"Grey areas" of legal regulation of AI and personal data processing

Abstract

In the modern period, artificial intelligence is often used to perform tasks that are in one way or another related to the processing of personal data. According to current legislation, any operations with personal data must be carried out openly, transparently, and in proportion to defined purposes. At the same time, AI systems are characterized by the "black box" phenomenon, which consists in the fact that the way they function is poorly understood and causes situations that may not have a clear legal solution – they occur in a "grey area". It is consi­dered why the issue of personal data protection is becoming particularly acute due to the development of artificial intelligence and related technologies. The study is based on the hypothesis that the lack of transparency regarding the impossibility of explaining to the data subject what specific information about him and in what way the AI system will use it is the only factor violating the personal data protection. To test this, common applications of AI were analyzed: profiling, biometric identification, content generation, as well as the procedure of training AI systems, which is associated with web scraping as a method of collecting information from websites. Since the mentioned methods are mostly designed by neologisms, their essence is described using the etymological method. The concept of personal data processing in the legislation of countries around the world has been studied, and it has been shown according to which criteria regarding the pro­cessing object one can assess processing methods for potential danger. The results of the study lead to the conclusion that the processing of personal data by AI systems may pose an unacceptable risk, violate the requirement for personal data accuracy, create threats to the enhanced protection of "sensitive data" and information about children, occur without the awareness of data subject, and also create a situation where personal data is stored significantly longer than necessary for the defined purpose and when it cannot be corrected (exercise the right to rectification). The factors that cause violations of personal data protection, aside from the lack of transparency, include the inability to ensure full control over the AI operational processes, active interaction with other systems and networks, as well as insufficient protection against data leaks, unauthorized access, and other threats.