Within the framework of the June 15, 2023 submitted parliamentary initiative 23.438 (“Adapt data protection legislation and supplement partially automated decisions based on artificial intelligence (AI)”), the new data protection law is to be supplemented with an obligation to provide information when using AI.
Initial situation
The new Data Protection Act (nDSG) will enter into force on September 1, 2023. Art. 21 nDSG also introduces a specific duty to inform regarding automated individual decisions. The provision requires the controller to inform data subjects about a decision that is exclusively is based on automated processing and which is associated with a legal consequence for them or significantly affects the data subject. The FADP thus only provides for fully automated Decisions, a specific labeling obligation and then certain rights. In the text of the proposal, it is precisely this point that is described as unsatisfactory – this because in practice AI systems are much more frequently used in partially automated procedures are used, but Art. 21 nDSG would then not be applicable. The parliamentary initiative submitted by the Green Group in the summer session is intended to address this problem with a new Art. 21bis nDSG.
Proposal Art. 21bis nDSG
According to the text of the proposal, the nDSG is to be amended as follows (emphasis by the author), although it is not entirely clear from the wording whether a new Article 21bis is to be inserted or whether Article 21 nDSG itself is to be amended:
Article 21bis Duty to provide information when using artificial intelligence
1 The data controller shall inform the data subject of a decision to is based to a large extent on artificial intelligence and which is associated with a legal consequence for them or significantly affects them (AI-supported individual decision).
2 Upon request, it shall give the data subject the opportunity to state its position. The data subject may request that the AI-supported individual decision is verified by a natural person.
3 Paragraphs 1 and 2 do not apply if:
- the AI-supported individual decision is directly related to the conclusion or performance of a contract between the data controller and the data subject and his or her request is granted; or
- the data subject has expressly consented to the decision being AI-supported takes place.
4 If the AI-powered individual decision by a federal body, it must mark the decision accordingly. Paragraph 2 does not apply if the person concerned does not have to be heard before the decision is taken in accordance with Article 30 paragraph 2 of the Administrative Procedure Act of 20 December 19686 (VwVG) or another federal law.
Art. 21bis nDSG is practically a copy of Art. 21 nDSG. The difference lies mainly in the fact that “Decision based solely on automated processing.” with “Decision that significant at artificial intelligence is based” is replaced and in the proposed article is always referred to by “AI-supported individual decision” is the talk.
Justification
The initiative is justified by the increasing automation of processes. AI systems would in practice much more often in partially automated processes - used as decision support. However, Art. 21 nDSG would precisely not be applicable in these cases, which is unsatisfactory, because a partially automated decision can of course have similarly serious consequences as a fully automated decision. However, the nDSG would only help a data subject if a fully automated AI system carried out every single step up to the decision itself, i.e. without human intervention.
The initiators are aware, moreover, that the term “artificial intelligence” is neither mentioned nor defined in the nDSG, and therefore refer to the planned AI regulation of the EUwhich will contain a definition of “AI system”. The Swiss legislator will probably (have to) follow this definition in the future, as it is well known that the AI Regulation is a extraterritorial effect and that in Switzerland it will probably also lead to the so-called “.Brussels effect” will come because the country is closely linked to the EU internal market and is dependent on market access (cf.
Special feature of the advance
The political debate surrounding this parliamentary initiative will be interesting in that federal politicians will now have to deal intensively with the issue of AI regulation and the use and functioning of AI systems in practice. This is against the background that the initiative is a so-called “parliamentary initiative” and a commission must therefore prepare a draft itself (if the Pa. Iv. is accepted in a first step). The previous proposals, which were submitted on the federal level on the topic of AI, were mainly motions, postulates, interpellations and questions, which were addressed to the Federal Council. In view of the current circumstances – we are experiencing in real time the Birth of a new generation of AI systems, especially in the area of generative AI – a reflective debate, conducted directly in the responsible commission, on how the use of AI should be regulated in Switzerland is desirable.
Outlook
It is not yet clear from the Swiss parliament’s website when the parliamentary initiative will be dealt with and in which National Council committee. Since the revision of the DPA was dealt with by the State Policy Committee (SPC) and data protection is one of its assigned areas of expertise, it is obvious that the SPC will again be responsible for this matter.