隐私立法如何帮助解决人工智能问题

2023/7/1010:40

BROOKINGS

HowprivacylegislationcanhelpaddressAl|Brookings

COMMENTARY

HowprivacylegislationcanhelpaddressAl

CameronF.Kerry

July7,2023

→Artificialintelligencepolicypresentsachallengeforlawmakers,butcomprehensiveprivacylegislationprovidesastartingpoint.

→TheAmericanDataPrivacyandProtectionAct(ADPPA)includesprovisionsonalgorithmicaccountabilityandfairnessthatcancreateabaselineforAlregulation.

→ThedevelopersofAlsystems,policymakers,andcitizenswillneedtolearnmuchmoreabouttheoperationofthesystemstoaddressthebiggestquestionsofAlpolicy.

Followtheauthors

@CamKerry

TheChatGPTmomenthascapturedattentionlikenothingbeforeinthedigitalera.

Thisisevidentintherecord-breakinguptakeofChatGPTaswellasthewidepublic

conversation,notonlyfromalmosteveryimaginablecommentatorbutalsoaround

manydiningtables.Thesedays,whenImentionIworkatathinktankonartificial

intelligencepolicy,thefollow-upIgetis,"WhatdoyouthinkaboutChatGPT?"

Thetsunamiofattentionisalsoevidentintherushbypolicymakerstodemonstrate

theyareontopofthistransformativethreshold.OnMay4,2023,theWhiteHouse

calledinleadingCEOsforameetingwithVicePresidentKamalaHarrisandseniorstaffand,alongsideadrop-invisitfromPresidentJoeBiden,urgedthemtoberesponsible

inAldevelopment.Theeventwasaccompaniedbyanannouncement

(

/generative%2Ored%20team/generative-red-team/

)ofcrowd-

sourcedtestingoflargelanguagemodels(LLMs)atthenextDEFCONconferenceandOfficeofManagement&BudgetguidanceforfederalagencyadoptionofAl,along

witharecapoftheWhiteHouseExecutiveOrderonbias

(

/briefing-room/statements-releases/2023/02/16/fact-

sheet-president-biden-signs-executive-order-to-strengthen-racial-equity-and-

support-for-underserved-communities-across-the-federal-government/),AlBillof

Rights,(

/ostp/ai-bill-of-rights/

)andotherpreviousactionsonAl.Twoweekslater,theWhiteHousereleasedanadditionalpackage

(

/ostp/news-updates/2023/05/23/fact-sheet-biden-

harris-administration-takes-new-steps-to-advance-responsible-artificial-intelligence-

research-development-and-deployment/)ofinitiatives—thistimefocusedonresearchanddevelopment,education,andgatheringmorepublicinput.

OntheotherendofPennsylvaniaAvenuetoo,SenateMajorityLeaderChuckSchumer

promptlyannounced(/2023/05/15/1175776384/congress-wants-

regulate-ai-artificial-intelligence-lot-of-catching-up-to-do)thatheisundertaking

workonAllegislation.Soonafter,hewenttotheSenatefloortoreport

(

/newsroom/press-releases/majority-leader-

schumer-floor-remarks-on-the-need-for-bipartisan-comprehensive-ai-legislation)on

assemblingabipartisangrouptoleadthisworkand,onJune21,hedeliveredapolicy

speech(/events/sen-chuck-schumer-launches-safe-innovation-

ai-age-csis)inwhichheoutlineda"SafeInnovationFramework"for"comprehensive"

/articles/how-privacy-legislation-can-help-address-ai/

1/7

2023/7/1010:40

HowprivacylegislationcanhelpaddressAl|Brookings

Allegislation,withemphasisoninnovationforAmericanleadershiponAl.This

emphasiswasbalancedbyacalltoincorporatesecurity(broadlyconceivedtoinclude

economicsecurity),accountability,nationalvalues,and,perhapsmostsignificantly,

greaterexplainabilityforAlmodels.Schumerplanstofleshouthisframeworkthrough

aseriesof"insightforums"thatwillbringtogetheracross-sectionofexpertsto

exploremajorAlissuesoutside(butalongside)thenormalcommitteeprocessesofthe

Senate.

TherapidpaceofAldevelopmentinrecentyearspresentsmanyquestionsabout

human-computerinteraction—fromfundamentalquestionsabouthowtocontrolAlas

machinelearninggrowsmoresophisticated,toarangeofsocialpolicyissues

stemmingfromthecapabilitiesofgenerativeAl,includinghowtoadapteducationand

knowledgework(includingtheworkofthinktankresearchers)anditsimpacton

disinformationanddemocracy.Toaddresssomeoftheseissues,thedevelopersofAl

systems,policymakers,andcitizenswillneedtolearnmuchmoreabouttheoperation

ofthesystemsaswellastheirrisksandbenefits.AsSenatorMartinHeinrich(D-NM)

putit(/2023/05/18/ai-legislation-bipartisan-senate-group-

schumer),"thisisgoingtobecomplicatedstuff."

Artificialintelligencepolicyisnotstartingfromscratch,though.Thereissome

consensusaroundmeasuresthatcanhelpincreaseunderstandingandjudgment

aboutAlsystems,theiroperation,andtheireffects.Algorithmictransparency,

accountability,andfairnessarethetouchpointsofmostAlgovernanceframeworks

andregulatoryproposals.A2019survey(/articles/s42256-

019-0088-2)inNatureofethicalAlguidelinesandprinciplesidentified84such

frameworksaroundtheworld.Ofthese,transparencyinsomedimensionwas

reflectedin73;"justice&fairness"in68;and"responsibility"in60(othersalientpoints

incommonwerebeneficenceandpreventionofharm).Sofar,congressionalproposals

havefollowedsimilarlines.Disclosureoftheusesandbasisforalgorithmsisa

significantelementofSen,Schumer'sframework.Anearlyandinfluentialbillinthis

regardhasbeentheAlgorithmicAccountabilityAct

(

/bill/116th-congress/senate-bill/1108

)originallyintroduced

in2019bySen.RonWyden(D-OR)andRep.YvetteClark(D-NY),whichfocusedon

"algorithmicimpactassessments"ofAlsystemsdefinedas"high-risk"basedontheir

potentialimpactonindividuals.

Privacylegislationanticipatesalgorithmissues

Keyprivacylegislationhasincludedprovisionsonalgorithmicaccountabilityand

fairness,startingwiththeleadingSenatebillsfromSens.MariaCantwell

(

/bil/116th-congress/senate-bill/2968

)(D-WA)andRoger

Wicker(/bill/117th-congress/senate-bill/2499)(R-MS)inthe

116hCongress.ThebipartisanAmericanDataPrivacyandProtectionAct

(

/bill/117th-congress/house-bill/8152

)(ADPPA)inthe117th

Congressbuiltonthese.TheADPPAwasreportedoutoftheHouseEnergy&

CommerceCommitteeinJuly2022bya53-2votebutdidnotgettotheHousefloor

duringtheend-of-yearlameducksession.Itislikelytobere-introducedinthecurrent

CongressandcanbeavehicleforCongresstogetsomethingdoneonAlissues.

Inmyownwork,Ihavepreviouslypointedtocomprehensiveprivacylegislationtoget

atcompetition(/blog/techtank/2021/08/16/one-year-after-

schrems-ii-the-world-is-still-waiting-for-u-s-privacy-legislation/)andcontent

(

/opinion/technology/535824-to-fix-social-media-now-focus-on-

privacy-not-platforms/)issues,soIcouldbeaccusedoftreatingprivacylegislationas

thehammerforeverytechissuethatlookslikeanail.Idonotmeantosuggestthat

privacylegislationcansolvealltheissuespresentedbyemergingAl.But

comprehensiveprivacylegislationislongoverdueand,unlikeotherunfoldingissues,

theADPPAoffersavehiclethathasalreadyadvancedalongwaythroughthe

/articles/how-privacy-legislation-can-help-address-ai/

2/7

2023/7/1010:40

HowprivacylegislationcanhelpaddressAl|Brookings

legislativeprocessoverseveralyearsofworkanddebate.Indeed,inthecurrent

CongresstheHouseEnergy&CommerceCommitteeheldhearingsspecificallyon

privacylegislationinMarch(/events/innovation-

data-and-commerce-subcommittee-hearing-promoting-u-s-innovation-and-

individual-liberty-through-a-national-standard-for-data-privacy)andApril

(

/events/innovation-data-and-commerce-

subcommittee-hearing-addressing-america-s-data-privacy-shortfalls-how-a-

national-standard-fills-gaps-to-protect-americans-personal-information),thelatest

amongmanyoverthreesuccessivecongresses.Thecollection,use,andsharingof

personalinformationisfundamentaltomanytechnologyapplicationsofconcern,andtheADPPAcontainsprovisionsthataddressotherimportantaspectsofAlgovernance.

Iamnotaloneinsuggestingprivacylegislationasaremedyforissuesotherthan

privacyperse.Inthefirsthearingoftheyear

(

/events/full-committee-hearing-american-energy-

expansion-strengthening-economic-environmental-and-national-security)forthe

SubcommitteeonInnovation,Data,andCommerceofHouseEnergy&Commerce,on

"strengtheningAmerica'scompetitivenessandbeatingChina,fullcommitteechairand

rankingmemberCathyMcMorrisRodgers(R-WA)andFrankPallone(D-NJ),

subcommitteechairandrankingmemberGusBilirakis(R-FL)andJanSchakowsky(D-

IL)andReps.LisaBluntRochester(D-DE),NealDunn(R-FL),andLoriTrahan(D-MA),allcalledouttheADPPAasanecessaryresponse,asdidwitnessesSammSacksandBrandonPugh.WhenTikTokCEOShouChewtestified

(

/watch?v=x1xEuKOFxu8

)beforethecommitteeinMarch,alongrosterofmemberspointedtothevolumeofdatacollectedbyTikTokaspartofabroaderproblemonline:Rodgers,Pallone,Bilirakis,Rochester,andTrahanwerejoinedbyReps.RichardHudson(R-NC),KatCammack(R-FL),KathyCastor(D-FL),Bill

Johnson(R-OH),YvetteClarke(D-NY),JayObernolte(R-CA),GregPence(R-IN),AnnaEshoo(D-CA),andDanCrenshaw(R-TX).PrivacyalsocameupduringaMay

2023Senatehearing(/newshour/politics/watch-live-openai-ceo-sam-altman-testifies-before-senate-judiciary-committee)withOpenAlCEOSam

Altman,whereSens.MarshaBlackburn(R-TN),RichardBlumenthal(D-CT),andJon

Ossoff(D-GA)calledforCongresstomoveforwardinlegislationforonlineprivacyanddatasecurity—andsodidAltman.Thesevoiceshavebeenjoinedbycommentators

fromForbes(/sites/forbestechcouncil/2023/03/27/why-you-

need-to-prepare-now-for-privacy-legislation-that-may-not-pass/?sh=76791506769a)

,StanfordHAl(/news/regulating-ai-through-data-privacy),

andtheInternationalAssociationofPrivacyProfessionals.

(

/news/a/how-existing-data-privacy-laws-may-already-regulate-data-

related-aspects-of-ai/)And,accordingtoPewResearch

(

/internet/2022/03/17/how-americans-think-about-

artificial-inteligence/),theAmericanpeoplealsoareconcernedabouttheimpactof

Alontheirprivacy

TheADPPAcontainsseveralimportantprovisionsthatwouldhelpaddressAl.First,the

billwouldplaceboundariesoncollection,use,andsharingofpersonalinformation,

requiringthatsuchprocessbe"necessaryandproportionate"towhatisnecessaryto

provideaproductsorserviceorforotherenumeratedpurposes.AsIhavepreviously

written(/research/protecting-privacy-in-an-ai-driven-

world/),suchboundarieshelptocircumscribethepowerofartificialintelligenceto

"magnif[y]theabilitytousepersonalinformationinwaysthatcanintrudeonprivacyinterestsbyraisinganalysisofpersonalinformationtonewlevelsofpowerandspeed."Indeed,datagovernance—itsprovenance,quality,andethicaluse—isvitaltoAl

governanceframeworks.Itisnotablethat,asfoundationalmodelshaverolledout,itis

privacyanddataprotectionregulatorsinEurope

(https://edpb.europa.eu/news/news/2023/edpb-resolves-dispute-transfers-meta-

and-creates-task-force-chat-gpten)andCalifornia

(

/regulations/pdf/invitation

forcommentspr02-2023.pdf)that

havesteppedintoexplorethesourcingandusesofpersonaldata.

/articles/how-privacy-legislation-can-help-address-ai/

3/7

2023/7/1010:40

HowprivacylegislationcanhelpaddressAl|Brookings

Second,theADPPAcontainsagroundbreakingprovisionstrengtheningprotectionsof

civilrightslawsinthedigitalspherebyprohibitingtheuseofpersonalinformationin

waysthatdiscriminate.AstheWhiteHouseAlBillofRights

(

/ostp/ai-bill-of-rights/

)issuedlastyearputit,the

problemsofbiasinalgorithmsandautomatedsystem"arewelldocumented

(

/stable/pdf/24758720.pdf?

casatoken=D1VrB8rxvWYAAAAA:Fu7ocYkgmgw3Z9gevs9alfAEombTrOxXhVOejTYPGXxgH5G2BODEnwNAGY5xd

,andpoordesignofalgorithmsorunrepresentativetrainingdatacanembedhistorical

inequitiesinlife-affectingcontextslikehiring(/2019/05/all-the-ways-

hiring-algorithms-can-introduce-bias),housing

(

/press/press

releasesmediaadvisories/HUDNo22050FactSheet)

,andhealthcare(/publications/artificial-inteligences-racial-bias-in-

health-care)aswellascriminaljustice(/article/machine-

bias-risk-assessments-in-criminal-sentencing)amongothers.Thefactsheet

(

http://ahttps//ostp/news-updates/2022/10/04/fact-sheet-biden-

of

harris-administration-announces-key-actions-to-advance-tech-accountability-and-

accompanyingtheAlBillprotect-the-rights-of-the-american-public/)accopinintgstheclBllielld

outtheworkoffederalagenciestoapplyexistinglawsandmechanismstoaddress

discriminationinhousing,employment,andotheropportunities.TheADPPAscivil

rightsprovisionwouldreinforcetheseefforts.

Third,theADPPAscivilrightssectionalsocontainedtheprovisionsmentionedon

algorithmicassessmentandaccountability.Thesewouldhaverequiredalgorithmic

assessmentsthattouchkeyelementsofAlguidelinesandframeworks.Nevertheless,

provisionscanbeimprovedwithgreatertransparencyandaccountabilityforAl

systems.Thenextsectionlooksathowtoincorporatetheseelementsintothe2022

algorithmprovisionsoftheADPPA.

AdjustingprivacylegislationfortheChatGPTmoment

AsreportedoutoftheHouseEnergy&CommerceCommitteeinJuly2022,Section

207oftheADPPAprovidedfortwodifferenttiersofalgorithmicassessment.First,

"largedataholders"(entitieswithannualgrossrevenuesof$250millionormoreand

datafromfivemillionormoreindividualsordevices)wouldberequiredtoconduct

moreextensive"impactassessments."Thesewouldhavetobeperformedinitially

withintwoyearsofenactmentandannuallythereafter,detailingdesign,uses,training

data,outputs,andenumeratedrisks.Second,allothercoveredentitieswouldhaveto

performamoregeneral"designevaluation"covering"design,structure,andthe

inputs"ofalgorithmsandaddressingthesamerisksenumeratedforlargedataholder

impactassessments.Bothimpactassessmentsanddesignevaluationswouldhaveto

befiledwiththeFederalTradeCommission,withtheoptiontomakesummariesof

theseavailablepublicly.GiventheincreasedsaliencyofconcernsaboutAl,these

provisionsshouldbeupdatedtorequirecoveredentitiestomakeinformationabout

algorithmicdecision-makingavailabletothepublicandclarifythealgorithmsandrisks

thatarecoveredandtheneedtomeasureoutcomes.

Coveredalgorithmsandentities

Bythetermsofthebill,thealgorithmicimpactassessmentrequirementforlargedata

holders(Section207(c)(1))appliestoanyalgorithmicdecision"thatposesa

consequentialriskofharmtoanindividualorgroupofindividualsandusessuch

algorithmicdecision-makingsolelyorinparttoprocesscovereddata."Themore

generallyapplicable"designevaluation"requirement(Section207(c)(2))appliesto

any"consequential"algorithmicdecision-making.Thelargedataholderprovision

enumeratespotentialharmstoavoid,andthedesignevaluationprovisionrefersback

tothisenumeration.Evenso,"consequential"byitselfistoovaguebecauseitisnot

clearfromthelanguagewhatalgorithmicdecision-makingisencompassed.

/articles/how-privacy-legislation-can-help-address-ai/

4/7

2023/7/1010:40

HowprivacylegislationcanhelpaddressAl|Brookings

TheADPPAcontainsadefinitionof"coveredalgorithm."Itmeans:

Acomputationalprocessthatusesmachinelearning,naturallanguage

processing,artificialinteligencetechniques,orothercomputationalprocessing

techniquesofsimilarorgreatercomplexityandthatmakesadecisionor

facilitateshumandecision-makingwithrespectto[personalinformation],

includingtodeterminetheprovisionofproductsandservicesortorank,order,or

promote,recommend,amplify,orsimilarlydeterminethedeliveryordisplayof

informationtoanindividual.

Thislanguageimprovesonversionsthatmighthaveencompassedalmostany

computingusedtoassisthumandecisionsevenasroutineasanExcelspreadsheet,

butitisstilloverbroad.Recommendationenginesareaconcernwhen,forexample,

theyproduceinvidiousdiscriminationinproductrecommendationsorleadchildren

andteensdownrabbitholesofharmfulcontent,butnotineveryuse.Ratherthan

leavethemeaningof"consequential"tothesubstantiveprovisionsonalgorithmic

assessments,thedefinitionof"coveredalgorithm"itselfshouldelaboratethemeaning

of"consequential'tomakeclearthatrequirementsforalgorithmicassessmentand

accountabilityprovisionareafunctionoftheconsequencesofalgorithmicdecisions

andnotofanyuseofalgorithmsassuch.

ThisdefinitionshouldincorporatethespecificcategoriesofharmidentifiedinSection207(c)(1)(B)(vi)thatidentifycontextsandconsequencesthatshouldbeconsidered,suchasaccesstohousing,employment,andhealthcare.However,additionalumbrellalanguageshouldcapturethebroaderuniverseofharmstowhichthesecategories

belong.Forexample,theEuropeanUnion'sGeneralDataProtectionRegulationapplies

arighttohumanreviewofautomateddecisionsthathave"legaleffectsorsimilarly

significanteffects"onindividuals.But"similarlysignificant"isalsobroadandvague;it

couldbeclarifiedwithlanguagelike"opportunitiesandeconomic,social,andpersonal

well-being."Thiswouldcovertheenumeratedcategoriesbutalsoencompassother

life-affectingapplicationsaswell.

Inaddition,thefocusonanyalgorithmictoolthat"facilitates"humandecision-making

isalsooverlybroad,asthatcouldsweepindecisionsthatinvolvesubstantialhuman

agencyintheloop.CaliforniaAssemblyBill331(AB331)

(

/faces/billNavClient.xhtml?billLid=202320240AB331

),

asintroducedinthe2023-24session,containsbetterlanguage:itwouldencompass

analgorithmicprocessthatis"acontrollingfactor"inaconsequentialdecision.

Thereisananomalyinthescopeofthedesignevaluationprovision.Itcoversa

coveredentityorserviceprovider"thatknowinglydevelops"acoveredalgorithm.Thisbyitstermsfocusesfocusonlyonthedeveloperofanalgorithmandnotonacoveredentitythatusesanalgorithmicprocessdevelopedbyanotherentity.Thisventuresintoquestionsabouttheallocationofresponsibilityacrossthesoftwarevaluechain

debatedinconnectionwithCaliforniaAB331andtheEuropeanUnion'sproposed

ArtificialIntelligenceActandappearstoleaveoutusesthatmaybeconsequential.

Ratherthanaddresssuchobligationsacrossthevaluechain,informationprivacy

legislationshouldapplytheobligationtoconductadesignevaluationacoveredentity

that"employs"acoveredalgorithm.Theabilitytoevaluatethedesign,structure,

inputs,andoutputsmaybeconstrainedunderthosecircumstances,butsomesuch

inquiryisanecessarysteptowardresponsibleAlsystemsnonetheless.

Scopeofassessments

SincetheADPPAwasmarkeduplastJuly,theNationalInstituteofStandards&

Technologyissuedversion1.0ofitsAlRiskManagementFramework

(

/itl/ai-risk-management-framework

)(AlRMF)inJanuary2023.

/articles/how-privacy-legislation-can-help-address-ai/

5/7

2023/7/1010:40

HowprivacylegislationcanhelpaddressAl|Brookings

Thisframeworkprovides(/blog/techtank/2023/02/15/nists-ai-risk-management-framework-plants-a-flag-in-the-ai-debate/)aconceptual

frameworkforidentifyingAlriskandasetoforganizationalprocessesforassessing

andmanagingtheserisks.Theframeworkisexplicitlyintendedtobeiterativeandnot

one-size-fits-all.Therequirementsforriskassessmentsanddesignevaluationinthe

ADPPAshouldbereconsideredconsideringtheNISTAlRMF.Forexample,toavoid

makingthedesignevaluationprovisionone-size-fits-all,itcouldtakeintoaccountthe

sizeandcomplexityoftheentityinvolvedandthevolumeandsensitivityofdata,

parallelinglanguagethatrecursinanumberofotherADPPAprovisions(Sections101

(c)(dataminimizationguidance),103(b)(privacybydesign),203(g)(regulationson

individualcontrol),and208((a)(2)(datasecurity)).

Aboveall,theelementsofalgorithmicassessmentsshouldmoreexplicitlyand

distinctlyincorporatemeasurement.Incarpentry,themaximis"measuretwice,cut

once."ForAl,themaximneedstobemeasure,measure,measure,andmeasureagain.

AsmyBrookingscolleagueNicolTurnerLeehaswrittenwithPaulResnickandGenie

Barton(/research/protecting-privacy-in-an-ai-driven-

world/#footnote-20),"It'simportantforalgorithmoperatorsanddeveloperstoalwaysbeaskingthemselves:Willweleavesomegroupsofpeopleworseoffasaresultofthealgorithm'sdesignoritsunintendedconsequences?'(emphasisinoriginal).ThiscallsforauditsortestingtoensurethatAlsystemsareperformingasexpected,thatstepstomitigatepotentialharmsareworking,andthatadaptationsfrommachinelearningarenotcausinguntowardresults.Measurementisoneofthecorefunctionsofthe

NISTRMF(alongwithgoverning,mapping,andmanaging),whichrecommendsthat"Al

systemsshouldbetestedbeforetheirdeploymentandregularlywhileinoperation"

(emphasisadded).TheprovisionoftheADPPAonthescopeofimpactassessments

(Section207(c)(1)(B))refersto"outputs,"butshouldmakeexplicitthatits

assessmentsshouldincludemeasurementofoutputsbothbeforeandafter

deployment.

Inasimilarvein,thelanguageondesignevaluationshouldtilttowardmeasurementas

partoftheevaluation.Thisprovision(Section207(c)(2))shouldadd"andexpected

outputs"to"design,structure,andinputsofthecoveredalgorithm."

TheADPPAshouldincorporatetheNISTRMFintoalgorithmicassessmentsanddesign

evaluationsasareferenceforguidance(thoughnotacompliancesafeharboras

such).Thiscouldbeimpliedbyaprovision(Section207(c)(4))thatprovidesforthe

issuanceofFederalTradeCommission(FTC)guidanceonSection207compliance"in

consultationwiththeSecretaryofCommerce,"whocandelegatetoNISTtodrive.

ExplicitreferencewouldhelptodriveuptakeoftheNISTRMFanddevelopmentof

standardsandpracticestoinformcomplianceandenforcement.BecausetheNIST

RMFwillbeupdatediterativelyandinteractivelyonanongoingbasis,itismore

dynamicthantheusualagencyrulesorguidance.

Disclosure

TheADPPAprovisionsforassessmentswouldrequirelargedataholderstodocument

numerousfeaturesoftheAlsystembeingevaluated(Section207(c)(1)(B))andto

includethisinformationintheirreportstotheFTC.Othercoveredentitieswouldalso

havetosubmittheirdesignevaluations.Makingthisinformationavailabletothepublic

isentirelyoptional,however.

ThisleavesoutanessentialingredientofAltransparency.Asdiscussedabove,

transparencyisamajorelementofframeworksforethicalandtrustworthyAl,

includingtheNISTRiskManagementFramework.TheADPPAha