Artificial Intelligence and Sensitive Inferences: New Challenges for Data Protection Laws

Abstract

Data protection laws are under strain to respond to the continuing advances in information and communications technologies, including now AI technologies. How strictly they regulate the handling of personal information and its effects for human identity varies between jurisdictions, despite efforts to achieve international harmonisation. One such area of disparity between existing data protection laws is on the question of whether some types of data, designated ‘sensitive’, or ‘special’, should be subject to stricter legal or practical protection. In this article, we consider the basis on which some categories of data are accorded enhanced protection as sensitive (or special) in modern data protection regimes, and why the categories themselves may vary between jurisdictions. The blurring of the boundaries between ‘ordinary’ personal data and these sensitive categories through the potential to draw inferences from intensive data processing facilitated by developments in artificial intelligence (and more specifically machine learning), raises important new questions for policymakers.

Keywords: Privacy, data protection, sensitive data, inferences, GDPR, CCPA

JEL Classification: K10, K19, K23, K29, K30