IJDSBDA International Journal of Data Science and Big Data Analytics 2710-2599 SvedbergOpen ijdsbda-1-3-002 10.51483/IJDSBDA.1.3.2021.6-14 Research Paper The Right Not to be Subject to Automated Individual Decision-Making/Profiling Concerning Big Health Data. Developing an Algorithmic Culture IglezakisIoannis 1 * TrokanasTheodoros 2 KiortsiPanagiota 3 1Aristotle University of Thessaloniki, Thessaloniki 541 24, Greece. E-mail: iglezakis@hotmail.com 2Aristotle University of Thessaloniki, Thessaloniki 541 24, Greece. Email: trokanas@mycosmos.gr 3Kapodistrian University of Anthens, Greece. Email: kiortsip@gmail.com *Corresponding author: Ioannis Inglezakis, Aristotle University of Thessaloniki, Thessaloniki 541 24, Greece., E-mail: iglezakis@hotmail.com 11 2021 1 3 6 14 Abstract

This paper examines the legal issues arising from the collection and processing of Health Big Data in the light of the European legislation for the protection of personal data of natural persons, placing emphasis on the General Data Protection Regulation, i.e., Regulation 679/ 2016. Whether Big Health Data are “personal data” or not is really the heart of the matter. The legal ambiguity is compounded by the fact that, even though the processing of Big Health Data is premised on the de-identification of the data subject, the possibility of a combination of Big Health Data with other data circulating freely on the web or from other data files cannot be excluded. Moreover, data subject’s rights, e.g., the right not to be subject to a decision based solely on automated processing, are heavily impacted by the use of AI, algorithms and technologies that reclaim health data for further use, resulting in sometimes ambiguous results that have substantial impact on individuals. On the other hand, as the Covid-19 pandemic has revealed, Big Data analytics can offer crucial source of information. In this respect, this paper identifies and applies the legal provisions to algorithms used in big health data processing, providing an interpretation to address risks to data subject’s rights, while embracing the opportunities that Big Health Data has to offer.

 Keywords Big data Health data Genetic data Privacy DGPR Pocessing principles Algorithm accountability Automated profiling References AlhadeffJ.Van AlsenoyB.DumortierJ. (2012). The Accountability Principle in Data Protection Regulation: Origin, Development and Future Directions, In D. GuagninD.HempelL.IltenC. (eds.). Managing Privacy through Accountability, 54, Palgrave Macmillan. Article 29 Data Protection Working Party (2010). Opinion 3/2010 on the principle of accountability, adopted on July 13. Article 29 Data Protection Working Party. (2018). Guidelines on Automated Individual Decision-making and Profiling for the Purposes of Regulation 2016/67, Adopted on October 3, 2017 as last Revised and Adopted on February 6. Article 22, In C. KunerL.A. BygraveC. DockseyL. Drechsler (ed.) (2020). The EU General Data Protection Regulation (GDPR) A Commentary, Oxford University Press, 2020, Under C 3, p 533. CohenI.G.LynchH.F.VayenaE.U. (2018). Gasser, Introduction, In CohenI.G.LynchH.F.VayenaE.U. (eds.). Big Data, Health Law, and Bioethics, 8, Cambridge University Press, p. 1. Convention 108+ of the Council of Europe for the protection of individuals with regard to the processing of personal data, as amended by Protocol CETS No. 223. CriadoN.SuchJ. (2019). Digital Discrimination in: An Introduction, In YeungK.LodgeM. (eds.). Algorithmic Regulation, Oxford University press, p. 11. DashS.ShakyawarS.K.SharmaM. et al. (2019). Big Data in Healthcare: Management, Analysis and Future Prospects. J. Big Data, 6, 54, https://doi.org/10.1186/s40537-019-0217-0 Directive 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA European Economic and Social Committee. (2017). The Ethics of Big Data: Balancing Economic Benefits and Ethical Questions of Big Data in the EU Policy Context, p. 33, Under 5.1.2, available at https://www.eesc.europa.eu/sites/default/files/resources/docs/qe-04-17-306-en-n.pdf. European Group on Ethics in Science and New Technologies. (2018). Statement on Artificial Intelligence, Robotics and ‘Autonomous’ Systems, 15–20, Brussels. European Parliament (2017). Committee on Civil Liberties, Justice and Home Affairs, Report on Fundamental Rights Implications of Big Data: Privacy, Data Protection, Non-discrimination, Security and law-enforcement (2016/2225(INI)), 20 February 20, Under A. Evidently, the proposed US Bill Reflects the Spirit of the Provisions of Article 35 of Regulation 2016/679, Article 39 of Regulation 2018/1725, and Article 27 of Directive 2016/680. FavarettoM., et al. (2019). Big Data and Discrimination: Perils, Promises and Solutions. A Systematic Review. J Big Data, 6, available online https://journalofbigdata.springeropen.com/articles/10.1186/s40537-019-0177-4#citeas HarrisonJ. (2011). Human Rights Measurement: Reflections on the Current Practice and Future Potential of Human Rights Impact Assessment, Journal of Human Rights Practice, 3(2), 162–187, available at https://doi.org/10.1093/jhuman/hur011 Hellenic Republic National Bioethics Commission, Opinion, Big Data in Health, p. 5, available at http://www.bioethics.gr/images/pdf/GNOMES/OPINION_Big_Data_FINAL_EN.pdf. International Standards on the Protection of Personal Data and Privacy, (2009). The Madrid Resolution-Joint Proposal for a Draft of International Standards on the Protection of Privacy, p.13. https://edps.europa.eu/sites/edp/files/publication/09-11-05_madrid_int_standards_en.pdf IsaakJ.HannaM.J. (2018). User Data Privacy: Facebook, Cambridge Analytica, and Privacy Protection, In Computer, 51(8), 56–59. JørgensenR. et al. (2019). Chapter 12: Exploring the role of HRIA in the information and Communication Technologies (ICT) sector, In GötzmannN. (ed.), Handbook on Human Rights Impact Assessment, Research Handbooks on ImpactAssessment Series, 205–218, Edward Elgar. KaltheunerF.BiettiE. (2018). Data is Power: Towards Additional Guidance on Profiling and Automated Decisionmaking in the GDPR, Journal of Information Rights Policy and Practice, 2(2), 8. MittelstadtB.D.FloridiL. (2016). Introduction, In MittelstadtB.D.FloridiL. (Ed.), The Ethics of Biomedical Data, Law Governance and Technology Series, 29(Springer), 2. OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, Recommendation of the Council of Organisation for Economic Co-operation and Development of 23 rd September 1980-Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. https://www.oecd.org/sti/ieconomy/oecdguidelinesontheprotectionofprivacyandtransborderflowsofpersonaldata.htm#recommendation PormeisterK. (2017). The GDPR and Big Data: Leading the Way for Big Genetic Data?, In SchweighoferE.LeitoldH.MitrakasA.RannenbergK. (Eds). Privacy Technologies and Policy. APF. Lecture Notes in Computer Science, 10518(Springer), 13. StephensZ.D. et al. (2015). Big Data: Astronomical or Genomical? PLoS Biol., 13(7), e1002195, 1. TsamadosA.AggarwalN.CowlsJ. et al. (2021). The Ethics of Algorithms: Key Problems and Solutions. AI&Soc. VealeM.BrassI. (2019). Administration by algorithms Public Management Meets Public Sector Machine Learning in K YeungM Lodge (ed.), Algorithmic Regulation, 133–138, Oxford University Press. VoigtP.von dem BusscheA. (2017). The EU General Data Protection Regulation (GDPR). A Practical Guide, 31, Springer. YeungK.LodgeM. (2019). Algorithmic Regulation: An Introduction, In YeungK.LodgeM. (eds.), Algorithmic Regulation, 14–16, Oxford University Press.