According to the parliamentary initiative of the Green Group of 15 June 2023, Art. 21bis nDSG is to be amended. The obligation to provide information for partially automated decisions should now also include whether such a decision was made on the basis of artificial intelligence (AI). You can read more about this in the following article.
The Federal Data Protection Act of 25 September 2020 (Data Protection Act, nDSG; SR 235.1), which will come into force on 1 September 2023, will contain Art. 21 nDSG, which introduces a specific duty to inform for automated individual decisions. Data subjects must be informed of a decision that is based exclusively on automated processing and significantly affects data subjects.
Within the automation of processes and procedures, which is the reason for Parliamentary Initiative 23.438, a distinction must be made between different levels of automation. (Fully) automated processing within the meaning of Art. 21 nDSG exists if both the content-related assessment of a life circumstance and the decision based on it are carried out by a program in the broadest sense without human intervention. Partially automated systems, on the other hand, can serve as decision support and assist in determining the facts. The system determines information, compiles it and evaluates it. This information can then be taken into account by the natural person in their decision-making – with the emphasis on can, because they do not have to. The final decision remains with the individual.
In Art. 21 nDSG, the current data protection law only provides for a labelling obligation and certain rights of the data subjects for fully automated decisions, but not for partially automated ones, although these can have a similar impact on data subjects. In addition, artificial intelligence (AI) is used much more frequently in semi-automated procedures than in fully automated ones. In order to take these points into account, the amendment should include in the wording “AI-supported individual decision” and thus include as Art. 21bis nDSG the partially automated decision when using AI.
Article 21bis Duty to provide information when using artificial intelligence
1 The controller shall inform the data subject of a decision that is significantly based on artificial intelligence and that entails a legal consequence for him or her or significantly affects him or her (AI-based individual decision).
2 On request, it shall give the data subject the opportunity to state his or her position. The data subject may request that the AI-based individual decision be reviewed by a natural person.
3 Paragraphs 1 and 2 shall not apply if:
(a) the AI-based individual decision is directly related to the conclusion or performance of a contract between the controller and the data subject and the data subject’s request is granted; or
(b) the data subject has expressly consented to the decision being AI-assisted.
4 If the AI-supported individual decision is taken by a federal body, it must mark the decision accordingly. Paragraph 2 does not apply if the person concerned does not have to be heard before the decision is taken in accordance with Article 30 paragraph 2 of the Administrative Procedure Act of 20 December 19686 (APA) or another federal act.
The parliamentary initiative will lead to a political debate, as AI has already made strong inroads both in the private sector and in the federal administration of the private sector.