본문 바로가기
KERD
논문KCI 등재

인공지능 관점에서 GDPR 제22조의 인간 개입에 대한 분석

Analysis on Human Involvement in the GDPR Article 22 in terms of Artificial Intelligence

황지은
법학연구소 (The Institute of Legal Studies Konkuk University)|2020.05|경제규제와 법|제13권 제1호|pp. 37-58|DOI 10.22732/CeLPU.2020.13.1.37

0

조회

0

다운로드

9

인용

0

참고문헌

키워드

인공지능알고리즘artificial intelligencealgorithmdecision based solely on automated processingEU General Data Protection RegulationEU 일반정보보호규정인간 개입자동화된 처리에만 근거한 결정human involvement
주제분류법학

초록

인공지능의 발전에 따라, 인공지능 규제와 관련된 GDPR 제22조의 중요성이 커지고 있다. 자동화된 처리에만 근거한 결정에 따르지 않을 권리를 보장한 GDPR 제22조는 의사결정과정에 인간 개입이 있었는지에 따라 규제의 적용 여부가 결정되는 성격이 있다. 자동화 의사결정이 효율성, 일관성 등의 장점이 있음에도 알고리즘 결정에 인간 개입을 요구하는 것은, 알고리즘의 리스크를 감독하고 알고리즘이 반영하기 어려운 인간적 특성을 고려하기 위한 것일 수 있다. 그러나 GDPR 제22조에서의 인적 개입은 이러한 목적을 달성하지 못한 채 인공지능 환경에서 여러 한계를 보인다. 첫 번째 한계는 어느 정도로 인간이 개입해야 실질적인 인간 개입이 되는 것인지 그 기준이 불분명하다는 것이다. 두 번째로 하나의 최종 결정을 위해 여러 개의 인공지능의 판단이 연속되는 경우, 어느 단계에서 인간이 개입해야 하는지가 불분명하다. 세 번째는 정보 및 역량 등이 부족한 상황에서 실질적으로 인적 개입을 한다는 것이 현실적으로 가능한지에 대한 의문이다. 네 번째 한계는 의미 있는 인적 개입이 이루어졌는지 외부에서 감독하기가 힘들다는 것이다. 인공지능 시대에서 GDPR 제22조가 실효성을 갖기 위해서는 인간 개입을 둘러싼 한계를 극복할 필요가 있다. 첫째, 인간 개입이 실질적인지 명목적인지를 나누는 기준이 명확해야 한다. 이 논문은 이를 위해 자동화 결정과정에 대한 전반적 이해, 실제 검토행위의 존재, 최종 결정의 근거 및 과정에 대한 설명이라는 기준을 제시한다. 둘째, 여러 인공지능의 판단이 연속되는 경우, 각각의 인공지능 판단이 끝날 때마다 인간이 개입하도록 하여 인적 개입 단계를 명확히 할 필요가 있다. 셋째, 실질적 인적 개입의 실효성을 강화하기 위한 방안을 강구해야 한다. 알고리즘 감사, 설명가능한 인공지능 등을 통해 인공지능 판단과정의 투명성을 높이고, 인간의 검토 역량을 기르기 위한 훈련을 강화해야 한다. 인공지능 프로그램의 개발조직과 활용조직이 다를 경우, 제3자 기관을 통한 감사, 계약 등을 통해 인간 개입의 실효성을 확보해야 한다. 넷째, 외부 감독기관에 대한 정보 제공 및 조사 직원 역량 강화 등을 통해 외부 감독기관이 인간 개입의 적절성을 제대로 판단하도록 하여 개인정보 관리자들이 명목적 인적 개입으로 규제를 회피할 가능성을 낮추어야 한다.

Abstract

The GDPR Article 22 has been drawing attention with the development of artificial intelligence. The feature of Article 22 which guarantees the right not to be subject to a decision based solely on automated processing, is that human involvement in the decision-making process could determine the application of the regulation. Although automated decision-making has advantages such as efficiency and consistency, human involvement in algorithm decision-making could be required to supervise the risks of the algorithm and to consider human characteristics that are difficult for algorithm to reflect in decision process. However, human involvement in Article 22, without achieving these goals, presents several limitations in the AI environment. The first limitation is that it is unclear to what extent human should step in for substantive human involvement. Second, when several AI judgments are successive for a final decision, it is ambiguous at what stage human involvement should take place. Third, it could be questionable whether meaningful human involvement is realistically possible in situations where information and capabilities for reviewing the AI decision are deficient. The fourth is that external supervision of whether it is meaningful human involvement could be difficult. In order to become effective regulation in the AI ​​era, Article 22 needs to solve the limitations on human involvement. First, the standard for classifying whether human involvement is nominal or substantive should be distinct. To this end, this paper suggests the criteria of the general understanding of the automated decision-making process, the existence of actual review actions, and explanation of the basis and process for the final decision. Second, when multiple AI decisions are consecutive, it is required to clarify the stage of human involvement by letting human to involve at the end of each automated decisions. Third, measures to strengthen the effectiveness of substantive human involvement including transparency enhancing system such as algorithmic auditing and explainable AI, training for human review capability, and auditing through third-party organizations should be devised. Fourth, it is necessary to strengthen external supervision by providing sufficient information and improving capacity of supervisory authorities.

참고문헌 (53)

  1. Goodfellow, Ian, "Deep Learning" (2016), MIT Press
  2. Hildebrandt, Mireille, "Digital Enlightenment Yearbook 2012" (2012), IOS Press
  3. Russell, Stuart, "Artificial Intelligence: A Modern Approach" (2010), Pearson
  4. Van Otterlo, Martijn, "Privacy, Due Process and the Computational Turn-Philosophers of Law Meet Philosophers of Technology" (2013), Routledge
  5. Adler, Philip, "Auditing black-box models for indirect influence", Knowledge and Information Systems, 54(1), pp.95~ (2018)
  6. Bennett, Colin, "The European General Data Protection Regulation: An instrument for the globalization of privacy standards?", Information Polity, 23(2), pp.239~ (2018)
  7. Brennan-Marquez, Kiel, "Artificial Intelligence and Role-reversible Judgement", Journal of Criminal Law &Criminology, 109(2), pp.137~ (2019)
  8. Jenna Burrell, "How the machine ‘thinks’: Understanding opacity in machine learning algorithms", Big Data & Society, 3(1), pp.205395171562251~ (2016), SAGE Publications[DOI]
  9. Buttarelli, Giovanni, "The EU GDPR as a clarion call for a new global digital gold standard", International Data Privacy Law, 6(2), pp.77~ (2016)
  10. Bygrave, Lee A., "Automated Profiling:Minding the Machine: Article 15 of the EC Data Protection Directive and Automated Profiling", Computer Law & Security Review, 17(1), pp.17~ (2001)
  11. Citron, Danielle K., "Technological Due Process", Washington University Law Review, 85, pp.1249~ (2008)
  12. Citron, Danielle K., "The Scored Society: Due Process for Automated Predictions", Washington Law Review, 89, pp.1~ (2014)
  13. De Hert, Paul, "Expanding the European data protection scope beyond territory:Article 3 of the General Data Protection Regulation in its wider context", International Data Privacy Law, 6(3), pp.230~ (2016)
  14. Edwards, Lilian, "Slave to the algorithm? Why a 'right to an explanation'is probably not the remedy you are looking for", Duke Law and Technology Review, 16(1), pp.18~ (2017)
  15. Hildebrandt, Mireille, "Privacy as protection of the incomputable self : from agnostic to agonistic machine learning", Theoretical Inquiries in Law, 20, pp.83~ (2019)
  16. Kroll, Joshua A., "Accountable Algorithms", University of Pennsylvania Law Review, 165(3), pp.633~ (2017)
  17. Kuner, Christopher, "Machine learning with personal data: is data protection law smart enough to meet the challenge?", International Data Privacy Law, 7(1) (2017)
  18. Kuner, Christopher, "The GDPR as a chance to break down borders", International Data Privacy Law, 7(4), pp.231~ (2017)
  19. Mittelstadt, Brent, "Automation, Algorithms, and Politics : Auditing for Transparency in Content Personalization Systems", International Journal of Communication, 10, pp.4991~ (2016)
  20. Mittelstadt, Brent, "The Ethics of Algorithms: Mapping the Debate", Big Data & Society (2016)
  21. Roig, Antoni, "Safeguards for the right not to be subject to a decision based solely on automated processing (Article 22GDPR)", European Journal of Law and Technology, 8(3) (2017)
  22. Scherer, Matthew U., "Regulating Artificial Intelligence Systems: Risks, Challenges, Competencies, and Strategies", Harvard Journal of Law &Technology, 29(2), pp.353~ (2016)
  23. Selbst, Andrew D., "The Intuitive Appeal of Explainable Machines", Fordham Law Review, 87, pp.1085~ (2018)
  24. Turing, Alan M., "Computing Machinery and Intelligence", Mind, 59(236), pp.433~ (1950)
  25. Tutt, Andrew, "An FDA for algorithms", Administrative Law Review, 69, pp.83~ (2017)
  26. Veale, Michael, "Clarity, surprises, and further questions in the Article 29 Working Party draft guidance on automated decision-making and profiling", Computer Law & Security Review, 34(2), pp.398~ (2018)
  27. Wachter, Sandra, "Why a Right to Explanation of Automated Decision-Making Does Not Exist in the General Data Protection Regulation", International Data Privacy Law, pp.76~ (2017)
  28. Wrigley, Sam, "'Bots, artificial intelligence and the General Data Protection Regulation: asking the right questions", Trinity College Law Review, 22, pp.199~ (2019)
  29. Zarsky, Tal, "Transparent Predictions", University of Illinois Law Review, 2013, pp.1503~ (2013)
  30. Global Data Privacy Laws 2015: 109 Countries, with European Laws Now a Minority’, Privacy Laws & Business International Report, "Greenleaf, Graham", UNSW, ~, pp.UNSW Law Research Paper No. 2015-21 (2015)
  31. Growing the artificial intelligence industry in the UK, Independent report, "Hall, Dame Wendy", ~ (2017)
  32. Machine Learning wit h Personal Data, "Kamarinou, Dimitra", Queen Mary University of London, ~, pp.Queen Mary University of London Legal Studies R esearch Paper No. N247 (2016), 2016
  33. Almada, Marco, "Human Intervention in Auto mated Decision-Making: Toward the Construction of Contestable Systems", 17th International Conf erence on Artificial Intelligence and L aw (ICAIL 2019) (2019)
  34. Sandvig, Christian, "Auditing Algorithms: R esearch Methods for Detecting Discrimin ation on Internet Platforms", the 64th An nual Meeting of the International Commu nication Association (2014)
  35. Danziger, Shai, "Extraneous Factors in Judicial Decisions", Proceedings of the National Academy of Sciences, 108(17), pp.6889~ (2011)
  36. Hoffman, Robert R., "Explaining Explanation For “Explainable Ai.”", Proceedings of the Human Factors and Ergonomics Society Annual Meeting, 62(1) (2018)
  37. Mittelstadt, Brent, "Explaining Explanations in AI", Proceedings of the Confere nce on Fairness, Accountability, and Transparency (FAT* '19), 1 (2019)
  38. Ribeiro, Marco Tulio, ""Why Should I Trust You?":Explaining the Predictions of Any Classifier", Proceedings of the 22nd ACM SIGKDD International Conference on knowledge discovery and data mining (2016), ACM
  39. "Article 29 Data Protection Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation", ~ (2016)
  40. "'Automated Decision Making: the role of meaningf ul human reviews" (2019)[URL]
  41. "Directive 95", 46, pp.1995, ~
  42. "About EDPB"[URL]
  43. "The GDPR gets some stamps in its passport" (2018)[URL]
  44. "Automated decision-making and profiling" (2018)[URL]
  45. "Lei Geral de Proteção de Dados Pessoais (LGPD) LEI Nº 13.709, DE 14 DE AGOSTO DE" (2018)[URL]
  46. "What is Artificial Intelligence?" (2007)[URL]
  47. "Could Counterfactuals Explain Algorithmic Decisions Without Opening the Black Box?" (2018)[URL]
  48. "Efficient AI interview preve nting corruption: Identifying abilities and aptitude through Bigdata" (2019)[URL]
  49. "Sizing the prize: what’s the real value of AI for your business and how can you capitalise?"[URL]
  50. "Regulation (EU) 2016", 679 of the European Parliament and of the Council of 27April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95, EC (General Data Protection Regulation), 2016[DOI]
  51. "Explainable Artificial Intelligence (XAI)"[URL]
  52. "Towards accountable AI in Europe?" (2017)[URL]
  53. "The Other Half of the Truth:Staying human in an algorithmic world" (2019)[URL]

관련 논문AI추천

자동화된 의사결정에 대한 기본권의 실효적 보장- EU AI법 제54조와 GDPR 제22조의 관계를 중심으로 -주민호법학연구원 · 법학논고2023 · 제82호자동화된 결정에 관한 개인정보보호법 정부 개정안 신설 규정의 문제점 - EU GDPR과의 비교 분석김효권, 박노형사법발전재단 · 사법2022 · 제1권 제62호EU AI법 개인정보보호 관련 규정 검토김효권, 박노형사법발전재단 · 사법2024 · 제1권 제68호개인정보보호법상 자동화된 결정 조항의 해석이상용, 이혜리사단법인 법조협회 · 법조2024 · 제73권 제1호EU 일반정보보호규정(GDPR)의 알고리즘 자동화 의사결정에 대한 통제로써 설명을 요구할 권리에 대한 쟁점 분석과 전망김재완민주주의법학연구회 · 민주법학2019 · 제69호EU GDPR상 프로파일링 규정의 법적 분석박노형, 정명현안암법학회 · 안암법학2018 · 제56호

이 간행물의 다른 논문 (4건)

인공지능 윤리규범과 규제 거버넌스의 현황과 과제고학수, 이나래, 박도현pp. 7-36개인정보보호법상의 국외이전 개정방안 연구안정민pp. 59-74VR/AR 산업 활성화를 위한 법⋅제도 개선방안 - 의료ㆍ교육ㆍ영상 관련 실감 콘텐츠 규제를 중심으로 -이승민pp. 75-95데이터 경제 활성화를 위한 필수요소법리의 재검토방정미pp. 96-115
원문 보기