Vedder & Naudts 2017 – Accountability for the use of algorithms in a big data environment¶

In brief

The authors define accountability as the ability to give good reasons to explain and justify actions, decisions and policies to a (hypothetical) forum (p. 206) [U]. Because both private and public decision-makers increasingly rely on algorithms operating on big data, special accountability mechanisms are needed (p. 206) [U]. They argue that the accountability mechanisms in the GDPR cannot be appropriately applied to such algorithms, because algorithms are complex and often operate on a ‘random group level’ (p. 206) [U]. They conclude that accountability must go beyond data protection, and that broad stakeholder involvement and sector-specific oversight are needed (p. 219) [U].

Research question and main claim¶

Question: what form should accountability take when complex algorithms are used and outcomes may refer to other or more people than those in the input data (p. 207) [U]?
They cannot answer in detail, but aim at ‘rudimentary contours of starting points for such an answer’ (p. 207) [U].
Main claim: the effects of algorithms transcend data protection, so algorithmic accountability cannot be based solely on data protection principles or directed only at a data protection authority (p. 219) [U].
They try to stay close to the GDPR's basic assumption: not closing off useful data use, but enabling responsible use through accountability (p. 207) [U].

Theoretical perspective¶

Law and ethics of information technology; definitions of algorithms (Hill, Gillespie) and big data (boyd and Crawford) (p. 206) [U].
Critical algorithm studies: Kitchin, Pasquale's ‘black box society’, Burrell on opacity, Kroll et al. on accountable algorithms (pp. 207–210, 215) [U].
Accountability literature: OECD 1980 principles, Article 29 Working Party, Zimmermann and Cabinakova (pp. 211, 214) [U].
Vedder's own earlier work on random groups and non-distributive profiles (Vedder 1999) (p. 210) [U].
Solove (2013) on privacy ‘self-management’ and Obar on its limits (p. 216) [U].

Empirical material and context¶

No empirical study. Legal analysis of the EU General Data Protection Regulation (GDPR), especially the accountability principle (Art. 5), data protection impact assessments (Art. 35), records of processing (Art. 30), the right not to be subject to automated decision-making (Art. 22) and transparency (pp. 211–214) [U].
Context: written before the GDPR took effect (‘the upcoming GDPR’) (p. 206) [U].

Method¶

Conceptual and legal analysis: first the complexity of algorithms, then the accountability mechanisms in the GDPR, then an assessment of whether they are sufficient (pp. 208–219) [U].

Key concepts¶

Concept	How the source defines or uses it	Page	U/T
accountability	The ability to provide good reasons to explain and justify actions, decisions and policies to a (hypothetical) forum	206	U
algorithm	Encoded procedures through which input data are transformed into a desired output	206	U
big data	(boyd and Crawford) Phenomenon in which technology is used to aggregate, analyse, link and compare large datasets to make claims	206	U
technical complexity	Algorithmic language, randomisation, ensembles, interdependence with data and other algorithms	208–209	U
contextual complexity	Algorithms are relational, value-laden and produce situated outcomes	209–210	U
random groups	Groups formed by algorithms on the basis of hidden commonalities; not easily recognisable	210	U
non-distributive statements	Statements about members of a group that need not hold for each individual	210	U
forum of accountability	Who the decision-maker is accountable to: individuals, regulators, organisations	217–218	U
unfair differentiation	A broader notion than discrimination, including unequal treatment not yet covered by law	217–218	U

How privacy and private data are understood¶

There has long been a tendency to see the social impact of data as a matter for privacy and data protection law (p. 207) [U]. The authors argue this is not enough for algorithms (pp. 214–219) [U].
Data protection is described as a fundamental right, with principles such as fairness, transparency and accountability (p. 211) [U].
The GDPR's focus on the individual data subject fits poorly when algorithms affect groups or potentially everyone (p. 218) [U].
Algorithms in big data settings do not necessarily use or produce personal data in the strict sense, so they may fall outside the GDPR (p. 215) [U].
Accountability towards the individual is a form of privacy ‘self-management’, which individuals have little time and capacity for (p. 216) [U].

Arguments and findings¶

Algorithms are used by decision-makers in both the private and public sphere, for example for jobs, creditworthiness and police suspicion (pp. 206–207) [U].
Algorithms are value-laden; the view that ‘computer knows best’ overlooks this (p. 209) [U].
Trade secrecy is a man-made cause of opacity, unlike technical or contextual complexity (p. 210) [U].
Transparency as such does not constitute accountability (p. 215) [U]. Transparency about context and purpose can still be created (p. 215) [U].
In big data, the purpose of processing may remain undetermined or change, which is why accountability after the fact is important (p. 216) [U].
Impact assessments are a priori, while accountability is usually a posteriori; the impact of algorithms is hard to predict in advance (p. 216) [U].
The right not to be subject to automated decisions only covers ‘solely automated’ decisions and does not help people whose data were not collected but who are still affected (pp. 213, 217) [U].
Accountability to one supervisory authority risks overlooking other affected interests; multi-stakeholder involvement and sector-specific oversight are needed (p. 219) [U].

Limitations the source itself mentions¶

They cannot answer the main question in detail; only rudimentary contours (p. 207) [U].
They focus on algorithms processing data about persons, although algorithms about non-human things can also have important effects (p. 208) [U].
It remains to be seen whether algorithmic risks can be mapped in practice (p. 216) [U].
Multi-stakeholder involvement brings its own difficulties, for example with competition law (p. 221, n. 40) [U].

What the source does not cover¶

Norway or national implementation of the GDPR [T].
Empirical cases of public authorities' use of algorithms [T].

Possible relevance for the thesis¶

Accountability and transparency are likely central words in Norwegian documents; the article gives a precise definition and shows the limits of the GDPR's mechanisms [T].
The point that the GDPR's individual focus fits poorly with group effects (p. 218) connects to collective understandings of privacy in other sources [T].
The article explicitly includes public decision-makers' use of algorithms (p. 206) [U], which concerns the state's use of data [T].

Connections to other sources¶

Fairfield & Engel 2015 – thematic: both argue that privacy problems concern groups, not only individuals [T].
Abiteboul & Stoyanovich 2019 – thematic: both discuss transparency and the GDPR's rights for algorithms; Abiteboul & Stoyanovich from a technical angle [T].
Solove 2011 – Vedder & Naudts cite Solove 2013 on privacy self-management (p. 216), not the 2011 book [U].
Grimmelikhuijsen et al. 2013 – thematic: transparency [T].
Bennett 2018 – Vedder & Naudts cite Bennett 2010 on accountability (p. 211); whether this is related to Bennett 2018 in the source list cannot be checked, because that PDF is missing [T].

Key quotes¶

“Accountability is the ability to provide good reasons in order to explain and to justify actions, decisions and policies for a (hypothetical) forum of persons or organisations.” (p. 206)

“Algorithms in a Big Data context, however, although often relating to human beings, do not necessarily use or produce personal data in the strict sense” (p. 215)

“Transparency as such, however, does not constitute accountability” (p. 215)

“As the effects of algorithms transcend the realm of data protection, so must the approach in algorithmic accountability.” (p. 219)

Open questions for Rebekka¶

Do Norwegian documents use ‘accountability’ (ansvarlighet, ansvar) and ‘transparency’? Do they mean the same as here?
Who is the ‘forum’ of accountability in the documents: the individual, Datatilsynet, the Storting, the public?
Do the documents discuss group effects of algorithms, or only individual rights?
Is the article's distinction between transparency and accountability useful for your analysis?