AI: System vs Processing, Means vs Purposes
An AI system, or several AI systems, could be means selected by a controller to implement personal data operations of a processing activity. It is key to understand that the final purpose of a processing activity is different from the means selected and performed to implement such processing. Indeed, the controller will be the one in determining whether the results of an AI systems would imply an automatic decision or to include a human supervision that makes the final decision. Therefore, automated decisions are not in the nature of the AI-system, but it is an option taken by the controller.
Foto de charlesdeluvio en Unsplash
Let’s start this new post line focusing on Artificial Intelligence analyzing an example to illustrate that an AI system itself is only a means for a processing and not a final purpose.
We could think in a processing activity that involves the recruiting of new staff in a company. This processing activity is defined by its purpose (recruiting), its scope (i.e., CV data, potential employees, the recruiting process, etc.), its context (i.e., labor regulation, social situation, status of such job in the society, etc.) and its nature (or how it is implemented).
Once the controller decides to go on with the implementation of such personal data processing, he/she should work on the design of the overall set of processing operations required or necessary to achieve the final purpose of the processing.
In this example, the set of operations could be to publish the job offer, to have a procedure to guide and gather the CVs and applications, to filter and select the most interesting CVs, to prepare an admission test, to carry out the admission test, to make the final evaluation, to select the most suitable candidate and to contract the selected candidate. As you can see, some of the operations, like publishing the job offer, won’t probably process personal data, but others do so.
The means of implementation of the different operations is a choice of the controller. These means could be automated or manual, in the own facilities or in the cloud, by mobile systems, by outsourcing some operations to processors, and so on. For example, the procedure to guide candidates to fulfill the application form which would include their CVs could be implemented by a chatbot that is an AI-system.
Moreover, the number of CVs issued could be so huge that the controller could decide to use an AI system for the automatic selection of the most interesting CVs according to a certain criterion that should be set up by the controller too. It is a decision of the controller whether such selection wouldn’t be supervised by a human or not, and then if it would become an automated decision-making, or not.
The controller could go further and implement the assessment of the selected candidates by means of another AI system that performs and evaluates tests. The controller could also decide that the final selection of the candidates to be recruited would be made by the results of the AI-system or there would be a human supervision of such evaluation. Again, the controller has the power to set up an automated decision-making operation, or not.
Consequently, in a processing activity like this example, the controller could decide to implement it by using up to three different AI-systems. The operation of CV filtering by AI-system is not a processing activity itself, because such isolated operation could not be legitimated if it is not including in a broad processing with a final and legitimated purpose.
Just to sum up, it is a decision of the controller that the current use the IA-systems could lead to automated decision-making, or not. Therefore, the fact of automated decision-making is not a characteristic of the IA-system itself, but it is about whether the controller includes an additional operation of a human supervision after the results produced by the IA-system.
AI-systems are means that could be selected and implemented by the controller as a set of operations within a specific a processing activity. AI-systems are not processing activities themselves; they are means to implement operations in a processing activity. A processing activity could be implemented by different AI-systems simultaneously, and also, these AI-systems could be implemented on-premises or in the cloud, they could involve data processors, etc. They are part of the nature of the processing activity when they are included in some of the necessary identified steps to carry on the processing activity, and this fact could lead to add specific risks for the rights and freedoms of the data subjects, that must be assessed and managed.
Other materials released by the Spanish DPA regarding this topic are:
