Governing algorithms in the big data era for balancing new digital rights - designing GDPR compliant and trustworthy XAI systems

This thesis investigates the legal, ethical, technical, and psychological issues of general data processing and artificial intelligence practices and the explainability of AI systems. It consists of two main parts. In the initial section, we provide a comprehensive overview of the big data processing ecosystem and the main challenges we face today. We then evaluate the GDPR’s data privacy framework in the European Union. The Trustworthy AI Framework proposed by the EU’s High-Level Expert Group on AI (AI HLEG) is examined in detail. The ethical principles for the foundation and realization of Trustworthy AI are analyzed along with the assessment list prepared by the AI HLEG. Then, we list the main big data challenges the European researchers and institutions identified and provide a literature review on the technical and organizational measures to address these challenges. A quantitative analysis is conducted on the identified big data challenges and the measures to address them, which leads to practical recommendations for better data processing and AI practices in the EU. In the subsequent part, we concentrate on the explainability of AI systems. We clarify the terminology and list the goals aimed at the explainability of AI systems. We identify the reasons for the explainability-accuracy trade-off and how we can address it. We conduct a comparative cognitive analysis between human reasoning and machine-generated explanations with the aim of understanding how explainable AI can contribute to human reasoning. We then focus on the technical and legal responses to remedy the explainability problem. In this part, GDPR’s right to explanation framework and safeguards are analyzed in-depth with their contribution to the realization of Trustworthy AI. Then, we analyze the explanation techniques applicable at different stages of machine learning and propose several recommendations in chronological order to develop GDPR-compliant and Trustworthy XAI systems.

The right to explanation

This research investigates the use of Artificial Intelligence (AI) systems for profiling and decision-making, and the consequences that it poses to rights and freedoms of individuals. In particular, the research considers that automated decision-making systems (ADMs) are opaque, can be biased, and their logic is correlation-based. For these reasons, ADMs do not take decisions as human beings do. Against this background, the risks for the rights of individuals combined with the demand for transparency of algorithms have created a debate on the need for a new 'right to explanation'. Assuming that, except in cases provided for by law, a decision made by a human does not entitle to a right to explanation, the question has been raised as to whether – if the decision is made by an algorithm – it is necessary to configure a right to explanation for the decision-subject. Therefore, the research addresses a right to explanation of automated decision-making, examining the relation between today’s technology and legal concepts of explanation, reasoning, and transparency. In particular, it focuses on the existence and scope of the right to explanation, considering legal and technical issues surrounding the use of ADMs. The research analyses the use of AI and the problems arising from it from a legal perspective, studying the EU legal framework – especially in the data protection field. In this context, a part of the research is focused on transparency requirements under the GDPR (namely, Articles 13–15, 22, as well as Recital 71). The research aims to outline an interpretative framework of such a right and make recommendations about its development, aiming to provide guidelines for an adequate explanation of automated decisions. Hence, the thesis analyses what an explanation might consist of, and the benefits of explainable AI – examined from legal and technical perspectives.

Internet of healthcare (law): privacy and data protection aspects in an internet of everything

The purpose of this research study is to discuss privacy and data protection-related regulatory and compliance challenges posed by digital transformation in healthcare in the wake of the COVID-19 pandemic. The public health crisis accelerated the development of patient-centred remote/hybrid healthcare delivery models that make increased use of telehealth services and related digital solutions. The large-scale uptake of IoT-enabled medical devices and wellness applications, and the offering of healthcare services via healthcare platforms (online doctor marketplaces) have catalysed these developments. However, the use of new enabling technologies (IoT, AI) and the platformisation of healthcare pose complex challenges to the protection of patient’s privacy and personal data. This happens at a time when the EU is drawing up a new regulatory landscape for the use of data and digital technologies. Against this background, the study presents an interdisciplinary (normative and technology-oriented) critical assessment on how the new regulatory framework may affect privacy and data protection requirements regarding the deployment and use of Internet of Health Things (hardware) devices and interconnected software (AI systems). The study also assesses key privacy and data protection challenges that affect healthcare platforms (online doctor marketplaces) in their offering of video API-enabled teleconsultation services and their (anticipated) integration into the European Health Data Space. The overall conclusion of the study is that regulatory deficiencies may create integrity risks for the protection of privacy and personal data in telehealth due to uncertainties about the proper interplay, legal effects and effectiveness of (existing and proposed) EU legislation. The proliferation of normative measures may increase compliance costs, hinder innovation and ultimately, deprive European patients from state-of-the-art digital health technologies, which is paradoxically, the opposite of what the EU plans to achieve.

Security and privacy of resource constrained devices

The thesis aims to present a comprehensive and holistic overview on cybersecurity and privacy & data protection aspects related to IoT resource-constrained devices. Chapter 1 introduces the current technical landscape by providing a working definition and architecture taxonomy of ‘Internet of Things’ and ‘resource-constrained devices’, coupled with a threat landscape where each specific attack is linked to a layer of the taxonomy. Chapter 2 lays down the theoretical foundations for an interdisciplinary approach and a unified, holistic vision of cybersecurity, safety and privacy justified by the ‘IoT revolution’ through the so-called infraethical perspective. Chapter 3 investigates whether and to what extent the fast-evolving European cybersecurity regulatory framework addresses the security challenges brought about by the IoT by allocating legal responsibilities to the right parties. Chapters 4 and 5 focus, on the other hand, on ‘privacy’ understood by proxy as to include EU data protection. In particular, Chapter 4 addresses three legal challenges brought about by the ubiquitous IoT data and metadata processing to EU privacy and data protection legal frameworks i.e., the ePrivacy Directive and the GDPR. Chapter 5 casts light on the risk management tool enshrined in EU data protection law, that is, Data Protection Impact Assessment (DPIA) and proposes an original DPIA methodology for connected devices, building on the CNIL (French data protection authority) model.

Influencable autonomy and predictable freedom in the IoE

This thesis investigates how individuals can develop, exercise, and maintain autonomy and freedom in the presence of information technology. It is particularly interested in how information technology can impose autonomy constraints. The first part identifies a problem with current autonomy discourse: There is no agreed upon object of reference when bemoaning loss of or risk to an individual’s autonomy. Here, thesis introduces a pragmatic conceptual framework to classify autonomy constraints. In essence, the proposed framework divides autonomy in three categories: intrinsic autonomy, relational autonomy and informational autonomy. The second part of the thesis investigates the role of information technology in enabling and facilitating autonomy constraints. The analysis identifies eleven characteristics of information technology, as it is embedded in society, so-called vectors of influence, that constitute risk to an individual’s autonomy in a substantial way. These vectors are assigned to three sets that correspond to the general sphere of the information transfer process to which they can be attributed to, namely domain-specific vectors, agent-specific vectors and information recipient-specific vectors. The third part of the thesis investigates selected ethical and legal implications of autonomy constraints imposed by information technology. It shows the utility of the theoretical frameworks introduced earlier in the thesis when conducting an ethical analysis of autonomy-constraining technology. It also traces the concept of autonomy in the European Data Lawsand investigates the impact of cultural embeddings of individuals on efforts to safeguard autonomy, showing intercultural flashpoints of autonomy differences. In view of this, the thesis approaches the exercise and constraint of autonomy in presence of information technology systems holistically. It contributes to establish a common understanding of (intuitive) terminology and concepts, connects this to current phenomena arising out of ever-increasing interconnectivity and computational power and helps operationalize the protection of autonomy through application of the proposed frameworks.

Patient data sharing for the improvement of healthcare and medical research: towards a moral duty of patients to share health-related data?

The project answers to the following central research question: ‘How would a moral duty of patients to transfer (health) data for the benefit of health care improvement, research, and public health in the eHealth sector sit within the existing confidentiality, privacy, and data protection legislations?’. The improvement of healthcare services, research, and public health relies on patient data, which is why one might raise the question concerning a potential moral responsibility of patients to transfer data concerning health. Such a responsibility logically would have subsequent consequences for care providers concerning the further transferring of health data with other healthcare providers or researchers and other organisations (who also possibly transfer the data further with others and other organisations). Otherwise, the purpose of the patients’ moral duty, i.e. to improve the care system and research, would be undermined. Albeit the arguments that may exist in favour of a moral responsibility of patients to share health-related data, there are also some moral hurdles that come with such a moral responsibility. Furthermore, the existing European and national confidentiality, privacy and data protection legislations appear to hamper such a possible moral duty, and they may need to be reconsidered to unlock the full use of data for healthcare and research.

Big data and AI applications for health and research. Co-regulation mechanisms as a prosed solution for data protection law issues

Big data and AI are paving the way to promising scenarios in clinical practice and research. However, the use of such technologies might clash with GDPR requirements. Today, two forces are driving the EU policies in this domain. The first is the necessity to protect individuals’ safety and fundamental rights. The second is to incentivize the deployment of innovative technologies. The first objective is pursued by legislative acts such as the GDPR or the AIA, the second is supported by the new data strategy recently launched by the European Commission. Against this background, the thesis analyses the issue of GDPR compliance when big data and AI systems are implemented in the health domain. The thesis focuses on the use of co-regulatory tools for compliance with the GDPR. This work argues that there are two level of co-regulation in the EU legal system. The first, more general, is the approach pursued by the EU legislator when shaping legislative measures that deal with fast-evolving technologies. The GDPR can be deemed a co-regulatory solution since it mainly introduces general requirements, which implementation shall then be interpretated by the addressee of the law following a risk-based approach. This approach, although useful is costly and sometimes burdensome for organisations. The second co-regulatory level is represented by specific co-regulatory tools, such as code of conduct and certification mechanisms. These tools are meant to guide and support the interpretation effort of the addressee of the law. The thesis argues that the lack of co-regulatory tools which are supposed to implement data protection law in specific situations could be an obstacle to the deployment of innovative solutions in complex scenario such as the health ecosystem. The thesis advances hypothesis on theoretical level about the reasons of such a lack of co-regulatory solutions.

Applicazione di strumenti di Lean Warehousing per il miglioramento di processi di magazzino: il caso studio di Dorelan B&T S.p.A.

La filosofia del lean thinking ha dimostrato in numerose occasioni, dalla sua nascita ad oggi, di poter apportare reali e consistenti benefici all’interno degli ambienti aziendali rivoluzionando a volte non solo il modo di produrre delle aziende ma anche quello di pensare, generando un profondo cambiamento culturale. La filosofia lean nasce come esigenza di riadattamento del sistema produttivo in contrapposizione a quello della mass production per questo molti dei testi di riferimento storici sul lean thinking citano prassi e casi aziendali che toccano esclusivamente l’ambito della produzione, tuttavia tale ambito rappresenta solamente uno dei tanti che si possono osservare in ambito aziendale. Successivamente si è compreso come il lean thinking rappresenti in realtà un sistema, composto da: principi, tecniche, metodi e strumenti in grado di garantire il miglioramento dei processi. Si tratta di fatto di un framework adattabile alle diverse funzioni aziendali e che per massimizzare la propria efficacia deve essere assimilato dall’intera organizzazione e non solo dall’ambiente produttivo. Negli anni infatti l’aggettivo “lean” è stato accostato agli ambiti più vari: lean sales, lean accounting, lean services, lean managment, lean organization, lean enterprise, lean office e molti altri. Tuttavia raramente ci si imbatte nel termine “lean warehousing” e ancora più raramente ci si imbatte in casi di applicazioni di strumenti lean in ambito logistico o a testi di riferimento che trattino l’argomento. In un mercato sempre più̀ competitivo è fondamentale per qualsiasi azienda avere una logistica efficiente e flessibile che consenta di offrire un alto livello di servizio per il cliente. Il magazzino rappresenta il punto di arrivo e di partenza per ogni flusso logistico e data la rilevanza che ancora oggi la sua funzione detiene per le aziende risulta fondamentale per il successo dell’interno sistema implementare anche in questa divisione la filosofia lean.

El problema de una sensibilización del campo de la moralidad en la filosofia trascendental de Kant

La problemática de la investigación se plantea en el contexto de la filosofía trascendental de Kant, en relación al modo en que es en general posible para nosotros representarnos el ámbito de la moralidad. Nuestra comprensión natural o preteórica del funcionamiento del lenguaje parece llevarnos a entender el significado de nuestras palabras en términos de la relación que se establece entre el signo lingüístico y el objeto: nuestros términos lingüísticos están en el lugar del objeto extralingüístico a que refieren y que constituye su significado. A nuestro modo de ver, la afirmación kantiana relativa a que todo nuestro conocimiento comienza con la experiencia, es decir, con aquello que procede de los sentidos, parece estar apuntando a esta intuición fundamental. Ahora bien, la cuestión que cabe plantearse es: de acuerdo con este modelo de significación, ¿cuál es el significado de nuestros términos morales? Si, con Kant, aceptamos que el concepto de deber moral exige el cumplimiento (u omisión) incondicionado de una acción y que, precisamente por las exigencias de universalidad y necesidad que le son inherentes, tal concepto es inderivable de la experiencia, cabe preguntarse cuál es el significado del concepto de deber en sentido moral (y, en general, de los términos morales) y de qué manera somos capaces de representárnoslo. Mi investigación ha pretendido esclarecer precisamente en qué sentido debe entenderse la afirmación kantiana de que en la reflexión sobre la corrección moral de nuestras acciones, para representarnos las exigencias de universalidad y necesidad que son propias del concepto de deber moral, nos servimos analógicamente del concepto de naturaleza, así como analizar la plausibilidad de la propuesta kantiana misma.

Las Acciones Básicas del Esfuerzo como recurso técnico en la pedagogía actoral: sus resonancias

Investigación sobre la aplicación didáctica en el campo de la Interpretación actoral de 3 aspectos fundamentales del trabajo de Rudolf Von Laban - El arte dramático como arte del movimiento. - La necesidad del entrenamiento del instrumento del actor. - La importancia del trabajo sobre los factores de esfuerzo como herramienta fundamental del actor y su íntima relación con las actitudes interiores. La técnica interpretativa propuesta recorre un camino que va desde lo físico para conectar con procesos internos del alumno (las resonancias), canalizando sus posibilidades expresivas hacia un lenguaje gestual-vocal creativo que trascienda la expresión cotidiana.

Reconfigurando espacios : el Grupo XIX de Teatro ya la renovación del escenario teatral en São Paulo

Considerando las últimas tendencias teatrales ocurridas en la ciudad de São Paulo (Brasil) que culminaron en la renovación del escenario teatral en la últimas dos décadas, esta investigación tiene como enfoque central entender cómo la ocupación y/o utilización de determinados espacios urbanos y las relaciones generadas por este entorno influencian y/o determinan la manera de producción artística de un grupo teatral. Para eso son investigados los procedimientos creativos del Grupo XIX de Teatro (São Paulo, 2000), desde su organización interna, construcción dramatúrgica, escénica y de lenguaje, partiendo del análisis del proceso de sus dos primeros montajes: Hysteria e Hygiene.

La cortesía en la publicidad del Tercer Sector: recursos gramaticales y fónicos en español y en inglés

En este trabajo se analizan de manera contrastiva los mecanismos lingüísticos y fónicos de la cortesía en la publicidad convencional y en la publicidad de las organizaciones del Tercer Sector o ONG. A su vez también se analizan las diferencias y similitudes entre los mecanismos de cortesía utilizados en el lenguaje publicitario en español y en inglés

Les partícules modals de la llengua alemanya i l’anàlisi del seu ús comparant el llenguatge oral real i el fingit

Resum: El treball està enfocat en les anomenades “partícules modals” de la llengua alemanya. La part teòrica inclou informació extreta de diferents fonts bibliogràfiques i a la part pràctica se n’analitza l’ús a partir d’un exercici elaborat amb fragments del guió de dues pel·lícules (llenguatge oral fingit) i la col·laboració d’estudiants de diferents parts d’Alemanya.

Bola de Drac: Doblatge, influència i cançons. Anàlisi del procés de doblatge, la influència sociaI, el llenguatge i elaboració de les cançons de Bola de Drac

El meu treball de fi de grau gira al voltant de la sèrie Bola de Drac, doblada al català i emesa a TVC des de l’any 1990. Primer de tot, he fet un recorregut per l’arribada de l’anime i de Bola de Drac a Catalunya. A continuació, parlo del doblatge en general i, en concret, de la sèrie, posant especial atenció al procés de traducció, revisió i ajust. El treball també pretén posar en relleu la influència de la sèrie a la societat catalana, amb especial èmfasi en el seu llenguatge. La següent part del treball tracta la traducció i composició musical de les cançons de Bola de Drac, primer explicant-ne la seva importància i, tot seguit, fent una anàlisi de quatre de les cançons de la sèrie, comparant amb les originals el contingut semàntic de les lletres i la composició musical. Finalment, a l’annex trobareu entrevistes a professionals relacionats amb Bola de Drac i una enquesta realitzada a 1.832 persones relacionada amb la influència i les cançons de la sèrie.