The European Union has recently considered appropriate to analyze the topic of personal data processing through artificial intelligence (AI).
In particular, high-risk AI systems have been identified, with reference to the type of processed data and the high degree of threat to which the related rights and freedoms of the individual concerned are subjected.
In this category we found also those AI systems that process data related to health and the use of heath services.
AI Act: the proposal of the European Parliament and Counsil
The European Parliament and Counsil have recently issued a proposal of Regulation, the AI ACT, which aims to provide harmonized rules on AI at European level, recognizing the particular sensitivity of certain type of data, such as health data.
Moreover, such proposal aims at introducing, as additional tool to safeguard health data from AI systems, the obligation for the data processor to carry out a preventive impact evaluation on protection in order to analyze the effective and uniform protection of rights and fundamental freedoms of the interested parties related to the processing of their personal data in a health context.
On the path of the virtuous goal placed at European level, the Italian DPA, competent for the protection of personal data, drew up a decalogue giving an account of the fundamental guiding principles which will regulate the AI activity in relation to health data.
In particular, the Italian DPA recalled preliminarily the general principles, already acknowledged in the area of data processing, integrating them with further ad-hoc principles in relation to the specificity of the processed data.
Health data and artificial intelligence: the Decalogue of the Italian DPA
The Italian DPA explained the three main principles in order to protect the health data of the interested parties and guarantee their correct processing by the algorithms and AI tools when performing the tasks of relevant public interest, such as the health service.
Principle of knowability
Such principle establishes the right of the data subject to be informed about the existence of decisional processes based on automatized processing and about the logic used inside the same processes in order to understand it. The present principle seems to be the expression of the broadest general principle related to the ethically correct and transparent processing in force in the field of personal data processing.
Principle of non-exclusivity of the algorithmic decision
The present principle provides that in the decision process, human intervention must be guaranteed in order to control, validate or deny the automatic decision proposed by the AI system. On this regard, the data processing authorities, both at Community and national level, recognized the irreplaceability of human supervision and the need to prevent data subjects from being subjected to merely automated processing. Such direction is justified by the fact that the accuracy of the predictions of AI systems is not always guaranteed, but depends on the quality and precision of the information provided to the system for the relating training.
Therefore, especially during the AI systems training phase, it is necessary that the role of man and, in this case, the health care professional, be maintained as the central role.
Principle of algorithmic non-discrimination
According to this principle, the data processor must use reliable and periodically updates AI systems, by implementing suitable technical and organization measures in order to minimize the risk of errors due to technical and/or human causes, given the potential discriminatory effects that an inaccurate data processing on health status, or data related to it, can determine on the single individuals. This principle falls into the broader principle of accuracy, according to which the data processing must guarantee that the processed data is correct and updated, in order to provide an efficient and fair performance of services.
Conclusions
In light of the above, it is possible to confirm the importance of the issue relating to personal data processing by AI systems in connection to health services. If on the one hand, the choice to use AI in such field seems to be very virtuous, on the other it requires a particular attention with reference to the relating implementation, given the high sensibility of the concerned data. Therefore, the strict observance of the above-mentioned principles and of the measures outlined appears to be essential.
Elena Bandinelli