47963 http://ec.europa.eu/newsroom/just/document.cfm?doc_id=47963
  - wiz21c 9y ago
    This : >>> The information provided should, however, be meaningful to the data subject. Although non binding, this makes the intent very clear. "AI: you have been refused insurance. Me : Why ? Insurer : Because our AI has reached that conclusion based on these data : X,Y,Z". Looks perfectly fine to me. Because with enough explanations like this, we can form an opinion about how the AI is working, which in turn will allow to balance the powers between me and the insurer some more. That looks good and balanced to me (notice that this argument doesn't consider the cost of implementation of GDPR, just the way the intereste of parties are better balanced)
    - olympus 9y ago
      Expand that a bit: "Articles 13-15 provide rights to 'meaningful information about the logic involved' in automated decisions." Your scenario doesn't explain the logic. Saying "that's the AI's choice and we're going with it because it's 99.9% accurate" isn't the logic involved in the decision. You need an interpretable model to ensure that the AI isn't discriminating based on a protected class (race/gender/etc). "You were denied a loan because the AI determined that you're Polish, and we don't like Polish people" is partly what this law wants to prevent. Forcing models to be explainable makes sure that we aren't illegally discriminating, so we need to make sure that we can tell why the AI made it's choice, not just what the choice was.
      - wiz21c 9y ago
        100% agree, that's why I wrote "that conclusion based on these data : X,Y,Z". The important word is "data". I said data because with AI, the decision process may be quite a black box. The only thing you know is what data you put in. So to me, input data is part of the answer. In my job, we grant decisions to help people or not. We could use some kind of AI to give, for example, a "pre decision". That AI would be trained on our current data but, in the end, it would interpret the profile of the person. So basically, it'd say "based on the profile of X, we've decided that ...". Now if nationality, for example, was in the list of data in the profile, I'm 100% sure that we'd have a lawyer at our door (rightfully).
montrose 9y ago
If you have to be able to review any decision manually that people complain about, that is significantly limiting. It means you can only write software to do things humans can do. I don't think it's alarmist to worry about the GDPR. It's an extremely far-reaching law covering types of technology that are changing very rapidly. Our default reaction should be skepticism, because the default outcome of that combination is disaster.
- annabellish 9y ago
  I don't think that's quite correct, many (most?) kinds of AI achieve things which are difficult or impossible for humans to do, but that doesn't mean you can't figure out why a decision was made afterwards. There are some scenarios where that isn't possible, but... if nobody knows why decisions impacting people's lives are made and it isn't possible to determine what they were done for, is that something we really want?
  - bobcostas55 9y ago
    >if nobody knows why decisions impacting people's lives are made and it isn't possible to determine what they were done for, is that something we really want? We do this every day with human cognition and nobody complains.
    - montrose 9y ago
      It's too bad your comment is buried so far down in the conversation, because this is probably the most insightful point I've seen on the internet today. And not only do we do this, we have to.
      - ethbro 9y ago
        I don't think that's an accurate analogy, at least at the enterprise level. Generally speaking, individuals do not make decisions. They may influence decisions or find novel ways to apply rules, but anything organizationally important is written down somewhere. Typically for legal purposes.

dcd0101 9y ago

It sounds like they're suggesting that, assuming those rights exist in these situations (they claim there's ambiguity there), that there are big questions around what qualifies as an acceptable explanation. Did I misunderstand?

ThePhysicist 9y ago
Yes, but reading the official guidelines should clarify this ([1], p. 14 ff.): > The controller should find simple ways to tell the data subject about the rationale behind, or the criteria relied on in reaching the decision without necessarily always attempting a complex explanation of the algorithms used or disclosure of the full algorithm. The information provided should, however, be meaningful to the data subject. There's also a detailed example in the document that should make it clearer what kind of explanation is required (and what is not required). Again, personally I understand that it's not clear what exactly will be required here, but titling an article "Will GDPR Make Machine Learning Illegal?" is just an attempt to garner attention by instilling (unfounded) fear. [1]: http://ec.europa.eu/newsroom/just/document.cfm?doc_id=47963 http://ec.europa.eu/newsroom/just/document.cfm?doc_id=47963
- wiz21c 9y ago
  This : >>> The information provided should, however, be meaningful to the data subject. Although non binding, this makes the intent very clear. "AI: you have been refused insurance. Me : Why ? Insurer : Because our AI has reached that conclusion based on these data : X,Y,Z". Looks perfectly fine to me. Because with enough explanations like this, we can form an opinion about how the AI is working, which in turn will allow to balance the powers between me and the insurer some more. That looks good and balanced to me (notice that this argument doesn't consider the cost of implementation of GDPR, just the way the intereste of parties are better balanced)
  - olympus 9y ago
    Expand that a bit: "Articles 13-15 provide rights to 'meaningful information about the logic involved' in automated decisions." Your scenario doesn't explain the logic. Saying "that's the AI's choice and we're going with it because it's 99.9% accurate" isn't the logic involved in the decision. You need an interpretable model to ensure that the AI isn't discriminating based on a protected class (race/gender/etc). "You were denied a loan because the AI determined that you're Polish, and we don't like Polish people" is partly what this law wants to prevent. Forcing models to be explainable makes sure that we aren't illegally discriminating, so we need to make sure that we can tell why the AI made it's choice, not just what the choice was.
    - wiz21c 9y ago
      100% agree, that's why I wrote "that conclusion based on these data : X,Y,Z". The important word is "data". I said data because with AI, the decision process may be quite a black box. The only thing you know is what data you put in. So to me, input data is part of the answer. In my job, we grant decisions to help people or not. We could use some kind of AI to give, for example, a "pre decision". That AI would be trained on our current data but, in the end, it would interpret the profile of the person. So basically, it'd say "based on the profile of X, we've decided that ...". Now if nationality, for example, was in the list of data in the profile, I'm 100% sure that we'd have a lawyer at our door (rightfully).

montrose 9y ago

If you have to be able to review any decision manually that people complain about, that is significantly limiting. It means you can only write software to do things humans can do. I don't think it's alarmist to worry about the GDPR. It's an extremely far-reaching law covering types of technology that are changing very rapidly. Our default reaction should be skepticism, because the default outcome of that combination is disaster.

annabellish 9y ago
I don't think that's quite correct, many (most?) kinds of AI achieve things which are difficult or impossible for humans to do, but that doesn't mean you can't figure out why a decision was made afterwards. There are some scenarios where that isn't possible, but... if nobody knows why decisions impacting people's lives are made and it isn't possible to determine what they were done for, is that something we really want?
- bobcostas55 9y ago
  >if nobody knows why decisions impacting people's lives are made and it isn't possible to determine what they were done for, is that something we really want? We do this every day with human cognition and nobody complains.
  - montrose 9y ago
    It's too bad your comment is buried so far down in the conversation, because this is probably the most insightful point I've seen on the internet today. And not only do we do this, we have to.
    - ethbro 9y ago
      I don't think that's an accurate analogy, at least at the enterprise level. Generally speaking, individuals do not make decisions. They may influence decisions or find novel ways to apply rules, but anything organizationally important is written down somewhere. Typically for legal purposes.