Learning Responsible AI together.

The paper aims to contribute to the understanding of the connection of law and legal science, on the one hand, and the Big Data phenomenon, on the other. The connection of Big Data and law can be thematised in several ways. This article makes a distinction whereby there are two levels of interplay between Big Data and the law (and legal science). Big Data on the one hand can be the subject of legal regulation and legal science, but it also can be a tool for better, ‘predictive’ law making and lawyering. This latter is also true for legal science: Big Data opens a whole range of possibilities as a new tool. Thus, this article discusses three fields and questions in three sections: 1. Big Data as the subject of legal regulation. What kind of moral questions does Big Data, and the predictive potential it has, raise? How does law recently frame, define and regulate the Big Data phenomenon? How does Big Data affect existing legal framework rules regarding privacy, data protection, compet...

On May 25, 2018, the European Union’s General Data Protection Regulation (GDPR) came into force. EU citizens are granted more control over personal data while companies and organizations are charged with increased responsibility enshrined in broad principles like transparency and accountability. Given the scope of the regulation, which aims to harmonize data practices across 28 member states with different concerns about data collection, the GDPR has significant consequences for individuals in the EU and globally. While the GDPR is primarily intended to regulate tech companies, it also has important implications for data use in scientific research. Drawing on ethnographic fieldwork with researchers, lawyers and legal scholars in Sweden, I argue that the GDPR’s flexible accountability principle effectively encourages researchers to reflect on their ethical responsibility but can also become a source of anxiety and produce unexpected results. Many researchers I spoke with expressed profound uncertainty about ‘impossible’ legal requirements for research data use. Despite the availability of legal texts and interpretations, I suggest we should take researchers’ concerns about ‘unknowable’ data law seriously. Many researchers’ sense of legal ambiguity led them to rethink their data practices and themselves as ethical subjects through an orientation to what they imagined as the ‘real people behind the data’, variously formulated as a Swedish population desiring data use for social benefit or a transnational public eager for research results. The intentions attributed to people, populations and publics – whom researchers only encountered in the abstract form of data – lent ethical weight to various and sometimes conflicting decisions about data security and sharing. Ultimately, researchers’ anxieties about their inability to discern the desires of the ‘real people’ lent new appeal to solutions, however flawed, that promised to alleviate the ethical burden of personal data.

Personal profiling and predictive behavioural analysis done by Big Data applications pose immense challenges to society and democracy, especially when they violate individuals’ constitutionally guaranteed fundamental rights, such as the rights to privacy and data protection, and the right to non-discrimination based on personal attributes. At the same time, Big Data applications also threaten basic ethical principles needed in a democratic society, such as fairness and respect for human autonomy. An analysis of European data protection laws (GDPR, ePrivacy, Digital Content, Copyright and Trade Secrets) shows far-reaching gaps with regard to the protection of privacy and the non-discrimination of individuals. Governments and legislators have a clear requirement to close these gaps as quickly and comprehensively as possible. We propose a three-pillared model for the future regulation of Big Data applications, covering three areas of action. Firstly, a fundamental reorientation of the concept of digital identity towards self-sovereignty over private data. According to this, the individual would become the owner of their own personal data and thus be able to decide sovereignly with whom to share which data, for which purposes, and over which time period. Secondly, the empowerment of the individual as a sovereign of their own data must be accompanied by a comprehensive education and training program at all levels of society. Through knowledge and training, individuals must be able to use the opportunity to determine for themselves how their information is used and, at the same time, be able to bear the associated risks. Thirdly, regulators themselves need to use so called “legal-tech” solutions to carry out automated and software-based testing and monitoring of Big Data applications with regard to their compliance with privacy protection regulations. For this purpose, the legislator faces the challenge of implementing the legal principles formulated in written laws into software code.