Administering AI And Data Regulation - Insights From European And Indian Accountability Frameworks
Author: LawSphereX
Category: Technology, Cyber & Privacy
Published:
Updated:
ADMINISTERING AI AND DATA REGULATION: INSIGHTS
FROM EUROPEAN AND INDIAN ACCOUNTABILITY FRAMEWORKS
Aastha Jain, O.P Jindal Global University
ABSTRACT
As technology rapidly evolves, Artificial intelligence (AI) continuously integrates the world, playing a significant role in decision-making across various aspects of life. The research paper compares European and Indian approaches to addressing administrative responsibility in data regulation, focusing on the interplay between AI legal personhood, liability, and accountability. The research paper aims to examine the General Data Protection Regulation (GDPR) and the proposed AI Act within the European framework, along with the Personal Data Protection Act, to see how these statutes can regulate AI, keeping administrative principles in mind like transparency, fairness, and judicial review, as transparency is ultimately based on rule of law. 1The paper will also analyse the DPDP Act through the lens of administrative law principles and whether it can adopt AI as a data intermediary.
The paper will also propose policy recommendations to enhance administrative liability in AI-driven data regulation and foster a solid and accountable data governance framework for emerging technologies. Keywords: Artificial Intelligence (AI), Fairness, Transparency, Accountability, ADM, AI legal personhood, GDPR, AI Act, DPDP Act, Delegation, Data Regulation.
1 WISCHMEYER, T. ARTIFICIAL INTELLIGENCE AND TRANSPARENCY
OPENING THE BLACK BOX, IN REGULATING ARTIFICIAL INTELLIGENCE 78, (T. Wischmeyer & T. Rademacher eds., 2020).
1 INTRODUCTION
AI has made all our lives a lot easier; from completing assignments, writing codes, and solving complex math problems to planning a trip, AI can do it all. So why not use AI to help courts and different authorities make decisions and make their lives easier? Well, it is not that easy. While AI has the traits of processing a vast amount of data in seconds, it also contains traits of being biased and discriminatory. While judges may also exhibit bias and unexplainable reasoning in court decisions, the apprehension surrounding AI use in courts is grounded in accountability and the legal maxim nemo judex in causa sua. 2It is harder to determine whether the software owner or the code writer should be held responsible for the illegal acts of AI.
If used by the government, AI can help them in several instances; they can predict future administrative necessities and, to some degree, adopt automated decision-making processes, which Europe already adopted. 3These skills can enhance the effectiveness of administrative law rules by improving timeliness, accuracy, and cost-efficiency in governance. Still, they can also lead to failure of transparency, fairness, judicial review, and the rule of law. It might also lead to excessive delegation of decision-making power. 4
1.1 Research Design and Methodology
The paper wishes to answer the question of whether administrative principles such as transparency and fairness influence the design of AI-powered accountability framework for data regulation in Europe and India with the help of GDPR, the AI Act and the DPDP Act by analysing case studies, research papers, scholarly works, statutes, and government policies. To gather information for this paper, the research process involved utilising various platforms like JSTOR, SCOPUS, Hein Online, Oxford publications, Springer, Administrative law by Paul Craig and many more, by adopting keywords like administrative law in AI, Data regulation, GDPR, AI Act, and Data regulation in AI. To ensure that the research remained relevant to the current times, the selection process involved choosing recent papers from the pool of 20-25
2 PAUL CRAIG, ADMINISTRATIVE LAW 796 (2021).
3 Fatria Khairo & Firman F. Busroh, Harnessing the Power of AI in Shaping Administrative Law Regulations, 5 IJSOC 617, 618(2023).
4 Id at 618.
research papers. The pool of relevant documents was further limited by looking at the methodology they adopted, the clarity of the paper, and the policy recommendations they gave.
2. UNDERSTANDING ADMINISTRATIVE RESPONSIBILITY IN AI-DRIVEN
DATA REGULATION
2.1 AI and its relationship with biasness
As we know, AI intelligence works on data being fed. If the data that the AI is being fed contains societal bias, there is a risk that AI’s decisions will also replicate such bias. 5All these AI models are made in the West, which runs the risk of them being unfit to be adopted in other countries as the data is being fed pertains to the issues of the West. One such bias was found in Google’s generative AI platform, Gemini. Recently, one journalist named Arnab Ray asked the Gemini whether Modi was a fascist or not, to which the AI agreed that Modi had been accused of the same. Still, when Arnab asked the same about Donald Trump, the Gemini said they could not give such information as an AI. When the government of India took cognizance of this, Google's CEO stated that Gemini is just an AI tool and may not always be reliable. Here, the Gemini has violated India's IT rules.
6 If we look at the research published in the Journal of Administrative Ethics in 2022, over 25% of the AI administrative apps have shown noticeable biases and unintentionally mirroring societal prejudices. 7 If we do not aim to check these prejudices, they can undermine the fundamental values of fairness and equity that administrative law seeks to maintain. All of this raises the serious question of whether using AI in decision-making would lead to biased results. We are to treat AI as an intermediary platform and who to hold accountable when AI commits a crime. 8
2.2 AI Legal Personhood
To address responsibility in the context of AI, we must look at the concept of AI legal personhood and its approach to address it. If we are to grant legal personhood to the AI system,
5 Id at 621.
6 India confronts Google over Gemini AI tool’s ‘fascist Modi’ responses (2024) The Guardian. Available at: https://www.theguardian.com/world/2024/feb/26/india-confronts-google-over-gemini-ai-tools-fascist-modiresponses (Accessed: 08 April 2024).
7 Supra at 3, 623.
8 Supra at 3, 622.
they could be held directly accountable for their actions rather than trying to hold them indirectly liable through human stakeholders. Interestingly, people have been apprehensive about giving AI legal personhood as that would provide AI with the other fundamental rights people have, which can create chaos in the legal system. However, the same legal personhood has been given to companies under the Companies Act 2013 9, so granting the same should not lead to such chaos and can help with accountability.10
3 THE EUROPEAN APPROACH
GDPR, AI ACT AND BEYOND
3.1 Automatic decision making in Europe
The European Commission for the Efficiency of Justice (CEPEJ) has outlined five principles for using AI in the judiciary: respecting fundamental rights, ensuring non-discrimination, maintaining data quality and security, promoting transparency, impartiality, and fairness, and keeping AI systems under user control. 11These principles guide the responsible adoption of AI in judicial systems, influencing the development of regulatory frameworks such as the GDPR and the proposed AI Act in Europe. 12 Europe has used automated decision-making for quite some time. In the past, society usually did not have access to whether the tools they adopted were discriminatory or not, as such a tool is not transparent to society regarding numbers or even technology. 13 Along with the issues of transparency, fairness and accountability, the main problem is delegation.
To what extent can we use automated decision-making (ADM) to stay within the realm of delegation and not cross the lines of excessive delegation? 14 Many researchers have argued that the use of ADM is lawful to the extent public officials can prove they have reviewed
9 Companies Act, No. 18 of 2013 (India).
10 VISA AJ KURKI, A THEORY OF LEGAL PERSONHOOD, 176(2019).
11 Catelijne Muller, The Impact of Artificial Intelligence on Human Rights, Democracy and the Rule of Law, draft, (Mar. 20, 2020), https://allai. nl/wp-content/uploads/2020/06/The-Impact-of-AI-on-Human-Rights-Democracyand-the-Rule-of-Law-draft. pdf. 12 Council of Europe, European Ethical Charter on the Use of Artificial Intelligence in Judicial Systems and Their Environment (Oct. 4, 2018), https://www. coe. int/en/web/cepej/cepej-european-ethical-charter-on-the-use-ofartificial-intelligence-ai-in-judicial-systems-and-their-environment. 13 Igor Gontarz, Judicial Review of Automated Administrative Decision-Making: The Role of Administrative Courts in the Evaluation of Unlawful Regimes, 2023 ELTE L. J. 151, 159-161 (2023). 14Cary Coglianese & David Lehr, Regulating by Robot: Administrative Decision Making in the Machine-Learning Era, 6-2017 U. Pa. L. Sch. , 1177 (2017).
the decision, not merely gesturing their approval, that they are competent to make a change, and that they have taken all relevant facts into account. 15 AI accountability cannot be without transparency; people affected by these AI decisions need to learn how these systems work more simply to understand how they affect them. 16Recital 71 of the GDPR 17is the way Europe approaches the question of transparency by granting the person the option of not being solely subjected to the ADM. Still, such right will be taken away from him in cases where it is allowed by law for such a person to give his expressed consent. Still, in those situations, the recital talks about having suitable safeguards, but who will decide on such safeguards is yet another point that raises questions about administrative principles. 18
3.2 GDPR through the lens of Administrative law
In line with this notion, Article 12(1) of the GDPR19 requires data controllers to provide information to individuals in a clear, transparent, and easily accessible manner. 20Similarly, The French Act, which provides individuals with the ‘principal characteristics’ of a decisionmaking system where the state actors decide with the help of algorithms, was inspired by the former DPD(Data Protection Directive) and current Article 13, 15 and Article 22 of GDPR. 21 Article 15(1)(h) of the GDPR 22grants individuals the right to access this information. However, these GDPR rights are limited to cases of automated decision-making (ADM) as defined in Article 2223, which only applies to decisions based solely on automated processing that have legal effects or significantly affect a person.
Consequently, AI-based systems that only support humans in decision-making are not subject to these provisions. 24
15 Supra at 13.
16 George B. Mensah, Artificial Intelligence and Ethics
A Comprehensive Review of Bias Mitigation, Transparency, and Accountability in AI Systems, RESEARCHGATE, page (2023) DOI: 10.13140/RG.2.2.23381.19685/1.
17 Regulation (EU) 2016/679, Recital 71, 2016 O.J. (L 119/1).
18 Wolswinkel, Johan, Comparative Study on Administrative Law and the Use of Artificial Intelligence and Other Algorithmic Systems in Administrative Decision-Making in the Member States of the Council of Europe, 13 (Dec. 2022), https://www.coe.int/cdcj.
19 General Data Protection Regulation, Regulation (EU) 2016/679, art. 12(1), 2016 O.J. (L 119/1).
20 WISCHMEYER, T. ARTIFICIAL INTELLIGENCE AND TRANSPARENCY
OPENING THE BLACK BOX, IN REGULATING ARTIFICIAL INTELLIGENCE 87, (T. Wischmeyer & T. Rademacher eds., 2020).
21 Id at 82-82.
22 General Data Protection Regulation, Regulation (EU) 2016/679, art. 15(1)(h), 2016 O.J. (L 119/1).
23 General Data Protection Regulation, Regulation (EU) 2016/679, art. 22, 2016 O.J. (L 119/1).
24 Supra at 17, 83.
According to Article 35 of the General Data Protection Regulation (GDPR), organisations must conduct Data Protection Impact Assessments (DPIAs) where their handling of personal data, especially when utilising new technologies, is expected to pose a significant danger to individuals. A Data Protection Impact Assessment (DPIA) is mandatory whenever there is systematic and comprehensive profiling or other automated evaluation of personal data that leads to decisions with legal or similarly significant consequences for individuals.25
3.3 AI Act through the lens of Administrative Law principles
Similarly, the proposed AI Act aims to ensure transparency (Articles 13, 52), fairness (Article 10), and judicial review (Article 43) for high-risk AI systems. By integrating these administrative law principles into their regulatory landscape, the EU strives to 9foster responsible AI adoption and address potential societal concerns while safeguarding human rights, democracy, and the rule of law in an increasingly AI-driven society. However, some scholars have raised concerns about the effectiveness of these regulations in practice. A study by Veale et al. (2018) pointed out that the GDPR's provisions on algorithmic decision-making and profiling lack clarity, which may limit their effectiveness in ensuring transparency and fairness.
26Similarly, Mittelstadt (2019) argued that the current regulatory focus on individual rights and transparency in the GDPR may not sufficiently address the systemic risks posed by AI systems. 27Regarding the proposed AI Act, scholars such as Jobin et al. (2022) have expressed concerns about the potential loopholes in the regulation, arguing that the AI Act's scope is too narrow, focusing only on high-risk AI systems, and may not adequately protect citizens from potential harm caused by AI technologies in general. 28
4 THE INDIAN CONTEXT
NAVIGATING ADMINISTRATIVE RESPONSIBILITY IN DATA REGULATION In India, the Digital Personal Data Protection Act (DPDP Act) is the primary legislation governing data protection. The Act aims to provide a comprehensive legal framework for data
25 9 PAUL CRAIG, ADMINISTRATIVE LAW 790(2021).
26 Veale, M., Binns, R., & Edwards, L., Algorithms that remember
Model inversion attacks and data protection law. Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 10- 11(2018), https://doi. org/10. 1098/rsta. 2018. 0083. 27 Mittelstadt, B. , Principles alone cannot guarantee ethical AI, Nature Machine Intelligence 1-20, 3(2019). 28 Jobin, A. , Ienca, M. , & Vayena, E. (2022). The global landscape of AI ethics guidelines. Nature Machine Intelligence, 4(5), 399-414. privacy and security in the country. Central to its administration is the Data Protection Authority of India (DPA), a regulatory body responsible for overseeing and enforcing the provisions of the Act. 29 Unlike the multi-layered structure of the European Union's General Data Protection Regulation (GDPR), India's DPDP Act establishes a single centralised authority for data protection matters.
Furthermore, while the GDPR differentiates between sensitive personal information and personal information to grant the former more robust protection, the DPDP bill fails to distinguish between the two. 30 As the European Union proposes the AI Act to ensure judicial review and accountability, India still lacks similar provisions in its legal framework. Indian authorities have hesitated to integrate AI in decision-making, yet its growing prominence demands a robust AI policy. AIdriven solutions like ‘Kisan e-Mitra’, National Pest Surveillance System, and crop health assessment tools support farmers, address crop-related issues, and promote healthier produce. 31Similarly, the healthcare sector is witnessing the implementation of AI in telemedicine platforms, disease detection and diagnosis, and healthcare infrastructure optimisation.
These initiatives demonstrate the government's commitment to harnessing AI technology for sector-wide improvements and enhancing the lives of its citizens. 32 Justice B. V Nagarathna's dissenting opinion in Demonetisation's case has repeatedly reminded us how excessive delegation would be ex-facie arbitrary and suffer from unconstitutionality. It feels like the legislation failed to remember that while passing the DPDP Bill. 33The bill uses the words "as may be prescribed" in various sections such as Section 12, Section 13 and Section 16; these provisions raise questions about transparency as we do not know what may be prescribed and whether the people governed by the Act will be under the curtains on how such Act will be applied to them. The funny part is that "as may be prescribed" has been used 28 29 Ministry of Electronics & Info. Tech.
, Gov’t of India, Digital Personal Data Protection Bill (2022), https://www. meity. gov. in/content/digital-personal-data-protection-bill. 30 Dipika Jain, Regulation of Digital Healthcare in India: Ethical and Legal Challenges, 11 Healthcare 911 (2023), https://doi. org/10. 3390/healthcare11060911. 31Press Information Bureau, Gov't of India, Krishi Kalyan Abhiyaan - II: MietY's Crop Prediction System Empowering Farmers for Higher Output and Better Financial Returns, (Jan. 12, 2022), https://pib. gov. in/PressReleaseIframePage. aspx? PRID=2002010.
32 Supra at 27.
33 Vivek Narayan Sharma v. Union of India,(2023).
times in the entire bill, raising the question that this bill is ill-defined. Such ambiguity in the bill strikes the bill's heart as it gives the government power to make arbitrary decisions. 34 The sub-section(5) of section 8 uses the words “reasonable security safeguards”. However, the word 'reasonable' is open to interpretation by a data fiduciary. Furthermore, Data fiduciaries do not have to get consent from data owners before sharing data with other data fiduciaries or data processors. This weakens the control that data owners have over their personal data and makes people worry about sharing personal data without their knowledge or permission.
35 To address the concerns that the bill lacks the provision for AI regulation, one can argue that while the Digital Personal Data Protection (DPDP) Bill itself does not explicitly define data intermediaries, the term is defined in Section 2(1)(w) Information Technology Act, 2000 (IT Act)36 as “any person who on behalf of another person receives, stores or transmits that record or provides any service concerning that record and includes telecom service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes. ” AI systems often perform similar functions, such as collecting, processing, and analysing data to generate insights or make predictions. As such, it could be argued that AI systems fall within the scope of data intermediaries. 37
5. HARMONISING ADMINISTRATIVE
LAW PRINCIPLES AND
POLICY
RECOMMENDATIONS
Aiming for a life without AI is not the solution to curb such biases and discrimination; we need an effective regulatory scheme to deal with the same with the commitment to technological due process. 38Countries worldwide are trying to adopt AI in their decision-making system most transparently and fairly; the Canadian government has invested billion in public funds to seek AI research and development.39 Along with that, the Supreme Court of Canada has emphasised how the data being fed to AI can lead to biased results if the data being fed is 34 Brittas, J. and Babu, A. (2023) What lies beneath the PR Blitz on the New Data Protection Act?, The Wire. Available at: https://thewire.in/government/what-lies-beneath-the-pr-blitz-on-the-new-data-protection-act (Accessed: 08 April 2024).
35 Id.
36 Information Technology Act, 2000, § 2(1)(w) (India).
37 9 PAUL CRAIG, ADMINISTRATIVE LAW 783(2021).
38Amy Goudge, Administrative Law, Artificial Intelligence, and Procedural Rights, 42 WINDSOR REV. LEGAL & SOC. ISSUES 17, 43 (2021).
39 Id at 38.
discriminatory; they found risk assessment tools to curb the same. 40The same tools can be adopted by the administrative and judicial bodies in Europe and India by also putting much importance on the kind of different data for different geographical areas of the world; the data should relate to the societal views, laws and procedures. Engineers are developing transparency-enhancing tools to make AI easily understandable to those affected by its decisions. 41 Such tools should be made easily accessible to the people who are subject to such ADM’s. One way forward is the inclusion of diverse perspectives, as was discussed in the paper before on how all these AI models are being coded in the West but for the same to be adopted in India or countries with different views, cultures, morals and laws; we cannot apply the same as the data that is being fed is not relevant to us.
Furthermore, instead of feeding these AI models one sector of data or one type of data, we need to involve a diverse group of stakeholders in the development and implementation of such AI models and regulations governing the same. 42 Furthermore, many automatic systems impose fines, such as speeding tickets, without a hearing. However, the penalty system usually allows an individual to appeal the penalty in a magistrates' court. 43The same analogy can be applied to the decision-making of the AI model. When the court makes a mistake while interpreting the statute, the affected party can appeal on the same and can argue how the court has failed to apply the correct interpretation.
The court reviews the decision of the public bodies with the help of the 'Wednesbury test', which assesses whether the decision was reasonable or not; the same test should be applied to AI systems in Public Body Decisions. 44
6 CONCLUSION
Europe has come a long way in incorporating administrative principles into its rules. However, there are still concerns about how clear and compelling the current rules are, especially when it comes to dealing with the systemic risks that AI systems bring. In the same way, India's DPDP Act tries to set up a complete data protection system but has trouble making sure that
40 Id at 40.
41 Id at 48.
42 Supra at 1, 623.
43 9 PAUL CRAIG, ADMINISTRATIVE LAW 783(2021).
44 Id at 800-802.
everything is transparent and accountable, especially when it comes to AI regulation, as India still lacks legislation on the same. Second, the paper shows that AI governance needs to be more nuanced. It needs to find a balance between new technologies and administrative values. This will encourage responsible AI use while protecting fundamental rights and social interests. Lastly, the paper stresses how important it is to have policy-making processes that include a wide range of parties and points of view. This way, regulatory efforts can be tailored to each region's unique social, cultural, and legal conditions. Overall, the results show how important it is to keep improving regulatory systems to deal with the changing problems and chances that AI technologies bring, which will lead to a fairer, more open, and more responsible digital future.
If we are to talk about liability and accountability, it is still a grey area. Criminal liability can only be attached if mens rea can be attached to that individual, and when it comes to AI, which is, at the end of the day, a subset of robots, criminal liability cannot be attached. The concept of legal personhood should be adopted for the AI models. To stop AI systems from being misused or having adverse impacts, it is important to set clear rules, standards, and roles for developers, organizations, and users. By setting up ways for people to be held accountable, we can make sure that AI is used in an honest and responsible way, stopping biases and discrimination from spreading in a world that is becoming more and more AI-driven. 45
45 George B. Mensah, Artificial Intelligence and Ethics
A Comprehensive Review of Bias Mitigation, Transparency, and Accountability in AI Systems, RESEARCHGATE, page (2023) DOI: 10.13140/RG.2.2.23381.19685/1.