Brief of the panel @ CLB Fest 2018 Torino, with Daniele Magazzeni, Marco Ciurcina and Pietro Calorio. Video (in Italian): https://www.youtube.com/watch?v=K2WCyu2uEsI https://www.clbfest.it https://www.youtube.com/channel/UCJKU28AkcvbcyLLoyNF2Emw/featured - https://legalhackers.org/clbfest2018/

1. GDPR and Explainable AI
Daniele Magazzeni
Marco Ciurcina
Presented by Pietro Calorio
Turin, March 17th 2018 – 4:00-4:50 PM CET
GDPR e Explainable AI - slide 1 di 20CLBFEST 2018

2. Carol Beer gives you a WARM welcome
GDPR e Explainable AI - slide 2 di 20CLBFEST 2018
https://www.youtube.com/watch?v=zUQgthIs7pM

3. Computer says NO…
GDPR, recital 4:
“The processing of personal data
should be designed to serve mankind”
GDPR e Explainable AI - slide 3 di 20CLBFEST 2018

4. Pietro Calorio
● Nerd, Lawyer, IT and Data Protection
● Founder and President of Sloweb (non-profi)
www.sloweb.org
GDPR e Explainable AI - slide 4 di 20CLBFEST 2018
“Promote the responsible use of
information technologies and
devices, of the web and
Internet applications in
general, through education,
information and combating any
private or public improper uses
of the internet and the web”

5. Daniele Magazzeni
● Director of Artifcial Intelligence and
Autonomous Systems at King's College
London
● https://nms.kcl.ac.uk/daniele.magazzeni/
GDPR e Explainable AI - slide 5 di 20CLBFEST 2018

6. Marco Ciurcina
●Lawyer, and free software and digital
freedom activist
GDPR e Explainable AI - slide 6 di 20CLBFEST 2018

7. Daniele
● Could you please help us to get into the topic
by giving us a very simple and “tech-free”
defnition of “Artifcial Intelligence”?
GDPR e Explainable AI - slide 7 di 20CLBFEST 2018

8. Daniele
●Could you please now (reasonably)
complicate that defnition?
GDPR e Explainable AI - slide 8 di 20CLBFEST 2018

9. GDPR rules on
“automated decision-making” (1/3)
● Data controllers shall provide to the data subject information
about “ihe exisience of auiomaied decision-making, including
profling, [...] and, […] meaningful informaiion aboui ihe logic
involved, as well as ihe signifcance and ihe envisaged
consequences of such processing for ihe daia subjeci” (article
13.2.f and 14.2.g)
GDPR e Explainable AI - slide 9 di 20CLBFEST 2018

10. GDPR rules on
“automated decision-making” (2/3)
● “The daia subjeci shall have ihe righi noi io be subjeci io a
decision based solely on auiomaied processing, including
profling, which produces legal effecis concerning him or
her or similarly signifcanily affecis him or her” (article 22.1)
GDPR e Explainable AI - slide 10 di 20CLBFEST 2018

11. GDPR rules on
“automated decision-making” (3/3)
● Whenever a decison based on an automated processing is carried out (by
contract or consent), the controller “shall implemeni suiiable measures io
safeguard ihe daia subjeci's righis and freedoms and legiiimaie inieresis”
and data subject has the “righi io obiain human inierveniion, io express his
or her poini of view, io obiain an explanaiion of ihe decision reached [...]
and io challenge ihe decision” (recital 71 – article 22.3)
● Unless there is conseni or reasons of subsianiial public inieresi, and
“suiiable measures io safeguard [...] daia subjecis”, automated decision-
making shall not be based on special categories of personal data (article
22.4)
GDPR e Explainable AI - slide 11 di 20CLBFEST 2018

12. Marco
●What about the “right to
explanation” set by the GDPR?
GDPR e Explainable AI - slide 12 di 20CLBFEST 2018

13. Daniele
●Could you please tell us something
about the difference between “black
box AI” and “Explainable AI”?
GDPR e Explainable AI - slide 13 di 20CLBFEST 2018

14. Daniele
●To which questions an AI should
answer? And how it should NOT
answer?
GDPR e Explainable AI - slide 14 di 20CLBFEST 2018

15. Daniele
●Which technical solutions are
adoptable to make an AI
“explainable”?
GDPR e Explainable AI - slide 15 di 20CLBFEST 2018

16. Marco
●Somebody said that GDPR will get
the result to make illegal to develop
applications using deep learning
techniques. Is this true?
GDPR e Explainable AI - slide 16 di 20CLBFEST 2018

17. Marco
● Data Controllers and Data Processors can be
“agencies”: what the GDPR mean by that? Artifcial
agents which determines the purposes and means
of the processing of personal data, in an
autonomous way. Is it an imaginable scenario? Does
the GDPR have a response on that?
GDPR e Explainable AI - slide 17 di 20CLBFEST 2018

18. Marco
●Does it make sense to talk about a
“right to access to the algorithm”?
GDPR e Explainable AI - slide 18 di 20CLBFEST 2018

19. Daniele
●Any advice for AI developers
in this context?
GDPR e Explainable AI - slide 19 di 20CLBFEST 2018

20. Released uncer Creative Commons license (http://www.creativecommons.org)
Attribution – Non Commercial – Share Alike 4.0 International
(CC BY-NC-SA 4.0)
THANK YOU FOR YOUR ATTENTION