The positioning of AI between the respect for individual freedoms and health security : The European legal framework

Being aware that AI will contribute considerably to improving health security but that many risks are associated with it, the European Commission is proposing an approach based on an ecosystem of trust thanks to the establishment of a regulatory framework[9] .

Although AI can help ensure the safety of citizens, it can also be a source of legal uncertainty when used for malicious purposes and thus arouses a feeling of mistrust.

The Commission had already addressed the issue beforehand and had formulated, in its Ethical Guidelines for Trustworthy AI of April 8 2019[10], seven essential requirements expected of an AI :

• Human factor and human control ;
• Technical robustness and safety ;
• Privacy and data governance ;
• Transparency ;
• Diversity, non-discrimination and equity ;
• Societal and environmental well-being and
  Accountability.

Today, AI is only subject to non-binding guidelines. The establishment of a specific regulatory framework would thus contribute to reducing the lack of confidence and accelerating the adoption of this technology.

In particular, AI increases the possibilities of monitoring and analyzing the habits of populations. Although AI developers are required to respect fundamental rights, and are subject to European regulations regarding the protection of personal data and respect for privacy, in the minds of certain European citizens, the potential risk of mass surveillance of the population by public authorities is increased.

While in France the use of video surveillance by drones whose role is to patrol to control the frequency of movement of the population in public spaces is already the subject of much debate, some citizens fear a next step image of the means undertaken in the aforementioned countries[11].

However, it should be remembered that the collection and processing of personal data has a strengthened regulatory framework since the adoption of the “General Data Protection Regulation (commonly known as “GDPR”) [12], the purpose of which is to give back the governance of their personal data to European citizens, and to guarantee the protection of their privacy. The GDPR has been directly applicable in the Member States of the European Union since May 25, 2018.

At a national level, France has thus modified the provisions of law n°78-17 of January 6, 1978 relating to data processing, files and freedoms (commonly called “Loi Informatique & Libertés”), in accordance with the new regulatory European framework.

In order for the national governments of the Member States to legitimize the use of programs involving the processing of personal data, the latter must comply with the rules and principles formulated by the GDPR, in particular :

• A lawful processing must be based on one of the six legal bases listed in Article 6 of the GDPR, including : consent of the individual, necessity to safeguard their vital interests, necessity for the performance of a mission of interest public or subject to the exercise of public authority.
• The processing must guarantee the principles set out in Article 5 of the GDPR : purpose, transparency, security and confidentiality, retention of data limited to the purpose, proportionality and minimization of data.

It should be specified that under Article 9.1 of the GDPR, arrangements involving the processing of sensitive data, i.e., “data revealing racial or ethnic origin, (…) as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning the sex life or sexual orientation of a natural person”, are in principle prohibited.

The European Data Protection Board recalls, in its statement of March 19, 2020, that processing in the context of a pandemic such as Covid-19 is, by exception of article 9.2 of the GDPR, authorized under certain conditions, and in accordance with national provisions. In this context, it is not necessary to obtain the consent of individuals[13].

On this occasion, the Committee also provides details on a possible use by national governments of devices collecting data from smartphones to monitor and limit the spread of the virus.

In accordance with the Privacy Directive[14], such processing requires the consent of the user or the anonymization of his personal data. The Committee therefore calls on governments to favor the anonymization process.

Following this official communication, eight operators announced their intention to transmit the anonymous geolocation data of their customers, to a group of researchers attached to the European Commission, the aim being to generate statistics by mapping the population and to help health services to anticipate needs[15]. The Commission guarantees users the deletion of personal data at the end of the health crisis.

The anonymization of personal data is a guarantee of technical security making it impossible to re-identify the individual. Thus, the data is no longer personal and the privacy of its subject is preserved.