Search papers, labs, and topics across Lattice.
This paper critiques existing data protection frameworks for AI, highlighting their failure to address the risks of unreliable inferences even when data practices are legitimate. It proposes a structured regulatory framework that prioritizes the validity of AI inferences as a prerequisite for deployment approval, challenging the current EU AI Act's risk-based approach. By grounding this framework in the principle of informational self-determination, the authors advocate for a governance model that includes AI-specific validity assessments and ongoing monitoring of deployed systems.
Validity of AI inferences should be a non-negotiable condition for deployment, not just an afterthought in regulatory frameworks.
Artificial intelligence (AI) systems increasingly mediate decisions affecting individuals and societies. Existing data protection frameworks address certain privacy-related harms, particularly those arising from data leakage, re-identification, and profiling. However, they inadequately capture a more fundamental risk: unreliable or unjustified inference produced by AI systems even when data collection and processing are legitimate. This article argues that modern AI raises distinct concerns of construct validity, confounding, representativeness, distribution shift, and fairness trade-offs that require specialised regulatory attention. In the context of AI, transparency and explainability acquire distinct and significantly more challenging meanings than in conventional software. A substantial body of work in critical data studies and the measurement-theoretic literature has diagnosed these epistemological limitations. This article's contribution is to derive from that diagnosis a structured and operationalizable regulatory framework. We argue that validity of inference should function as a precondition for proportionality assessment and deployment approval --- a move that existing frameworks, including the EU AI Act's domain-based risk tiers, do not make. We ground this argument in the constitutional principle of informational self-determination articulated in the Indian Supreme Court's \emph{Puttaswamy} judgement, extending its reach from data collection to the legitimacy of use of data. Effective governance must therefore incorporate AI-specific validity assessment, post-deployment monitoring, and proportionality assessments grounded in structured articulation of both epistemic risk and potential benefit.
