AI regulation & GDPR: ‘nerdy’ but serious problems

Giving a speech to the Irish Law Society Industry Event last week, Sir Geoffrey said that, as technology advances, it is important ‘not to impede its beneficial adoption by premature regulation, before the dangers posed by those technologies are clearly understood’.

The EU’s Artificial Intelligence Act partially came into force in August. The UK, EU, USA and others have signed the Council of Europe’s Treaty on AI, human rights, democracy and the rule of law.

Sir Geoffrey highlighted two ‘nerdy’ but ‘serious problems’—Art 22 of the GDPR, and the question of whether the owners of data used to train AI tools retain residual rights once the machine is in the public domain.

Article 22 protects the data subject’s right not to be subject to a decision based solely on automated processing, including profiling.

Sir Geoffrey said: ‘We may, I suppose, end up with a situation in which local authorities, Amazon and government pension authorities ask customers to consent to automated decision-making every time they contact you, just as we are asked 20 times a day to consent to cookies or additional cookies.’

Article 22 would also have repercussions if AI were to be used in judicial processes, he said, and ‘if AI were ever to be used in judicial decision-making, an automated decision could arguably not be effective’.

Issues over residual rights, such as licensing rights, in data used to train AI are likely to be ‘the subject of significant litigation in the future’, Sir Geoffrey predicted. He referred to a current dispute between Getty Images and Stability AI.

Sir Geoffrey said both problems were ‘created in part at least by regulation getting ahead of private law’.