AI and the right to an explanation

In our first AI blog, we briefly discussed the right of data subjects to be informed of how their personal dataInformation which relates to an identified or identifiable natural person. is being processed and for what purposes. The UK Information Commissioner’s OfficeThe United Kingdom’s independent ‘supervisory authority’ for ensuring compliance with the UK GDPR, Data Protection Act 2018, the Privacy and Electronic Communications Regulations etc. (ICOThe United Kingdom’s independent supervisory authority for ensuring compliance with the UK GDPR, Data Protection Act 2018, the Privacy and Electronic Communications Regulations etc.) has stressed the importance of explaining to data subjects how and why their personal data will be used in a clear way that is easy for them to understand. In the UNESCO paper on the Ethics of Artificial Intelligence, explainability is referred to as “making intelligible and providing insight into the outcomes of AI systems”, referring also to the “understandability of the input, output and behaviour of each algorithmic building block and how it contributes to the outcome of the system.”

In this blog we discuss the importance of the right to be informed, and how to respect this right when deploying AI systems.

Why should there be an explanation?

The right to be informed (or “explainability”) is very much linked to the EU and UK GDPRThe UK General Data Protection Regulation. Before leaving the EU, the UK transposed the GDPR into UK law through the Data Protection Act 2018. This became the UK GDPR on 1st January 2021 when the UK formally exited the EU. principles of accountabilityPerhaps the most important GDPR principle, which requires controllers to take responsibility for complying with the GDPR and, document their compliance. and transparency. Both regulations make it clear that all data controllersEntities (such as an organisation) which determine the purposes and means of the processing of personal data. carrying out any personal data processing activity should be transparent with those whose personal data they processA series of actions or steps taken in order to achieve a particular end.. Controllers of AI technology that process personal data are no different. This includes the transparency obligations under Articles 12 to 14. Transparency is an overarching obligation under data protection laws, applying to the following areas:

• The provision of information to data subjects related to fair processing
• How controllers communicate with data subjects in relation to their rights under the UK/GDPR
• How controllers facilitate the exercise by data subjects of their rights

Providing data subjects with an explanation is important as individuals have the right to be informed of how their personal data is being processed, particularly when there is the existence of solely automated decision-making that produces legal or similarly significant effects. This means that individuals need to be provided with a meaningful explanation of the logic behind the AI system, as well as the possible consequences of the processing. The right to an explanation helps to uphold other data subject rightsUnder UK and EU data protection regulation, data subjects have a number of rights available to them, including the right to be informed, access, rectification, erasure, restrict processing, data portability, to object and further rights in relation to automated decision making and profiling. including Article 22 and the right to meaningful review.

Both the EU and UK GDPR clearly stress the importance of individuals knowing and understanding what is happening to their data. This means that it is vital that organisations that deploy AI technology have detailed documentation in place that explains how and why their data is being processed.

When it comes to explaining solely automated decision-making to data subjects, there are specific requirements for what information needs to be included in the explanation to data subjects if the solely automated decision has the potential to have a legal or similarly significant effect on the individual.

What goes into an explanation?

The ICO has suggested that when writing an explanation, data controllers should provide information based on two sub-categories of information:

Processed-based explanation – gives information on the governance of the AI systems across the design and deployment phases of the project. This part of an explanation is about demonstrating that you have followed best practice and implemented good governance processes across the project.

Outcome-based explanation – gives users clarity on the results of a specific decision. This involves explaining the reasoning behind an outcome generated by an algorithm in a way that is easy for users to understand.

There are many different ways to explain decision making carried out by AI, and the ICO identifies six different types of explanation:

1. Rationale explanation: explaining the reasons that led to a decision outcome, delivered in an accessible and non-technical manner
2. Responsibility explanation: this explains who is involved in development, management and implementation of the AI system, and who users can contact if they want a human review of the decision
3. Data explanation: this involves providing information around what information, about themselves and from other sources, has been used to make a particular decision, or to train the AI system
4. Fairness explanation: explaining the steps taken to ensure that the decisions being made are unbiased and fair, and whether or not an individual has been treated equitably
5. Safety and performance: providing information on the steps that are taken/continue to be taken across the design and implementation of the AI system to maximise the accuracyIn data protection terms, the concept of ensuring data is not incorrect or misleading., reliability, security and robustness of its decision-making abilities and behaviours
6. Impact explanation: this provides individuals with information on the steps taken to consider and monitor the impacts that the use of an AI system and its decisions has or may have on an individual, and the wider society

The ICO has also provided data controllers with the following tips:

• Be upfront and explain the purposes for using AI
• If the purposes of processing are unclear, give individuals an indication of what you are going to do with their data. When processing purposes become clearer, communicate this with people and update your policies
• Inform individuals of any new uses of personal data before you start processing
• If the AI system solely makes automated decisions about individuals with legal or similar significant effect, tell them what information you use, why it is relevant and what the impacts might be
• Consider using ‘just-in-time’ notices and dashboards which can help to keep people informed and let them control further uses of their personal data

What does this mean in practice?

The ICO makes clear that the type of explanation that is most appropriate will depend on the context. It is therefore important for AI data controllers to remember the domain, the audience, and the purpose of their AI system. For example, the explanatory information provided for AI systems that are making decisions about children or other vulnerable people will need to have much more simple language and explanations compared to the explanatory information provided for an AI system used to make decisions affecting computer scientists who already have some technical understanding of how the system works. The main question to ask when considering which to choose is: what information is the data subjectAn individual who can be identified or is identifiable from data. likely to want to know or find most useful?

Conclusion

AI data controllers need to create explanations in ways that are easy to read and understand, keeping in mind the affected data subjects’ level of knowledge of the AI system. They must also ensure that these explanations are easily accessible. Having a solid explanation that considers all the above factors is key to ensuring that AI systems respect the principles of lawfulness, fairness and transparencyThe first principle of the GDPR, requiring organisations to document a lawful basis for collecting and using personal data, to avoid processing personal data in a way that is unduly detrimental, unexpected or misleading to data subjects, and to be clear and honest about how they use personal data..

For more information on the right to an explanation, the ICO and The Alan Turning Institute have created the following guidance documents entitled: “Explaining decisions made by AI” part one, part two and part three.

If you have any questions on the content of this blog, or how The DPO Centre can assist your organisation, please complete the form below.