On October 4, 2022, the White House Office of Science and Technology Policy (OSTP) issued the Blueprint for an AI Bill of Rights (the Blueprint)¹, which lays out guidelines for companies to use to protect the public from invasive and harmful developments that may be posed by artificial intelligence (AI) systems. As automated systems develop, they offer the possibility for positive advancements – but unchecked, AI has led to unconsented surveillance, discrimination from algorithmic bias, and other foreseeable harms, states the OSTP. The Blueprint is intended to “help guide the design, development, and deployment of artificial intelligence and other automated systems so that they protect the rights and democratic values of the American public.”²

After a yearlong development process, the OSTP outlined five principles to safeguard the public:

• Safe and effective systems – Automated systems should undergo extensive testing prior to deployment to determine potential risks and options for mitigating such risks. Businesses should consult experts and have diverse input to ensure the system is effectively designed for the intended goal. Systems should be redesigned when the design is harmful, or the AI system should not be deployed if it cannot be improved. Independent evaluators should be given access to automated systems to evaluate and document their safety and effectiveness to ensure the systems are operating as intended.
• Algorithmic discrimination protections – Automated systems should be designed in an equitable manner. The public should not face algorithmic discrimination based on any type of legally protected classification like race, ethnicity, sex, gender identity, or religion. AI systems should be proactively designed and assessed to protect against discrimination. AI systems should receive “algorithmic impact assessments” from independent evaluators on the potential disparate impacts.
• Data privacy – There should be built-in protections to shield the public from “abusive data practices” and people should have control over how their personal data is used by AI systems. Data collection should conform to reasonable expectations and only data that is strictly necessary for a specific context should be collected. The description of the intended use of the AI-derived data should be explained in non-technical language. Any consent request should be brief, be understandable in plain language. Enhanced protections and restrictions on data and inferences related to sensitive information collection and processing may be necessary. In addition, individuals should be free from unchecked AI-enabled surveillance and monitoring. 
• Notice and explanation – People should be notified when AI is in use and told the extent of that use. The business should also explain how and why the particular outcome was reached and if any non-AI factors contributed to the outcome.
• Human alternatives, consideration, and fallback – The public should have the option to reject the use of AI and to choose a human alternative, where appropriate. Individuals also should have access to a person who can quickly consider and remedy any problems they encounter in relation to AI systems.

The Blueprint points out that it is fully consistent with the Organization for Economic Co-operation and Development’s (OECD) 2019 Recommendations on Artificial Intelligence, which the United States adopted and which identified principles and recommendations for “responsible stewardship of trustworthy AI.”³ The Blueprint also aligns with earlier Executive Orders on AI⁴ and with other AI principles, such as the National Association of Insurance Commissioners (NAIC) Principles on Artificial Intelligence, except that the Blueprint is sector neutral.⁵ 

The principles outlined in the Blueprint are non-binding and will remain discretionary unless enacted into laws or regulations. Indeed, the Blueprint states that future sector-specific guidance “will likely be necessary.”⁶ The OSTP Deputy Director for Science and Society, Dr. Alondra Nelson, said the Department of Labor is already “’leaning into their ability to compel reporting’ from companies about workplace surveillance using AI.”⁷ Although some criticize the Blueprint as being merely a set of voluntary guidelines, the White House intends it to demonstrate its commitment to the responsible development of artificial intelligence technology in a way that protects civil and digital rights.

Notably, the Blueprint does not define artificial intelligence,⁸ electing to use the term “automated system” instead, which it defines broadly as “any system, software, or process that uses computation as whole or part of a system to determine outcomes, make or aid decisions, inform policy implementation, collect data or observations, or otherwise interact with individuals and/or communities.”⁹ No matter how it is described, artificial intelligence is about making automated decisions using vast data sets. 

There are two areas in which using AI to collect and analyze data and make decisions about individuals autonomously is especially impactful: surveillance and predictive systems.

Surveillance

Surveillance is time and labor-intensive. AI is already being used to expedite the process and expand its scope. License plate readers, facial recognition, and even gait recognition software is widely used to observe and profile individuals. AI in these scenarios is being used to conduct activities that have traditionally been conducted by human operators. However, AI can also be used to expand what can be surveilled by observing behavior that is not easily observable by human operators. For example, AI can be used to fingerprint a computer user based on their keystroke patterns, mouse usage, screen time, and other factors that are traditionally difficult or impossible to observe by a person. The confluence of surveillance and privacy rights becomes especially salient in non-public areas, including the workplace, where continuous monitoring combined with AI is already being used to identify insider threats in the Department of Defense. The federal government may seek to require that the guidance published in the Blueprint be followed in spheres that it regulates, such as government contracting and interstate commerce. If so, government contractors and other entities engaged in commercial surveillance may need to prepare to be compliant with any AI regulations following the Blueprint.¹⁰

Predictive Systems

Ascertaining what a person will do or how they will react to a situation has been a challenge that humankind has attempted to resolve for its entire existence. AI, which can parse vast data sets at high speed, is pushing us closer to making that a reality. Some consumer data privacy laws have addressed this concern head-on, allowing consumers to opt out of what they call “automated decision-making technology” that is intended to create a profile of a consumer. Organizations that use AI to profile consumers (most frequently used to serve targeted ads) would, as the principles in the Blueprint are enacted into law or regulation, likely need to tailor their practices to enable users to exercise their rights under the principles.

Future Direction

It remains to be seen whether Congress will pass legislation and/or federal agencies will issue regulations based on the principles articulated in the Blueprint, by, for instance, requiring annual audits of an entity’s algorithms that make eligibility decisions to determine whether the practices result in unlawful discrimination and/or have a disparate impact. Some states in some sectors¹¹ have already taken the lead.

__________________________________________

¹ The White House: OSTP, Blueprint for an AI Bill of Rights: Making Automated Systems Work for the American People, The White House, https://www.whitehouse.gov/ostp/ai-bill-of-rights/ (the Blueprint).

² Press Release, The White House: OSTP, FACT SHEET: Biden-⁠Harris Administration Announces Key Actions to Advance Tech Accountability and Protect the Rights of the American Public, The White House (Oct. 4, 2022), https://www.whitehouse.gov/ostp/news-updates/2022/10/04/fact-sheet-biden-harris-administration-announces-key-actions-to-advance-tech-accountability-and-protect-the-rights-of-the-american-public/. 

³ OECD, Recommendation of the Council on Artificial Intelligence, OECD Legal Instruments (adopted on May 21, 2019), https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449. 

⁴ See Blueprint at 9, citing to Executive Order 13960 on Promoting the Use of Trustworthy Artificial Intelligence and Executive Order 13985 on Advancing Racial Equity and Support for Underserved Communities Through the Federal Government.

⁵ See National Association of Insurance Commissioners (NAIC), Principles on Artificial Intelligence (AI) (adopted Aug. 14, 2020), https://content.naic.org/sites/default/files/inline-files/AI%20principles%20as%20Adopted%20by%20the%20TF_0807.pdf. 

⁶ The Blueprint at 2.

⁷ Christiano Lima, White House unveils ‘AI bill of rights’ as ‘call to action’ to rein in tool, The Washington Post (Oct. 4, 2022), https://www.washingtonpost.com/politics/2022/10/04/white-house-unveils-ai-bill-rights-call-action-rein-tool/. 

⁸ The US Chamber of Commerce criticized the Blueprint’s definition of “automated systems” as being so broad it will not assist in harmonizing definitions of AI among international allies.

⁹ Blueprint at 10.

¹⁰ On August 11, 2022, the Federal Trade Commission (FTC) filed an Advance Notice of Proposed Rulemaking (ANPR) to explore rules to “crack down on harmful commercial surveillance and lax data security.” The FTC is seeking public comment on the harms stemming from commercial surveillance and whether new rules are needed to protect people’s privacy and information. In the ANPR, the FTC explained its authority under Section 5 of the FTC Act to propose a rule defining unfair or deceptive acts to include some commercial surveillance practices. The FTC also recognized its ability to enforce sector-specific laws that relate to commercial surveillance practices, including the Fair Credit Reporting Act, the Children’s Online Privacy Protection Act and others.

¹¹ See, e.g., Colorado’s SB 21-169 “Protecting Consumers from Unfair Discrimination in Insurance Practices,” that requires insurers to test their big data systems - including external consumer data and information sources, algorithms, and predictive models - to ensure they are not unfairly discriminating against consumers on the basis of a protected class.

[View source.]