FairnessAccountabilityPrivacycs.CY
Fairness and Data Protection Impact Assessments
Atoosa Kasirzadeh, Damian Clifford
September 13, 2021
AAAI/ACM Conference on AI, Ethics, and Society
12 citations
1 influential
Key Takeaways
-
DPIAs lack practical guidance on fairness: While the GDPR theoretically requires fairness assessments as part of Data Protection Impact Assessments (Article 35), official guidance documents from data protection authorities rarely mention fairness in practice, creating a significant gap between legal requirements and implementation.
-
Fairness principle remains underspecified: The paper identifies that Article 5(1)(a)'s fairness principle has "multifaceted interpretations," meaning organizations lack clear, consistent definitions of what fairness actually means when conducting required assessments of data processing systems.
-
Current DPIAs may miss algorithmic bias risks: By not adequately addressing fairness metrics in impact assessments, organizations may fail to identify and mitigate risks of discriminatory outcomes in AI systems before deployment, undermining a key safeguard in the GDPR framework.
-
Regulatory guidance needs strengthening: The disconnect between theoretical fairness requirements and practical guidance suggests that data protection authorities should issue clearer, more specific instructions on how to evaluate fairness during the DPIA process to make compliance more meaningful.
Abstract
In this paper, we critically examine the effectiveness of the requirement to conduct a Data Protection Impact Assessment (DPIA) in Article 35 of the General Data Protection Regulation (GDPR) in light of fairness metrics. Through this analysis, we explore the role of the fairness principle as introduced in Article 5(1)(a) and its multifaceted interpretation in the obligation to conduct a DPIA. Our paper argues that although there is a significant theoretical role for the considerations of fairness in the DPIA process, an analysis of the various guidance documents issued by data protection authorities on the obligation to conduct a DPIA reveals that they rarely mention the fairness principle in practice.