An evidence-based methodology for human rights impact assessment (HRIA) in the development of AI data-intensive systems

TL;DR

This paper introduces an evidence-based methodology for assessing the impact of AI data systems on human rights, grounded in empirical analysis of regulatory decisions, and demonstrates its practical application through case studies.

Contribution

It presents a novel, measurable HRIA methodology tailored for AI applications, grounded in empirical analysis of existing data protection decisions.

Findings

Human rights underpin many data protection decisions.

The proposed HRIA model is feasible and effective.

The methodology aligns with regulatory risk thresholds.

Abstract

Different approaches have been adopted in addressing the challenges of Artificial Intelligence (AI), some centred on personal data and others on ethics, respectively narrowing and broadening the scope of AI regulation. This contribution aims to demonstrate that a third way is possible, starting from the acknowledgement of the role that human rights can play in regulating the impact of data-intensive systems. The focus on human rights is neither a paradigm shift nor a mere theoretical exercise. Through the analysis of more than 700 decisions and documents of the data protection authorities of six countries, we show that human rights already underpin the decisions in the field of data use. Based on empirical analysis of this evidence, this work presents a methodology and a model for a Human Rights Impact Assessment (HRIA). The methodology and related assessment model are focused on AI applications, whose nature and scale require a proper contextualisation of HRIA methodology. Moreover, the proposed models provide a more measurable approach to risk assessment which is consistent with the regulatory proposals centred on risk thresholds. The proposed methodology is tested in concrete case-studies to prove its feasibility and effectiveness. The overall goal is to respond to the growing interest in HRIA, moving from a mere theoretical debate to a concrete and context-specific implementation in the field of data-intensive applications based on AI.