Presentation on key legal issues regarding use and developments of BOTs, AI - GDPR, Data Protection. Case study BRISbot. Presentation delivered at Epicenter 30 of May 2017 in partnership with BRIS and Microsoft.

1. Explain
Simplify
Improve.
BRISbot
- juridiska nyckelfrågor & lösningar
Sofia Edvardsen, Managing Partner (CIPP/E)
sofia.edvardsen@sharpcookie.se

2. CEO/Founder, (LL.M., M.Sc., CIPP/E)
AIPPI, National Expert Copyright Law
2006 Degrees in Law & Business
2006 Nokia Corp., Trainee
2007 Chalmers Invest, Legal Counsel
2009 District Court Gothenburg, Junior Judge
2010 Baker McKenzie, Stockholm & London, Advokat
2014 Synch, Advokat/Head of Business Development
2015 Sharp Cookie Advisors, CEO/Founder
Sofia Edvardsen
• Business law firm
• Focus on tech and growth in the digital market
• Our clients are tech leaders
• We help our clients to prioritise
• Expert in IT, AI, Data Protection, transactions, SaaS
• Legal Counsel as a Service
Background & Profile

3. “‘Chatbots
are the new
apps.”
Satya Nadella, CEO Microsoft

4. 25 of May 2018
GDPR will replace PUL
1 law in the entire EU
Free flow of data in EU
Fines 4% or MEUR 20

5. Legal key issues

6. Build solutions that are continuously
“approved” by an innovation task force
consisting of Sales, Marketing, Finance, Legal, IT.
Bots are a powerful service
tool spanning over numerous
building blocks.
Legal key
issues.
Adopt ethical principles for AI
development it is not only best practice, it is
good business (and the best way to stay on
the right side).
Databases
Software Development
Data Science & Business Intelligence
Commercial Offer
Marketing
Data Protection
Cloud Services

7. 1. Focus on the value add for the individual
2. Adopt an ethical approach to AI
3. Document the AI development properly
4. Evaluate the technical environment for your BOT
5. Design transparent, easy to understand terms
6. Monitor, evaluate and improve continuously
Cheat sheet

8. - Legal basis for processing the data
- Consent
- Agreement
- Legitimate interest
- Purpose Limitation and Second Use
- BRIS
- Counselling services to children, adults, families
- Information services to the public
1. Focus on the value add to the individual

9. GDPR on
Fairness.
Effects
- How big data is used is an important
factor in assessing fairness of the use
of the personal data for new purpose
of big data analytics.
- Targeted ads can be relevant or
profiled in a way that perpetuates
discrimination.
- The GDPR does not prevent
automated decision making or
profiling, but it does give individuals a
qualified right not to be subject to
purely automated decision making.
Fairness
- Some type of big data analytics, e.g.
profiling, can have intrusive effects
on individuals.
- Organisations need to consider
whether the use of personal data in
big data applications is within people’s
reasonable expectations.
- The complexity of the methods of big
data analysis, such as machine
learning, can make it difficult for
organisations to be transparent
about the processing of personal data.
Expectations
- Consider whether people could
reasonably expect their data to be
used in the ways that big data
analytics facilitates.
- Deciding what is a reasonable
expectation is linked to the issue of
transparency and the use of privacy
notices, and also to the principle of
purpose limitation, ie whether any
further use of the data is incompatible
with the purpose for which it was
obtained.

10. Data
minimisation.
Accuracy
- There are implications regarding the
accuracy of personal data at all stages
of a big data project: collection,
analysis and application.
- Results of data analysis may not be
representative of the population as a
whole.
- Hidden biases in datasets can lead to
inaccurate predictions about
individuals.
In brief
- Big data analytics can result in the
collection of personal data that is
excessive for the processing purpose.
- Organisations may be encouraged to
retain personal data for longer than
necessary because big data
applications are capable of analysing
large volumes of data.
Right to be forgotten (Art. 17)
- Data subjects will have the right for
their data to be erased in several
situations.
- Applicable where the data is no
longer necessary for the purpose for
which it was collected, or where it is
processed on the basis of consent and
the data subject withdraws that
consent.

11. 2. Adopt an ethical approach to AI
• the use of algorithms
• the opacity of the processing
• the tendency to collect “all data”
• the repurposing of data, and
• the use of new types of data
Some distinctive aspects of Business Intelligence and Big Data are:
Provided data - consciously given
Observed data - recorded automatically
*Derived data - produced data, e.g. calculations, grading
*Inferred data - correlations between datasets based on probabilities,
e.g. profiling
*High risk processing, take extra care and seek expert advice

12. Privacy Impact
Assessments &
Ethics.
Ethical approaches
- An ethical approach to the processing
of personal data in a big data context is
a very important compliance tool.
- Ethics boards at organisational and
national level can help to assess issues
and ensure the application of ethical
principles.
- Ethical approaches to the use of
personal data can help to build trust
with individuals and enhance brand
value.
In brief
- A privacy impact assessment is an
important tool that can help to
identify and mitigate privacy risks
before the processing of personal
data.
- Under the GDPR, it is highly likely that
doing a privacy impact assessment –
known as a ‘data protection impact
assessment’ – will be a requirement
for big data analytics involving the
processing of personal data.
“ Industry specific risks are
the use of inferred data and
predictive analytics.”
Private Sector
- IBM has published an ethical
framework for big data analytics (2014)
- Vodafone publishes a set of privacy
commitments (2015)
- International developments. In the
USA, the Alliance of Automobile
Manufacturers and the Global
Alliance of Automakers has produced
a set of privacy principles for the
consumer data derived from new
vehicle technologies (2014).

13. - Legal basis for processing the data
- Consent
- Agreement
- Legitimate interest
- Purpose Limitation and Second Use
- BRIS
- Instructions to developer
- Data Protection Programme
3. Document the AI development properly

14. Is Personal Data
actually required?
Use anonymised
data.
Be transparent.
Provide meaning-
ful privacy notices.
Is this processing
fair?
Do a Privacy Impact
Assessment.
Could we design
this more secure?
Adopt a privacy by
design approach.
Is this in line with
our ethical
principles?
Develop your
principles or ethics
board.
Is this algorithm
auditable?
Document the
rationale and audit
it regularly.
Key recommendations.

15. - Your own website or application?
- Security
- Consent or alternatives
- A partner’s website, messenger platform or app?
- Security
- Within the EU?
- Detailed instructions and requirements on data
- BRIS
- Simple BOT on Facebook Messenger and Kik
- Advanced BOT on own website
4. Evaluate the technical environment for your BOT

16. - The Legal Documents
- Terms and Conditions
- Privacy Policy
- Cookie Policy
- Emerging Best Practice
- Just in time notices
- Layered notices
- Highlights
- Full Terms
- FAQ
- Swedish or English
- A partner’s website, messenger platform or app?
- Detailed instructions and requirements
5. Design transparent, easy to understand terms

17. Conditions for
processing of
personal data.
Legitimate interest (Art. 6(1)(f)
- Processing is necessary for the
purposes of the legitimate interests
pursued by the controller or by a
third party, except if contrary to the
freedom of the data subject.
- The processing is not necessary if
there is another way of meeting the
legitimate interest that interferes less
with people’s privacy.
In brief
- Obtaining meaningful consent is
often difficult in a big data context, but
novel and innovative approaches can
help.
- Relying on the legitimate interests
condition is not a ‘soft option’. Big data
organisations must always balance
their own interests against those of
the individuals concerned.
- It may be difficult to show that big
data analytics are strictly necessary for
the performance of a contract.
Consent (Art. 6.(1)(a) + Art. 7)
- The opaque nature of analysis using
AI techniques can make it difficult for
meaningful consent to be provided.
- New alternative of ‘just in time’
notifications, yes/no at the time of
the offer through the relationship.
- If an organisation buys data sets, it
need to ascertain that the original
consent obtain by the supplier covers
the further use of the data.
- May be need to provide a new
privacy notice or seek further
consent.

18. - Monitor
- Evalute
- Improve
- BRIS
- Data Protection Programme with the Board’s support
- Embedded into the culture of BRIS
- Data Protection Officer
6. Monitor, evaluate and improve continuously

19. Compliant
approach
No Personal Data
Often, big data analytics will not require
the use of data that identifies individuals.
Algorithmic transparency
- Auditing techniques can be used to
identify the factors that
influence an algorithmic decision.
- Interactive visualisation systems can help
individuals to understand why a
recommendation was made and give
them control over future
recommendations.
Anonymisation - discovery phase
Anonymised data that do not identify an
individual is no longer personal data.
The anonymisation ‘keys’ and other
relevant data that enable identification
should not be kept by the organisation.
Data masking, aggregation,
pseudonymisation.
Ethics Boards
Can help shape and improve the
transparency of the development of
machine learning algorithms.
The Board should develop ethical values
for assuring assessment and evaluation of
big data analytics. E.g. Google’s AI Ethics
Board for Deep Mind (2014).
“Bottom up” approach
Begin with the data itself, experimenting
with what is available to see the
correlations it reveals. Do this with
anonymous data first.

20. 1. Focus on the value add for the individual
2. Adopt an ethical approach to AI
3. Document the AI development properly
4. Evaluate the technical environment for your BOT
5. Design transparent, easy to understand terms
6. Monitor, evaluate and improve continuously
Take aways

21. Tack!
Sofia Edvardsen, Managing Partner
sofia.edvardsen@sharpcookie.se
Office
Hälsingegatan 49, 113 61 Stockholm
+ 46 8 12 44 33 50 (switchboard)
info@sharpcookie.se