By Carrie Cox

The breakneck pace of AI development is an unprecedented test for legal systems, but better proactive data protection and governance must be central to any regulatory response.

That’s the advice of Marco Rizzi, an Associate Professor from UWA Law School and an expert in risk regulation and the law’s intersection with technology.

Associate Professor Rizzi said the recent review of the Privacy Act 1988 by the Attorney-General’s Department was a welcome first step in bringing Australia up to speed in the area of data protection.

“AI feeds off data and if the way that data is regulated is frankly antiquated, then you’re immediately on the back foot when it comes to governing AI,” he says.

“Privacy and data protection are the bedrock on which you can build governance mechanisms, but Australia has been lagging in this area.”

Associate Professor Rizzi says the issue of consent — the agreement given by an individual for the collection and processing of personal information — has been largely stepped around for a long time.

“We give up this consent every day, every time we use the Internet. We click ‘okay’ — we just want to get to the thing and move on. Because what’s the alternative?

“That’s been a massive problem for a very long time and it’s important not to overstate what individual consent can do in these situations.”

In the European Union, the General Data Protection Regulation — a legal framework still considered successful in its fifth year of enactment— provides a number of ways that individuals can better exercise data consent, including a default acceptance of minimal permissions with the option to add on more.

Associate Professor Rizzi believes this opt-in approach has merit but still places too much regulatory expectation on individuals.

“Personally, I think we need more regulation about what type of data collection is permitted at a top level because putting the burden on individuals is essentially ignoring the problem and it has been an ineffective way of regulating data collection and sharing,” he says.

The EU is also set to introduce the AI Act, the world’s first comprehensive law governing artificial intelligence. Part of its charter is to impose risk rankings on different types of AI systems and applications.

Associate Professor Rizzi says while the appetite for overarching governance over AI is growing — in Australia there have been calls for appointing an independent AI Commissioner, much like a Therapeutic Goods Administration — such action is not a cure-all.

Privacy and data governance are the bedrocks on which you can develop further protections, but Australia has been lagging in this area.

Associate Professor Marco Rizzi, UWA Law School

 

“There are certainly merits to having overarching rules and independent bodies that oversee the application of AI, especially when it comes to use by the government, but we also need to look more broadly at our regulatory regimes across the board and upskill them,” he says. “We need sector-specific solutions as well as overarching legislation and principles.”

As pressing as the need for legislation to keep pace with AI development is the potential for AI to reshape some legal processes, particularly cumbersome and low-skill activities, but Associate Professor Rizzi advocates a cautious approach to any procedural change.

“There is a lot of hype around what AI can do but then there is the reality that we’re not as advanced as we seem to think, and the risk then is to trust AI with too much,” he says. “In sentencing, for example, it is increasingly common for judges in North America and even in some parts of Australia to use AI models for advice on proper sentencing and the risk of reoffending — I think that is potentially very risky if you don’t know how that model has been trained.

“We have this idea about removing biases in the law, particularly when it comes to judgment, but the fact is there are no ‘clean’ datasets. AI is always trained on human behaviours, ideas and data.

“Giving (legal decision-making) over to a machine might cut costs and speed things up, but is cost-effectiveness a value that should override others? I personally don’t think so.”

Read the full issue of the Winter 2024 edition of Uniview [Accessible PDF 12MB]