Seite - 207 - in Intelligent Environments 2019 - Workshop Proceedings of the 15th International Conference on Intelligent Environments

voices and faces, process languages, make or support decisions, guide an interaction with human in a personalized way or [4] even in a social and an emotional way. People often make decisions based on different criteria: (i) personal experience or knowledge, (ii) based on an analysis of several external conditions, (iii) processing and extracting meaning out of data is at the core of human decision-making processes. AI obviously simulates human decisional patterns in many aspects also in decision-making: it is able to exhibit signs of rational thinking, it is capable to adapt to a detected change in circumstances and it is able to engage in autonomous actions based on the above. AI’s data collection and processing ability is based either on the past data that is used for initial training purposes, or on new data that it collects and analyzes itself as an outcome of its learning curve [5]. When it comes to defining what AI is, the instinctive answer is that there is no single definition. However, ones understanding of what an AI is reflect their approach to this topic. This is demonstrated by the example of software engineers who define technical terms very differently from lawyers, but the same is true vice versa for legal terms in this realm (e.g. liability, damages, notions of self, the human concept, rights and obli- gations). According to the EU [6], AI is a system that displays intelligent behaviour by analysing its environment and taking action, with some degree of autonomy, to achieve specific goals (emphasis added). Although the definition was later expanded enormously [7], the new definition was adopted after the GDPR entered into force, and is rather an ethical concept, not necessarily a legal one (with the only legal element of the notion being degree of autonomy). This means that at the time of drafting the GDPR, EU law- makers did not give enough emphasis to the AIs undeniable relationship with data and Machine Learning, but rather focused on the intelligence and autonomy aspects of the AI systems. Furthermore, this definition excludes AIs learning ability, but in turn fo- cuses on the outcome (the action) and its goal-driven behavior to generate this outcome. Such a generic definition reflecting the EUs position towards AI, excluding the two most important aspects of AI applications (data processing and ML) might be the reason why the GDPR would fall short regarding its applicability to AI systems, as we will present in the following sections. Certainly, more personal(ized) services mean sharing more personal data required for AI systems and people will not be afraid of sharing their data with a machine in exchange for said services [8] customized to them. In this paper, we intend to cover AI systems designed for personal(ized) use to manage peoples monotonous daily activities. We first establish the possible legal basis for operating such systems in the GDPR. Then we discuss how difficult it would be to comply with the GDPRs certain principles and provisions since no specific guidelines are designed for the GDPRs implementation on AI technologies. 2. Consent as a Legal Basis What might be the applicable legal basis enabling an AI system to process data and make predictions? The answer is quite easy. As we focus on the EU legal framework in this paper, the GDPR is the only applicable law in this domain. The first question is, however, which legal bases within the GDPR could permit data controllers to operate their AI system? G.GultekinVarkonyi /Operability of theGDPR’sConsent Rule in Intelligent Systems 207