Article by the Parliamentary Ombudsman, Judge Emeritus Joseph Zammit McKeon published on the Times 14/03/25
I must confess that I am not an expert in artificial intelligence (AI). I am, however, a firm believer in the rule of law.
I know that for AI to operate it requires algorithms that are modelled on the decision-making processes of the human brain. They are designed to absorb large amounts of data in order to provide possibly accurate meaningful results. Although it is said that AI “learns”, AI cannot do so unless data is collected or exists. If data is inadequate or incomplete, then AI could “learn” wrongly. Knowingly or not, personal information is collected which could be used to profile behaviour.
AI has benefits. It has reduced strain, boosted productivity and reduced costs, especially in tasks that do not require human interaction. Nonetheless responsible and accountable use of AI is a must. Data collection should not be free from independent control. In order to prevent misuse, further developments should take account of ethical and social concerns. AI is no exception to the rule of law, in particular as regards the protection of human rights, especially the rights of the vulnerable. AI cannot be used to favour discriminatory practices. Nor can it become capable of making decisions that negatively affect the lives of people. The use of AI should not be allowed if its applications do not conform with domestic and international human rights standards.
Art 8(1) of the European Convention for the Protection of Human Rights and Fundamental Freedoms provides that “everyone has the right to respect for his private and family life, his home and his correspondence”. This provision, as others in the Convention which Malta ratified, is part of the laws of Malta (Chapter 319). We find provisions of similar content and quality in Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. The Charter is also part of Maltese Law by virtue of the Lisbon Treaty. The European Court of Human Rights (ECtHR) has had occasion to declare that Art 8 covers the protection of the right to personal identity and to personal development, and the right to protection of personal data, even though the latter is not specifically enshrined as an independent right in the Convention.
The difficult relationship between AI and the protection of human rights became more evident following the judgement of the 5 February 2020 given by the District Court of The Hague, Netherlands, in the Case No. C/09/550982/HA ZA 18/388.
The facts: The Dutch Government devised a statutory Risk Indication System (SyRI) to prevent and combat fraud primarily (but not only) in social security. The system was designed to allow data to be linked and analysed anonymously in a secure environment so that risk reports could be generated. The legislation sustaining SyRI was contested. The case focused not just on data processing operations in the deployment of the SyRI and its technical safeguards, but also on other issues including: the mutual exchange of personal data by administrative bodies and the provision of personal data to Government.
The Court ruled that SyRI violated Art 8 of the Convention (supra). The risk model, the indicators and the data that were actually processed were neither public nor known to those involved and had a significant effect on the private life of the persons to whom the report referred. SyRI legislation did not cater for an information obligation on the data subjects whose data was processed to enable them to know that their data was the object of processing. Nor did the legislation provide for an obligation to inform data subjects, individually where appropriate, of the fact that a risk notification has been made.
Although the Court accepted the principle that new technologies could be used to prevent and combat fraud and that in principle SyRI legislation had a legitimate purpose, the the development of new technologies had also to take into account the right to the protection of personal data. Legislation had to provide a framework sufficient to protect the right to privacy, which includes the protection of personal data, in order to enable all interests at stake to be considered in a transparent and verifiable manner. Legislation had also to allow any person to have a reasonable expectation that his/her private life would be respected in terms of Art 8 of the Convention (supra). The Court found that the SyRI legislation did not meet that requirement.
As a direct consequence of that judgement, the Dutch Government came under pressure and had to take responsibility for the implementation of the SyRI which brought about that 10,000 Dutch families were falsely accused of defrauding the State, forcing them to repay money owed to them and having their benefits stopped. A €500m fund was set up to compensate the families. The Rutte III Dutch Cabinet took collective responsibility and had to resign two months before the general elections that were scheduled to take place in March 2021.
On the multilateral level, both the European Union and the Council of Europe have intervened.
As part of its digital strategy, the EU embarked on regulating the development and use of AI. In April 2021, the European Commission proposed the first EU AI law that established a risk-based classification system. In June 2024 the Artificial Intelligence Act was adopted. After its entry into force, the Act established deadlines: 6 months for “Prohibited AI Systems”; 24 months and 36 months for “High Risk AI systems” as defined respectively in Annex III and Annex I of the Act ; and and 12 months for “General Purpose” AI. An AI Office was established within the EU Commission to ensure compliance.
The Council of Europe had its say as well by adopting the Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, that aims to ensure that activities within the lifecycle of artificial intelligence systems, although conducive to technological progress and innovation, are fully consistent with human rights, democracy and the rule of law. The Convention opened for signature on the 5 September 2024 even for countries outside the European Continent. So far signatories have been the EU, 9 non-EU European nations, Israel, Canada, the USA and Japan. The fundamental principles of the Convention include the protection of human dignity, individual autonomy, equality, non-discrimination, privacy, personal data, transparency and oversight, accountability, safe innovation and reliability. The Convention provides for remedies, procedural rights and safeguards, including the introduction of risk and impact management requirements.
These international legal instruments alone are not enough. There is a need for strong investment in awareness strategies and education projects that assist the public in learning not only about the operations of AI, but also its impact on everyday life, stressing on the importance of providing transparent and comprehensible information that is accessible not just to experts but also to the public in general. In addition, people should reasonably be advised how their data are being processed.
The promotion and protection of human rights must be put at the centre even in the case of AI. In order to advance further human rights standards, good law is a must. Civil society should also keep itself alert with increased awareness to identify matters where AI could impact negatively on human rights.
Human rights compliant and respectful AI is in the public interest.
Finland
