I think we'll slowly get started now uh most people uh had a chance to join the webinar the zoom webinar but people will filter in over the next couple minutes uh but in the interests of uh remaining on schedule I want to get us started here so that we don't run over and eat into people's uh lunches unduly um so first off I'll introduce myself my name is Dr Ryan Whalen I'm really happy to be here today at the invitation of the hku law and Technology Centre to chair this talk and moderate this talk I'm really excited to hear what our speaker today has to share with us. The structure of the talk will be as follows. So it'll be initially will give um Dr Clifford a period of time to present his work um I suspect that would be 30 to 40 minutes although you're free to Air on either side of that window as you prefer Dr Clifford um and as we go along if the audience has questions please feel free to use the Q&A box and then in the period after the talk I'll I'll pose those questions to Dr Clifford and we can have a bit of an extra change of ideas okay so first off I'm going to introduce today's speaker Dr Damian Clifford is a senior lecturer at the Australian National University College of Law and he's a chief investigator at the ANU humanizing machine intelligence brand challenge project and the socially responsible insurance in the age of artificial intelligence ARC linkage project he's also an affiliate of the ARC Center of Excellence for automated decision making in society and at The Institute of advanced legal studies which is at the University of London so Dr Clifford thank you so much for taking time out of your busy day to talk to us here today at HKU and in Hong Kong and I'm going to give you the floor now to to present your work to us thanks very much Ryan um so I'll just share my slides and I can get started okay so you should be able to see those um thank you um yeah so thanks very much for the invitation and the opportunity to to speak um so today I'm going to speak about data protection and the accuracy principle in data protection and I'm going to do it through the lens of emotional AI so uh you know to start this off um I thought that you know I just kind of give a brief explanation as to what this accuracy principle is that appears in a lot of data protection legislation um essentially it requires that personal data is kept up to date and corrected or deleted were relevant um and my I suppose starting premise um you know for the work that I'm presenting is that you know I think this is an underexplored dimension or principle within data protection legislation um okay but that's like fair enough um and you know you might be wondering why I'm actually interested in it and I suppose my interest started inaccuracy largely because I started to look at emotional AI or affective computing I suppose that the context which I'm going to be exploring um you know the accuracy principle in this talk um so there are a range of examples I'm just going to give a couple from Facebook here because um I suppose when it comes to kind of you know um some behavior that has uh you know led to some debates uh they provide a few uh very good examples so the first one is the emotional contagion experiment uh in which I suppose researchers bought a different academic institutions and at Facebook uh found that if they manipulated the user feeds of users they could then change how those users interacted with the framework and whether they did so kind of either positively or negatively um there has also been um leaks around um you know Facebook saying to advertisers that they can allow them to target teens who are feelings insecure or vulnerable um there were a range of patents um dealing with emotional AI and of course then there's the Cambridge analytical Scandal which had a clear kind of emotional impact I suppose around the capacity to persuade now these technologies have been very controversial for a variety of reasons but some of them have been very controversial as well from an accuracy perspective so there's been wide scale critiques of what's known as facial action coding or the detection of emotions through facial expressions so there have been a lot of discussions more recently about the accuracy of such technologies in particular so the reason I kind of wanted to look at this thing is well because of the kind of garbage in garbage out so if you look at the role of data protection and potentially this accuracy principle as a means of regulating some of the issues kind of actually play some sort of a role in terms of correcting or requiring the deletion of information that isn't accurate and that may play a role I suppose in the deployment of these technologies now aside from that I'm also interested in it because data protection law and in particular I suppose I'm referring to the GDPR as a particular so the general data protection regulation in the EU as a particularly strong example of regulation that has extensive accountability mechanisms or tools within it so you have things like data protection impact assessments or privacy impact assessments and other jurisdictions as they're known and you have requirements for data protection or privacy by design by default and you also have protections around automated individual decision making or profiling so you know there are robust regulatory tools that could play a role in this space and through which I suppose we could look at accuracy as a principle and whether it could actually play a role in mitigating some of the challenges um before I get into I suppose some of the specifics on this I wanted to highlight a couple of two preliminary points so the first is that you know when we're looking at accuracy often what we're talking about in this context or any context would be more in the range of kind of accurate inputs so there's a focus very much in ensuring that the data process isn't isn't incorrect um and you could say that that kind of reflects the historical roots of these types of Frameworks but also um there are broad goals so um their goals uh what I mean here is you know that they're designed to protect privacy under data protection but also um the the other goal within this is to provide a level of uniformity and certainty to allow for information flows and to provide that certainty for businesses now within that I suppose those competing values um there is also uh uh I think that that's manifested in the fact that accuracy has a bit of an unusual role yeah and so in that even inaccurate data are still considered personal data or personal information so um it is a principle I suppose rather than a strict rule that information has to be accurate and there's good practical reasons um uh for that you know um say for instance just a very simple example if you had um you know provided your address and telephone number and various other personal information on sign up just because you change your address your telephone number doesn't mean that they don't then relate to you in the future so this feature of data protection that even inaccurate information is still personal information is manifested clearly in different types of Frameworks be that the general data protection in the ndu or the Australian Privacy Act within the Privacy principles um as I've noted there in the slide um but let's look at this notion of like accurate inputs and where it could kind of play some sort of a role then in order to to provide some sort of illustration um so to do this I'm just going to use um uh this figure that I had um that I suppose I used in an article with some colleagues that I wrote um and what I want to kind of highlight is that traditionally I suppose we would see a reward for the accuracy principle and data protection to be everything within the the red circle so if it comes within the definition of personal information there's a requirement to correct or ensure that the information you know in your sign up but also potentially any personal information about might be within the training data or that might be used to ensure that it is accurate if it is if it comes within the definition of personal information um now another point that I want to highlight out of this is that the broadness of your definition of personal data will affect accuracy as well so what do I actually uh mean by that now if you have a broader definition of personal information more information is obviously going to come within it and that raises potential issues because if that information May relate to multiple people so let's take an example in order to kind of highlight it a little bit so we take this um graph again or this figure which effectively is discussing um the potential deployment of a machine learning system in a hypothetical Insurance context but if we take the data here that I've kind of circles now in red with a smartphone Smartwatch sensor data um you know that device related information would clearly come within the definition of price information in certain jurisdictions but there are doubts in others such as Australia because that information may not necessarily be about the individual so you know if you're talking about something like an IP address um you know that may relate to multiple individuals but it still comes within the definition of person information in the EU um even though it may relate to multiple individuals so the broader your definition of personal information the more that you have challenges with this accuracy principle um so it does kind of show the flexibility of it and that it should be seen as a principle because um you know its operation is a little bit context dependent now within this as well it's also important to remember that this also relates to so-called sensitive data categories in data protection um in multiple regimes in different jurisdictions they protect either personal data um and or sensitive data so there are certain categories of sensitive information such as health data for instance um so when we're considering this and considering it through the context of emotional AI um we may then start to think about the sensitive instances that may be drawn from seemingly innocuous device related information regarding for instance our emotional state and how we classify those types of information are those sensitive inferences potentially sensitive data within the scope of data protection adjustation so let me kind of explain that within the garbage out side of this equation so if we look at this then we're looking at the right hand side of our our diagram yeah so the inferred data output so you know you have the detailed processing of various types of information which run through a machine learning model and then spit out some sort of an output so the question here is whether you know these potentially sensitive piece uh information whether they also come within the definition of process information or personal data and whether then the protections that are afforded in data Protection Law um in particular the accuracy principle also applies to this side of you know the equation so does it play a role both in terms of the garbage in but also the garbage out um now um you know within this I think you know we can uh there have been some developments and discussions um uh but it would be uh generally um accepted I suppose now come to this in a second that you know the definition of person information uh would be covered within this inferred data output um and there have been some developments uh recently um speaking about you know um the uh overlapping intersection between personal data information and uh sensitive inferences that may be drawn uh particularly in the U um but also um for instance in the reform of the Australian Privacy Act where you can see here with the Triple C's and digital platforms inquiry report a direct reference to you know a recommendation that we need to consider the role of uh inferences yeah so what would happen and a further elaboration about in the Attorney General's discussion paper uh around whether the categories of sensitive information need to be adjusted to take account of the fact that um such developments are able to draw sensitive inferences so um you know we can see um that there is a role potentially for accuracy both uh in the context of the uh inputs of uh these types of systems but also uh in terms of an output um but the next thing then to consider is whether there are any potential weaknesses in that regard you know so any potential restrictions um to accuracy playing a key role for instance in regulating the impacts of emotional AI in terms of its inaccuracy so there are a few here that I want to to highlight the first is that um you know when you're looking at data Protection Law there's an assumption generally that the purposes are legitimate um and effectively the Frameworks are kind of set up as risk mitigation mechanisms uh you know the Frameworks avoid afford certain rights to individuals to whom the data will relate um they play certain obligations on the shoulders of those processing the information um but they generally don't say anything about the legitimacy of the purposes for which you're actually using the information and generally speaking if you're talking to particular users they're often concerned about the particular uses that technology are put up within this concern then you have washed barchap corpses referred to as you know the focus of data protection being on the Upstream so the input data as I have put it as opposed to the output part of it and the last part then you know I mean we have to remember with on all this is that even inaccurate data are still considered personal uh data or information and therefore can we really consider there to be some sort of a positive obligation to mitigate the negative impacts the risks associated with uh inaccurate outcomes um particularly when we consider that you know users or consumers will often have agreed to the potential for this risk of inaccuracy uh when signing up to use the particular service um so we have I think you know some limitations there within the consideration of data protection um but maybe to kind of spell out some of that more specifically in the context of emotional AI um okay so given that inferences our personal uh data at least in the EU anyway um what role you may be wondering does data protection have to play in preventing inaccuracies in the context that you know the case study that I'm using to test this a little bit um so um I I mentioned I suppose that there were these white uh uh you know these uh broad concerns with the accuracy of facial action coding in particular um but I suppose you know there's just to kind of give you a flavoring of these criticisms you have um the AI now Institute at NYU basically saying that the whole thing is a pseudoscience um and then you have uh researchers such as Feldman barish and others uh saying that there's a methodological flaw within it in that they rely on what are known as basic emotions and that fails to capture the richness of emotional experiences so I suppose there are um kind of fundamental theoretical uh debates here as to whether the entire thing is the pseudoscience or whether there is a need for I suppose some sort of um methodological tweaking uh within the development of the Technologies to ensure that they actually achieve what they set out to do um no the criticism um you know the response to the criticism that has been there is to kind of adjust some of the methodology methodologies so instead of looking at a basic emotion approach they've adjusted to a more appraisal approach and that effectively requires the Gathering of far more data you know because it's a far more context aware of uh assessment um and uh essentially that requires then uh more uh information gathering in order to put what is gathered into context to drive more accurate inferences as to someone's emotional state So within that then you end up with a question yeah so accuracy um say if we take the general data protection regulation in the U as an example has a series of principles within it um one of which is accuracy um as I've been speaking about but others includes a data minimization where you only have to gather where you should only gather the minimum amount of information in order to achieve a specific purpose so um you know adjustments um here in terms of the methodology require some balancing between the interests the different principles in order to achieve accuracy if that's we're setting out but that may then negatively impact uh individuals uh vis-a-vis um you know the more extensive Gathering of information so you end up I suppose having to to question I suppose how these various principles are balanced fairly um the next key point I suppose that I want to highlight is um you know it's kind of a statement but there's also a question to it I suppose is you know if there's a flaw in the entire methodology um there's a question as to whether it really matters in terms of input or output um whether that's accurate yeah so what's the role of data Protection Law if um you know the entire methodology that is being relied upon uh is flawed so um I thought I'd take again the example of the facial action coding to kind of um illustrate what I'm trying to to say here um but if we um you know so with this uh particular um example of emotional AI essentially the premise behind it is that the facial expressions of an individual reveal these basic emotions so how they are feeling at any particular moment um and there have been serious questions regarding that premise that methodology or understanding that grounds um the technological developments um so now within okay I suppose an accuracy's perspective from the data side um the data might be perfectly accurate in that the detection of the facial expressions might be Flawless but the underlying methodology or the correlation between those facial expressions and the emotion that the individual is actually feeling may not be correct so there is a question as to whether data protection is the appropriate lens through which to consider this potential fault or this particular particular problem so that kind of leads me then um to this point so if data protection isn't the solution how do we kind of regulate the potential for garbage in the middle yeah so we can see a role for data protection as an input you know when personal data is an input and for data protection when there's sensitive personal data outputs or inferences that are drawn through this detailed complex processing but what about regulating the machine learning model in the middle that might be um you know flawed in terms of its fundamental reasoning as to how it is drawing these inferences in the first place so this is kind of um you know where I am at the moment in terms of this research and where I'm going but I I'd like to kind of maybe spell out in the last few slides exactly where my thinking is and uh where the the progress for the future research that I'm doing and how it's going to tie in with this so um the first thing to mention and you know we need to I mean consider some of the regulatory developments that are happening in this space is that the proposed AI act um in the EU is essentially suggesting that there should be transparency requirements uh for Technologies including emotional AI why this is interesting um in particular is that there have been a series of um reports I suppose from policy makers but also enforcement authorities actually calling for a ban of these Technologies um and that has kind of led me to kind of question okay in what how should we regulate you know that the the potential garbage in the middle um these enforcement authorities of the European data protection board and the European data protection silver supervisor for instance are suggesting this ban but um how does that kind of fit together how should we view this and that has led to me kind of um coming up with a few different questions um that I am particularly interested in um so I suppose one of the fundamental ones um that is uh I guess to a certain extent plaguing me at the moment is you know do we want policy makers uh deciding on you know what could be construed as scientific debates so the merits of different Technologies uh from a purely scientific perspective and within that in the context of emotional AI you can question whether it is a scientific debate at all yeah there are some who say that it is purely a pseudoscience um and that's it there are others who say okay well there are fundamental flaws in some of the technologies that have been developed but this is an evolving space and so you know um there is a scientific debate to be had um now you know I the second bullet point there kind of points I suppose uh some of the complexities that are underpin that you know so uh the fact that some of the criticisms uh don't really narrow down on what they're criticizing whether it be it the underlying methodology or um for facial action coding in particular and uh you know the point within that is that policy makers are often probably not best placed um to recognize recognize the nuances and these types of arguments um and you can question whether it is actually the appropriate place to have these types of discussions then um so you know this has kind of LED them to me considering um the broader um uh implications of the research that um on this particular area um more specifically focusing on you know how we might go about regulating the inaccuracy more generally um emotionally I might be just one example of it and how we kind of start to think about um how we regulate inaccuracy how we've regulated in the past um and I suppose one of the fundamental things that I want to that I noticed I suppose such is obvious is that inaccuracy is everywhere in consumer products so the fact that we have some you know newfango technology um with you know um AI in the title that uh is suddenly inaccurate um is in particularly unique um uh in this space the next one is that you know there are a range of harmful products or Services um that are easily accessible to uh to Consumers um no there may be uh for instance certain restrictions on the access to certain harmful products uh for instance alcohol or tobacco but um there are extremely harmful products that are left open to the general public um so one will be unique about regulating a particular technology um uh broad scale through the through uh actually Banning it like emotionally I um the next thing I suppose that I'm starting to think about a little bit is if there is a difference between Banning a um you know a product or a service uh versus Banning a particular technology and if that actually matters yeah so I suppose within this I'm starting to kind of question whether there could be a shifting regulatory targets when we're talking about a specific uh deployment of Technology um you know um as opposed to particular types of products that we may or services that we may have regulated in the past um that may make us far more difficult to um effectively regulate the inaccuracy through bands in this particular context um Okay so then you know the final uh points that I kind of want to highlight is really you know the where from here you know and what I'm kind of uh focused on and um you know part of this research that's kind of moving into the future of us I'll be doing with um Professor Jeannie Patterson at University of Melbourne where we're going to be kind of looking at this issue through a broad or uh regulatory lens um you know so looking at existing contract law mechanisms but also for instance protections that may exist in consumer law to look at for instance misrepresentations and capacity of these particular uh um Technologies May perhaps contained in terms of conditions or the potential for the application of consumer protection mechanisms around misleading or deceptive conduct but also the potential role for the application of entrepreneurial terms regulations um also down to you know the unfair trading Provisions that exist for instance in the EU or the US um but also within this to view and understand more other exante means of regulating um in addition to data protection and data protection accuracy mechanisms uh such as consumer guarantees law uh and whether there could be kind of a more principled based regulatory intervention compared to outright bands of specific technological developments um and but within that we also still want to look at this role for more paternalistic means of intervention uh more specifically bans uh the circumstances of where and when they should happen even for um you know as I mentioned for very harmful products there may not be whole scale bands and we need to kind of explore those kind of trade-offs in order to determine okay on what point of this kind of paternalism empowerment scale do we need to land on in order to effectively regulate these types of Technologies so um I think that that's uh is kind of bringing me to the the end of what I wanted to say I realized that I kind of you know kept that very much within time but that then allows us for a more elaborate discussion which I think is is good um and I'm happy to kind of elaborate on any of the the parts I think it's kind of like wind me up and watch me go I think with this particular topic So like um I'm happy to expand in any particular areas if anyone has particular questions so thank you okay uh thank you uh so much Damian for a really nice uh introduction to this um research project uh as a reminder to the participants uh in the room uh you can use the Q a box to uh post questions or if there's an area you want Damien to if you want to wind him up and let him run uh in a particular area just just let them know up in the Q a box there I will uh use the the chair is privilege to ask um uh my main question really which is um so I'm not a scholar of privacy I'm more I think if you were to characterized scholar of innovation so I think about these things maybe from a different perspective um and I guess my question is is kind of like do we even need to worry about regulating inaccuracy in this in these sorts of contexts given that we can probably assume there's a built-in Market incentive for accuracy right the people who develop these Technologies want them to be accurate if I'm building an emotional AI I want it to do its job well if I'm building a a behavioral advertising algorithm I want it to accurately Target the advertisements that it it chooses for particular users um and we know just from the history of innovation that almost all Technologies they they develop incrementally they start off as sort of poor versions of themselves and over time as Market incentives sort of take their effect and the engineering Kinks get ironed out the Technologies get progressively better and and better and more at in this case it would be more accurate and more accurate and and I wonder whether or not even introducing the the threat of as you said Banning inaccuracy might upset those Market incentives and lead us to miss out on technologies that that might turn out to be very very very helpful for a lot of context that they're maybe not even now applied I could think of a lot of different contexts where I'm a truly accurate emotional AI engine would be very very useful and have a lot of uh good uses good things that we would mostly think of as ethical or moral uses that would help benefit Society so there's quite a bit there but I just wonder what your responses are to those thoughts yeah no thanks very much for that I think um like I think you've um eloquently uh expressed a concern that I had you know stemming from the the calls in the European Union to ban uh this particular technology um I know I say that as someone who is quite skeptical of like current developments um and I I definitely take your point I mean I suppose that was kind of like the the starting point for this and that like um moves towards a ban is an extreme regulatory outcome like it's an ex you know there's a lot in terms of the regulatory Spectrum in terms of interventions that you can have that don't go as far as Banning an entire technology um and I guess that that kind of started um uh this project out you know so um looking at more accented principle-based ways of mitigating the impacts of inaccuracy um now I take your your point the businesses themselves want to avoid it yeah because the better product that they have the more they'll be able to sell it essentially so the market essentially should at least in theory take care of it um now the one thing I would say um to kind of maybe draw back a little bit of what I said um is that like you know there are particular uses of this technology that are particularly problematic yeah where inaccuracy could pay um a fairly uh I mean it could have fairly massive negative impacts yeah so if you're talking about using this to you know surveil public spaces for instance um now granted this is all about particular uses yeah I mean you can have moratoriums on particular uses of the technology um and I I think that that's kind of part of the spectrum of regulatory responses that I'm interested in you know there's nothing particularly wrong with um in my view if having it as parent to the kind of a gaming feature uh for instance in a video game um no obviously you still have those lingering challenges associated with what is known as function creep yeah so you use it for one thing and then it just expands in terms of its uses um but I think that that's a different regulatory targets to the technology being inaccurate um if that makes sense so I kind of you know um I agree with you and then I've kind of expanded to a certain extent so I hope that that kind of um you know gives you another you know an understanding of my position absolutely yes I I sort of picked up implicitly on on that uh perspective that you presented when you talked about your your hesitancy about perhaps the European approach to Banning specific Technologies especially at this early stages in their development and the potential follow-on costs that might have for society we do have uh some questions in the Q a box uh now so TG has listed three questions um I'll read them all some of them I think you've maybe already started to address the first one I think is related to what we were just talking about where TG asks whether or not companies who are developing AI systems aren't already sort of self-regulating by basically doing a b testing so like they're just they're trying to make their products better so I think the question here is basically the same it's like do we even need to to intervene in these contexts when companies already are concerned about this the the second question is quite broad TGs whether or not there's a regulatory technology or a reg Tech solution to to regulate accuracy the third question I think is maybe the most interesting here is whether or not um regulating disclosure or transparency might upset the market and allow some companies to to benefit off of the work done by their competitors right so if if there's a disclosure regime that requires companies to disclose how their black box algorithm works is that then put them at a competitive disadvantage because their competitors don't need to reverse engineer it they can see it it's all been disclosed to them and because that then itself perhaps uh undermined incentives to produce good algorithms because you're not able to internalize the benefit of the algorithm so there's quite a bit there you're free to sort of answer any of those all those uh you like yeah this was a maybe um respond to the last question first then um I mean I think yes but uh to a certain extent I mean um entire transparency um would uh disincentivize um innovation in that sense but I suppose you know it isn't um it is all or nothing it's essentially my my very brief response to that you know if you think about like transparency around um say automated individual decision making in the gdpr um you can have layering of information it might only be the information that is needed for the consumer to have some idea of how their information is being processed without necessarily revealing the trade secrets that might go behind it um you know there's a broader discussion here about uh things I'm less varsed in as to whether you know um uh you know there's a broader need for um Powers regulatory powers to step in and kind of examine I suppose what's happening underneath the Hood um I think you know again that's kind of a more graduated response than saying whole scale you have to publish everything online um it's more kind of okay well there are restricted powers to investigate in certain circumstances um so I think like you know my response to that question is essentially that there's a potential Spectrum uh when it comes to transparency and it isn't you know entire transparency or nothing at all um so that's kind of maybe you know a fairly simple answer but I think that there's some way to it um you know in terms of the rake Tech solution for regulating accuracy um I'm not entirely sure you know it might depend a little bit on um you know the that difference I was say if we take the emotional AI context whether there's a flaw within the underlying uh premise of the technology so in the matter ideology that's actually being used or not um you know I think that that would be fairly clear based on the the type of work that's actually going there but if it's less based on the fundamental approach the methodology then it can become a little bit more difficult perhaps and then you may need Technical Innovations in order to figure out what precisely went wrong but again I'm you know I think that that's more of a computer science question than a law question or regulatory question proceed sure so we we have another question uh here which I think it raises something you uh you briefly uh discussed before which was about the use of these Technologies in video games where you suggested maybe there's less of a concern there and then you know they're maybe more more sensitive areas but William lamb asks um what if the there's sort of a transition towards what people call the metaverse obviously that can mean different things to different people but I think implicit in this question is what happens if and when I'll use the if because I don't know that it's uh predetermined but if a lot of more of our social behavior starts to take place in in game like context virtual reality whatever you want to call it um thereby making more of these the applications of these these Technologies potentially um it gives them more power to sort of influence the day-to-day activities of Our Lives that aren't just recreational maybe it's uh quite important things like you know meeting of our lovers Etc things like that really important personal experiences um do the considerations change in a context like that does it does it did your concerns change um yes I mean I think that they shift to concerns I mean uh concerns about our capacity to make decisions for ourselves essentially us or I mean they become a lot about autonomy um and I think like you know there's already debates about this in terms of the effects of a mediated environment when you can personalize content um and potentially I mean depending on your your way of viewing this I mean some would say manipulate Behavior depending on the context of the personalization and some of the the examples I showed at the very beginning you know whether it be the kind of Cambridge analytica or the emotional contagion experiments kind of point to those types of things the risk of you know the impacts and autonomous decision-making capacity of individuals um and you know you could see that with in you know the market yeah so can they effectively choose the products that they want are they even aware that they're potentially being manipulated um you know can they even retrospectively say that they didn't want a particular product or service or whatever whatever it is it is so certainly I think that those things kind of feature in um and to a large extent I think that they relate as well to the points I kind of hinted at around um function creep yeah so I mean you can think as you said uh in your first question I think um that there are uh you can point at religiousness ethical uses of this technology when it's accurate you know I mean you can think of potentially Healthcare uh applications as a particular context um but it's when um you know the data from one particular context starts to seep in terms of usages uh to kind of have some sort of an influencer or direct Behavior around commercial decision making that I really think then you have uh you know it starts to to play some sort of significant role so um again I think hopefully it kind of gives you an idea of what I'm thinking great thank you uh so we have another question here from Anonymous attendee who uh the premise is that most data protection laws provide a right to correct or Rectify inaccurate personal data that's collected about an individual and then the question is in the case of inaccurate inferred data how or would it even be possible could daters could data users be able to honor such requests so would they have to I guess tweak the algorithm somehow at the individual level um bite the algorithm and retrain their model like is there is there any thoughts about how the engineering or actual like functionally that could take place uh I mean I I suppose it depends on what point you're deleting yeah so if it's in terms of the impacts of an inference um then you can maybe change the outcome yeah if it has to do with okay um you know various aggregated data um are collected in order to you know um train the model uh then it's going to be very difficult to kind of remove anything from you know uh that particular stage yeah so if you're thinking about like okay uh the impacts of this in terms of the influencer that it draws and then the potential decision that comes out of it I think you're kind of circling back to automated decision making type protections um where there's been a massive discussion around you know right to explanation and all that kind of stuff but also the right to kind of contest a particular outcome um you know it might be that you know um requesting the deletion of that particular information isn't actually the most effective outcome it's to change the outcome that was reached uh or at least to be able to challenge the outcome I think I think that that kind of depends on the context a little bit and the application that you're talking about but um I would say that you know um yeah maybe maybe the the deletion of inaccurate inferences isn't um you know the the most appropriate outcome that you would be seeking that exhaust the currently asked questions I'll ask another uh follow-up question but I'll also invite uh attendees if you have questions feel free to add them to that q a box that's down at the bottom of your your Zoom window here um so one question I have I guess is like so we were just talking about the ability of users to potentially correct incorrect data or incorrect uh predictions or inferences uh about them that these um whatever you want to call emotional ai ai in general uh might produce do you think it might be useful to allow users to choose how much inaccuracy they're willing to tolerate because some people don't care right some people really have uh they don't really care if you want to make inaccurate emotional inferences about me or serve me bad ads because of your behavioral algorithm it doesn't matter to me very much but to other people might actually feel very strongly about these things and so is there a a mechanism whereby the regulation could take those considerations into account and allow people to sort of tailor the amount of inaccuracy they're exposed to or do you think that need to go over complicates things well I mean I think maybe even the um proposed approach in the uh proposed AI act actually kind of does that because it says that you need to be transparent I mean what you probably have to add is um you know some information on the the potential for inaccuracy yeah so some statistical um I don't know transparency obligation that would say that you have to provide this type of information now how you would actually practically realize that becomes a little bit difficult because it might be a little bit context dependent um but um in saying that I mean like you know that would be I mean legally speaking I think that that's the way you would do it yeah you um from you know if we're supposed to be active Market participants who provide the information to the consumers and they effectively choose now there's a you know a well-versed criticism of that and that individuals have absolutely no idea what's going on and they don't actively choose um or you know you could say that they actively uh choose not to be choosing or be informed armed yeah um so I think within this and I think it kind of underlines um you know the emphasis of the the project you know where this project is going is trying to kind of find that um the right spot along the spectrum between empowerment and fraternalism so you know how much fraternalism is actually necessary depending on the the risk associated with a particular technology and you know I guess the feeling um that I have and I try to kind of maybe convey this through some of the answers and also of the presentation is that I don't think wholesale bands um are brand new learn of to kind of respect that paternalism empowerment divide that you need to think about things a little with a bit more nuance um in order to kind of respect both the fact that you know consumer policy is there to protect individuals from themselves but also you know from I suppose different types of harm but also to promote individual autonomous decision-making capacity I mean it has multiple policy aims um and you know the protection of an autonomous capacity to choose is an important goal in itself um so I I do think that when you're trying to figure out okay where on the Spectrum you know you want to lie you have to kind of EX yeah you have to explore those kind of theoretical debates I suppose that um are familiar as opposed to Scholars and consumer protection but also to a certain extent data protection privacy as well great thanks um I got sort of another follow-up question to that I guess which uh it's a kind of a fundamental premise which is like who decides who's accurate and is what what is accurate in these contexts so I can think of at least three actors or or entities that that might be the important decision makers here right so one is the individual in question obviously and that's the most obvious one right I should decide what's accurate uh in these things that are inferred about me um another is the the infer right they may have a different opinion about what's accurate um because they have different use cases right maybe that their their use for their purposes their prediction might be perceived by them to be accurate but by me to be inaccurate and the third is you suggested earlier in response I think maybe to one of tg's questions that maybe there was some room here for like a regulatory intervention and maybe you could have I don't know I I called them in my mind like the algorithm police who could go in and look into the black box and see what's going on and so maybe they could be a third party uh in this context who might have a useful perspective on on what's accurate and what's inaccurate um is there an overarching answer to that question or again is it one of those like this is really context dependent and it it varies based on the technology the question of the application in question um I mean I do think it's kind of text dependent but I do think that it could ground I suppose regulatory responses yeah so um you know if you know that um the inaccuracy is being built yeah so there's a fundamental flaw in what you're deploying um then you can think about like you know other means of Regulation that we have um already have saying consumer protection around say product liability or whatever else so like you know we have mechanisms in order to respond to some of these things and it's about like thinking about their deployment to a certain extent um and you know you know this potential for like the the algorithm police to kind of come in um I would say that like I'd be kind of hesitant um to a large extent um I think it kind of um there may be certain contexts and certain uses that we say okay well um because accuracy is an issue here we simply can't deploy because the it's too risky yeah I'm not entirely sure if that's actually within consumer products yeah I mean we can think of emotional AI uses that extend far beyond what we as consumers might purchase um either you know embedded in products or services online um you know be it in kind of you know the policing National Security space um where the potential for error and the risk of error you know is uh I suppose and the risks associated with error um increase dramatically yeah um so I would be kind of um thinking more on the lines of if there are going to be regulatory interventions we have to think about okay well we're in where is the risk calculus to work just um and does that justify you know something like a moratorium on the use of that technology in that particular context rather than empowering um you know a regulator necessarily to kind of step in and say okay well this is only 59.5 accurate therefore it shouldn't be served to Consumers you know because it like yeah I I think that um it also just wouldn't result in a regulatory outcome that would be economical for the ones of a better you know for just yeah and there are other concerns as well I think um great thank you that's uh very useful we are getting close to the end of time but we have another question by either the same or a different Anonymous attendee here which is whether or not emotions actually qualify as uh personal data under current data protection regimes I don't know the answer to that but do you uh yeah well I've I've already written on this so there's this paper about a book chapter that I wrote um uh kind of dealing I suppose with some of these kind of basic questions as well so um it will be personal information or personal data I think uh that's not particularly difficult to find particularly in in the EU um I think where it gets a little bit more difficult is whether it's sensitive personal information um you know and here you kind of end up with questions like well okay um you know our Mo uh I suppose inferences relating to someone's emotions can they be classified as health related information which would be classified as sensitive information or if you look at particular deployments of emotional AI say through facial action coding it'll be clear that they'll probably be using biometric templates which are generally if you look at various data protection Frameworks they're classified as sensitive information whereas if they're using other means of detection that don't involve the use of Biometrics then there may be more questions yeah so then it's just a question whether it's Health Data or not Health Data um so I think yeah my answer that asks is kind of simple like um you know the it will be classified as these technologies will be using personal data it's more of a question whether they're using sensitive personal data and that may depend on the context and whether you view the insights that it derives to be kind of anywhere related to health and falling within the sensitive that category or whether they're using you know a particular biometric information which would otherwise bring it within the definition of process sensitive process information um so I hope that that kind of um answers it yeah I think it does I know more about it now than I did two minutes ago so thank you um maybe this might be the last question because we're down to the last few minutes of the hour um but uh so TT asked the question that and this comes up right sometimes this is people's response uh to these these thorny questions of of privacy is maybe we should just mandate uh anonymization right so that you can no longer associate users with their data it's it's challenging for a number of reasons but I wonder what your response to that is um I mean I suppose to a certain extent you can say that is kind of is already somewhat in the Frameworks in that like if you want to avoid the scope of data Protection Law um you render the data Anonymous and then it doesn't come within it and then you can do whatever you want um and there as there are requirements to delete information if you process if you process it so that it is anonymous um then you know it's not going to come within the scope of uh the statutory framework no one's saying that I think that that's like far easier said than done um because like you know there's kind of a utility anonymization uh balancing yeah you want the information to be useful and for it to be useful you need to be able to drive some sort of uh inferences or whatever or you need to be able to relate it to some individual which basically means that you it can't be anonymous um you know I mean there are discussions around pseudonymization um and uh you know depending on the jurisdiction you're in whether Anonymous information comes within the definition of personal data I think the general consensus is Within These Frameworks is that generally it does because the impact of its use will still be the same as to whether it's pseudonymous or not but I think with this anonymization point um I think really as soon as you start thinking about anonymization you have a real impact on the utility of the information that you've gathered which then kind of undercuts the purposes for which you might be gathering it in the first place um which renders those kind of very difficult so I hope that that has kind of answered this and it's probably a nice way to end as well yeah it was a good uh way of showing out the competing interests between anonymization and utility like how you put that okay so uh we're basically out of time there uh that hour flew by gaming it was very very fascinating so thank you so much on behalf of hku and the law and Technology Center for presenting your research and entertaining our questions and uh thank you to all the attendees for attending and for your great questions and we hope to see you all at a future hku law and law and Technology talks okay so thank you uh thank you again thank you take care
2023-02-15