Abiteboul & Stoyanovich 2019 – Transparency, Fairness, Data Protection, Neutrality¶

In brief

A short article aimed at the data management research community. It presents three regulatory frameworks – the EU's GDPR, New York City's law on automated decision systems, and the net neutrality principle – as examples of a global trend where governments are starting to regulate data-driven algorithmic technology (pp. 1–2) [U]. The authors point out technical challenges the frameworks raise: transparency, fairness, deletion and portability of personal data, and neutrality (pp. 4–7) [U]. The main message is that legal and ethical norms cannot be added as an afterthought; we must think in terms of ‘responsibility by design’ (pp. 1, 8) [U].

Research question and main claim¶

Aim: to bring the regulatory frameworks to the attention of the data management community and to point out technical challenges the community is well equipped to address (pp. 1–2) [U].
Main claim: legal norms cannot be incorporated into data-driven systems as an afterthought; responsibility by design must be a systems requirement (pp. 2, 8) [U].
Enacting transparency, fairness, data protection and neutrality will require a significant cultural shift, where efficiency, accuracy and utility are balanced against equitable treatment and accountability (p. 8) [U].

Theoretical perspective¶

No explicit theoretical tradition. The article is written from computer science / data management, with references to work on fairness in machine learning, data provenance and differential privacy (pp. 4–6) [U].

Empirical material and context¶

No empirical study. Discussion of regulation: GDPR (adopted 2016, enforceable from 25 May 2018), the NYC ADS Law (2017), EU Regulation 2015/2120 on net neutrality, India's net neutrality framework, and the US FCC's repeal of net neutrality in 2017 (pp. 2–4) [U].
Examples: ProPublica's ‘machine bias’ story, the FICO credit score, Google's dereferencing, Facebook deletion, the Data Transfer Project (pp. 4, 6–7) [U].

Method¶

Position paper / overview of regulation and technical challenges, with research directions for the field [T – characterisation].

Key concepts¶

Concept	How the source defines or uses it	Page	U/T
personal data	(GDPR) Any information relating to an identified or identifiable natural person, the data subject	2	U
responsibility by design	Legal and ethical norms built in as a systems requirement, not added afterwards	1, 8	U
data transparency	Releasing data or statistical summaries of it, while preserving privacy; needed for algorithmic transparency	3–4	U
interpretability	Surfacing the properties of data and their ‘fitness for use’ for a specific task	4	U
fairness	Subjective, context-dependent and highly politicised; different notions cannot all be enforced at once	5	U
right to be forgotten	(GDPR Art. 17) The right to request erasure of personal data	6	U
data portability	(GDPR Art. 20) The right to receive and move one's data to another vendor	6–7	U
net neutrality	ISPs should not discriminate based on source, destination or content	3	U

How privacy and private data are understood¶

Mainly as individual rights under the GDPR: consent, rectification, erasure, portability and the right to be informed (p. 2) [U]. The GDPR's primary focus is on giving data subjects insight into and control over their personal data (p. 2) [U].
As something in tension with transparency: data cannot always be shared because they are sensitive; privacy-preserving methods such as differential privacy are proposed (p. 4) [U].
As a technical design requirement (responsibility by design) (p. 8) [U].
Data literacy and user associations are mentioned as an implicit form of regulation that can help people protect their private data (p. 8) [U].
The GDPR applies to both the private and public sector (p. 2), and the NYC ADS Law only regulates city agencies (p. 3) [U].

Arguments and findings¶

Transparency and accountability are of particular importance when algorithms are integrated into government processes; transparency of government is a core democratic value (p. 4) [U].
Publishing source code is rarely sufficient; algorithmic transparency requires data transparency (p. 4) [U].
Bias often arises in pre-processing (cleaning, integration, querying, ranking), so fairness should be addressed upstream (p. 5) [U].
Deletion must be permanent and deep, but it is hard to guarantee all copies are deleted, and deletion may conflict with other legal requirements (p. 6) [U].
Google has, against its will, acquired a questionable power to adjudicate through dereferencing (p. 6) [U].
It is the role of regulators to impose portability and interoperability, because companies have little incentive to help customers leave (p. 7) [U].

Limitations the source itself mentions¶

Net neutrality measurement is primarily of interest to other research communities than data management (p. 7) [U].
The article focuses on explicit regulation of industry and government oversight; user empowerment is only mentioned briefly (p. 8) [U].

What the source does not cover¶

Norway or Nordic regulation [T].
Social science or political analysis of why the regulation looks as it does [T].
The state as collector of data, beyond the NYC ADS Law on city agencies [T].

Possible relevance for the thesis¶

Gives a short, technical overview of the GDPR rights that Norwegian documents will likely refer to [T].
The idea that norms must be built into systems (‘by design’) may also appear in Norwegian documents (for example as ‘innebygd personvern’); the article can help recognise the vocabulary [T].
Can serve as an example of how computer scientists frame privacy, as a contrast to social science sources [T].

Connections to other sources¶

Fairfield & Engel 2015 – thematic and contrasting: Abiteboul & Stoyanovich present GDPR's individual rights to deletion and portability as central, while Fairfield & Engel argue that tools centred on individual rights of review and deletion have been largely ineffective (Fairfield & Engel p. 457) [T].
Grimmelikhuijsen et al. 2013 – thematic: transparency of government [T].
Vedder & Naudts 2017 – thematic: accountability for algorithms [T].

Key quotes¶

“Governments are starting to recognize the need to regulate data-driven algorithmic technology.” (p. 1)

“The main takeaway of this article is that legal and ethical norms cannot be incorporated into data-driven systems as an afterthought.” (p. 1)

“That is, data transparency is in tension with the privacy of individuals who are included in the dataset.” (p. 4)

“Fairness is a subjective, context-dependent and highly politicized concept” (p. 5)

Open questions for Rebekka¶

Do you use this article for its overview of the GDPR, or for its argument about responsibility by design?
Do the Norwegian documents use ‘by design’ thinking (for example ‘innebygd personvern’)?
Is the tension between transparency and privacy (p. 4) visible in your documents?
How do you want to use a technical source alongside the social science sources?