IEEE Technology and Society Magazine - June 2021 - 61

Risk-based regulation approach versus
human human-rights principles-based
approach
There is an ongoing discussion about the current
shift from a classical legal practice to more risk-based
approaches to regulation sparkled by the GDPR like
in [18]-[20]. GDPR represents this shift by introducing
its data protection impact assessment (DPIA)
exercise to data processors as its main governance
tool, but the White Paper goes beyond his point, suggesting
that the risk management exercise is to be performed
within the regulation itself. The White Paper
mentions that the regulatory framework should only
be applied to high-risk AI applications. This high-risk
approach to regulation implies an utilitarian or consequentialist
vision of regulation. That is, only if the
consequences of a specific application might be very
hazardous, it should be regulated. It could be implied
that other applications, with less important potential
damages could, in principle, be tolerated. In contrast,
a regulation based on " principles " is universal for all
activities under the scope of a regulation. We see, for
instance, the GDPR as a " principles " -based type of
regulation that contrasts with this high-risk approach
adopted for AI regulation. Of course, even in GDPR,
the resources for enforcement should be prioritized to
monitor those companies that might be offending to
more people or dealing with more delicate personal
data. And, a DPIA is required for data processors, so
it also has a risk management approach to identifying
and monitoring activities both of regulating agencies
and regulated entities. But the regulation itself does
not rule out other applications, considered a priori
" low risk " : the GDPR is applicable to all companies
processing personal data, big and small, independent
of the number of personal records or potential risk of
the consequences. We think it is a more robust and
flexible approach the principle-based regulation.
On this note, a more concrete and complete definition
of risk should be thought of. We propose that
a multidimensional risk assessment methodology
should be proposed based not only on the severity
of potential harm to an individual, but also the number
of individuals, the impact to common goods,
and the probability of occurrence. In this sense, the
proposed assessment of " high-risk " applications as
based on: 1) a set of industrial sector where " significant
risks can be expected to occur " and 2) severity
of individual hazard in these sectors, should be
refined, and not limited a priori to some sectors.
June 2021
We contend this position, since regulation should
affect all applications-all applications should be
safe, protect privacy, and be transparent to a reasonable
degree-but high-risk applications should
be subject to greater and more specific and frequent
(or continuous) controls like inspections and audits,
while no-risk applications should still follow regulation,
but without third-party auditing or inspection.
On the industrial aspects of this regulation, the
White Paper discusses the convenience of adopting
a sectorial approach to regulation and call for a
necessary survey of a complete collection of current
and potential AI applications in each commercial
or public activity, so a more in-depth analysis can
be performed on the impact and risk assessment for
each potential application.
In any case, risk is a useful concept while addressing
regulation. A recent study [21] about the societal
and ethical impacts of AI in different European
policy frameworks considers the following elements:
autonomy, human dignity, data protection and privacy,
fairness and equity, the good life and diversity,
responsibility and accountability, surveillance and
democracy, and trust. It is a broader framework, not
only a matter of " risk. "
It is also important to define how we classify high
risk. This is usually done in industry practice by quantifying
the overall damage caused, as the individual
damage inflicted multiplied by the number of people
affected. The high-risk approach focuses more on traditional
sectors in which decisions affect more lives
of individuals such as health-related applications. This
might be somewhat shortsighted for an AI regulation,
since in many cases, the damage can be inflicted in a
more subtle way not only to individuals but also to the
future of communities as a whole. For instance, the publishing
of fake news might be considered a low risk at
individual level, but the consequences of the decisions
based on fake news can have a considerable negative
impact on communities. Telling half-truths and filtering
content or ads based on profiles might have bad implications
for democracy as the Cambridge Analytica
case has shown. Fake news can have devastating consequences
like Myanmar October 2018 genocide, which
was a reported consequence of fake stories published
by military in Facebook. How do you evaluate potential
risk of these kinds of applications that really do not
affect much individuals but do affect communities or
even countries, by having a negative impact on a common
good such as public opinion or democracy? It is a
61
IEEE Technology and Society Magazine - June 2021

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - June 2021
