Page - 209 - in Intelligent Environments 2019 - Workshop Proceedings of the 15th International Conference on Intelligent Environments

”control of the use that is being made of his data[10], or competence to prevent unwanted situations/interference. The principle of data subjects’ free will plays a crucial role since it informs their intention to permit or not to permit the further use of their data by the data controller operating and intelligent (AI) system[11]. For data subjects to be able to give consent, they must be aware of almost everything related to the fate of their data. It is the data controller, surely, who shall inform them prior to obtaining consent (point 3 of Article 5 of the GDPR), so they could assess the risks properly and make a decision. Data controllers information obligation is placed in several parts of the GDPR, but we will focus only on Article 12 in following analysis. If data controllers fail to present true and complete information about the data processing activities, they obviously fail in fulfilling their legal obligations, firstly, the transparency principle. 2.1.1. Transparency Rule Pursuant to Article 12 of the GDPR explaining the conditions of transparency, data sub- jects are given the right to obtain information, for example, on the purposes of the pro- cessing; to request erasure (better known as right to be forgotten), and meaningful in- formation about the logic involved with automated decision making, including profiling activities that data controller processes data for. Presenting meaningful information is an important case since it orders data controllers to somehow explain to the data subjects how the AI system works. Although there are many issues related to purpose limitation by data controllers and data subjects right manage personal data within AI systems, we exclude both instances in order not to extend the scope of this paper. 2.1.2. Meaningful Information Articles 13, 14 and 15 of GDPR entrust data controllers with presenting meaningful in- formation related to data processing activities they carry out including such activities in which the decision is made algorithmically. What constitutes meaningful information has been discussed in literature from several points of view. Wachter et. al. firstly argues that right to be informed within the GDPR is an ex post right which would contravene the the essence of consent, and further stresses that the right to explanation should be inserted in the GDPR to make the rule more consistent and clear [12]. Selbst and Powles [13], on the other hand, strongly emphasize that explanation of meaningful information already is the right to explanation, and meaningful information refers here to any information regard- ing system functionality. Although both views cannot be easily and clearly understood neither from the related articles, nor Recitals, and nor from the EDPS opinions, we think that the GDPR is practically unclear on explaining the concept of meaningful informa- tion. We question, firstly, who should determine the meaningfulness of information the data subject in a personalized (subject-specific) fashion, or other standards should be ap- plied to assess meaningfulness in the eyes of the general public. [14] (This again brings about the issue of relevance interpreted as meaningful what is meaningful information in a particular context, it is also relevant to it.) If the answer is subject-specific mean- ingfulness, then we argue that data subjects have no interest in any complex technical terms specific to the applied AI, and would prefer the simplest and clearest explanation (laymens terms); while other data subjects might prefer more detailed information in line with their level of AI knowledge. (This necessitates a context and subject-dependent as- G.GultekinVarkonyi /Operability of theGDPR’sConsent Rule in Intelligent Systems 209