IEEE Technology and Society Magazine - September 2021 - 95

How AI complicates data rights
Emerging technologies such as Internet of Things
(IoT) devices complicate the discussions around
data regulation as they require " Big Data. " There are
additional concerns about algorithmic bias and calls
for diversification and transparency of the design
process of AI to ensure data is collected and analyzed
responsibly.
With the emerging technologies developing such
as IoT and AI, data will continue to be produced
and captured at unprecedented rates and scales.
Regulations are necessary to upstream protection of
individuals, especially as AI can be used to directly
target those belonging to systemically oppressed
groups [20]. There is an emergence of soft-law guidelines
referring to the social implications of AI, but
according to AINOW, " these types of ethical commitments
have little measurable effect on software
development practices if they are not directly tied
to structures of accountability and workplace practices "
and that " ethical codes can only help close
the AI accountability gap if they are truly built into
the processes of AI development and are backed by
enforcement " [21].
The process of AI development is critical to ensuring
AI is designed to benefit society equitably in a
positive way. For example, the design of algorithms
and bias of teams can be reflected in AI systems
through dataset choices and lack of awareness for
socio-technical implications or quality of their data
[10]. These biases can be detrimental to individuals
and society.
Humans are behind machines with teams often
lacking diversity, which leads to algorithmic bias
and issues in the datasets [10]. For example, replacing
judges with AI can lower racial bias, but raises
concerns about whether to trust the decision AI
makes and what data are allowed to be referenced
[22]. The person in question may not have granted
access to the AI and courts may consider data not
traditionally admissible. Another example of this
are facial recognition systems, which are becoming
commonplace in public and private spaces and
used as oppressive surveillance [1], [23].
Transparency and consent issues become more
complex with terms and conditions. A report showed
that Amazon echoes had automatic opt-in, allowing
thousands of employees to listen [24]. Amazon
claims it is for device improvement, but it is not
something most users are aware of, nor it is explicitly
September 2021
stated in the agreements, which are usually lengthy.
Amazon's Kindle device terms were reported to take
over 9 h to read out loud, and several studies have
shown that they are not read by users [16], [25]. As
identified by IEEE, " Digital consent is a misnomer in
its current manifestation. Privacy policies are largely
designed to provide legally accurate information
regarding the usage of people's data to safeguard
institutional and corporate interests, while often
neglecting the needs of the people whose data they
process " [26]. In the case of Amazon, those who
opt out " might still have their recordings analyzed
by hand over the regular course of the review process "
[24]. This obfuscation of data handling clearly
demonstrates a need for protecting people from
such AI practices.
United States specific recommendations
The United States is under pressure to enact
comprehensive privacy legislation as several states
proceed with their own [7]. Companies will have a
difficult time adapting to each state request individually
due to administrative and legal constraints. A
unified equivalent to the GDPR to consolidate and
supersede state legislation may be required.
Currently, data protections rely on guidelines proposed
by the FTC and sector-based regulations. Section
5 of the FTC Act protects consumers from unfair
and deceptive practices and failures to secure PII
[27], and sector-specific regulation such as HIPAA
protects medical information in certain context.
There are many loopholes in the patchwork of existing
regulations, requiring additional support.
An alternative approach is international soft law
with cohesive AI guidelines, such as standards and
sector-based agreements [28]. As the world becomes
more globalized, so does data and a regulatory
approach to AI requires flexibility. As a testament to
globalization, GDPR applies to any company working
with the data of EU citizens and has created a
ripple effect on companies within the United States.
There are benefits of agile governance with this
approach, but also enforceability issues [28].
The Center for Data Innovation proposes a mixed
approach for AI governance through three options:
abdication, regulation, and facilitation [29]. Abdication
means that the private sector can regulate itself,
but renders a weaker AI competitiveness because
there are " serious market failures that impede the
development and adoption of AI that industry alone
95
IEEE Technology and Society Magazine - September 2021

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - September 2021
