Kişisel Verilerin Korunması Yönüyle Algoritmik Karar Verme

Abstract

Günümüzde veri işleyenler birçok kararın alınması bakımından algoritmalardan yararlanmaktadırlar. Genel Veri Koruma Tüzüğü, münhasıran otomatik yollarla verilen kararlara ilişkin olarak çeşitli hükümler ihtiva etmektedir. 6698 sayılı Kişisel Verilerin Korunması Kanunu’ndan ise ne algoritmik karar vermenin gerçekleşeceğine ilişkin özel olarak aydınlatma yapılması gerektiği ifade edilmiş, ne de ilgili kişilere algoritmik karar verme yönteminin kullanılıp kullanılmadığına dair bilgi isteme hakkı tanınmıştır. Kanun’un münhasıran otomatik yollarla alınan kararlara ilişkin tek maddesi “İlgili kişinin hakları” başlıklı 11. maddesinin birinci fıkrası olup hükümde geçen “münhasıran otomatik sistemler vasıtasıyla analiz”, “kişinin kendisi aleyhine bir sonucun ortaya çıkması” ve “açıklama isteme” hakkı bakımından GVKT’ye ilişkin açıklamalardan yararlanılması mümkündür. Ancak GVKT’nin benimsediği esasın aksine, Türk hukukunda bireyler hakkında münhasıran otomatik yollarla karar verilmesi yasak olmayıp Kanun’un ilgili kişilere yalnızca bir itiraz hakkı tanıdığı kabul edilmelidir.

Keywords

• Algoritmik karar verme
• otomatik yollarla karar verme
• profilleme
• karara tabi olmama hakkı
• Algorithmic decision making
• automated decision making
• profiling

Algorithmic Decision Making from the Perspective of Data Protection

Abstract

Today, data processors use algorithms to make many decisions. The General Data Protection Regulation contains various provisions regarding decisions made solely by automated means. The Law on the Protection of Personal Data No. 6698, on the other hand, does neither require a special transparency requirement concerning the use of algorithmic decision-making, nor it provides the data subjects with the right to be informed whether the algorithmic decision-making method is used or not. The only article of the Law No. 6698 regarding the decisions taken solely by automated means is the first paragraph of Article 11 titled "Rights of the data subject", and the explanations regarding the GDPR may be used to interprete the terms "analysis solely by automated systems", "the emergence of a result against the data subject" and the "right to request an explanation”. However, contrary to the principle adopted by the GDPR, in Turkish law it is not forbidden to make decisions about individuals solely by automatic means, and it should be accepted that the Law only grants the relevant persons a right of objection.

Keywords

• Algoritmik karar verme
• otomatik yollarla karar verme
• profilleme
• karara tabi olmama hakkı

References

1. Article 29 Data Protection Working Party (2018). Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679. https://ec.europa.eu/newsroom/article29/redirection/document/49826 adresinden alınmıştır. Bader, V. ve Kaiser, S. (2019). Algorithmic decision-making? The user interface and its role for human involvement in decisions supported by artificial intelligence. Organization, 26(5), 655-672.
2. Borgesius, F. J. Z. (2020). Strengthening legal protection against discrimination by algorithms and artificial intelligence. The International Journal of Human Rights, 24(10), 1572-1593.
3. Brand, D. J. (2020). Algorithmic Decision-making and the Law. EJournal of EDemocracy and Open Government, 12(1), 114-131.
4. Brkan, M. (2019). Do algorithms rule the world? Algorithmic decision-making and data protection in the framework of the GDPR and beyond. International Journal of Law and Information Technology, 27(2), 91–121.
5. Brkan, M. ve Bonnet, G. (2020). Legal and Technical Feasibility of the GDPR’s Quest for Explanation of Algorithmic Decisions: of Black Boxes, White Boxes and Fata Morganas. European Journal of Risk Regulation, 11(1), 18-50.
6. Cabral, T. S. (2021). AI and the Right to Explanation: Three Legal Bases under the GDPR. D. Hallinan, R. Leenes ve P. D. Hert (Ed.), Data Protection and Privacy: Data Protection and Artificial Intelligence (29-56). Oxford: Hart Publishing.
7. Casey, B., Farhangi, A. ve Vogl, R. (2019). Rethinking Explainable Machines: The GDPR's 'Right to Explanation' Debate and the Rise of Algorithmic Audits in Enterprise. Berkeley Technology Law Journal, 34(1), 143-188.
8. Castets-Renard, C. (2019). Accountability of Algorithms in the GDPR and Beyond: A European Legal Framework on Automated Decision-Making. Fordham Intellectual Property, Media & Entertainment Law Journal, 30(1), 91-137.

9. Cuthbertson, A. (2016). Humans Still Quicker Than Robots at Learning to Drive. https://www.newsweek.com/artificial-intelligence-self-driving-robots-492406 adresinden alınmıştır.
10. Çekin, M. S. (2020). Avrupa Birliği Hukukuyla Mukayeseli Olarak 6698 Sayılı Kanun Çerçevesinde Kişisel Verilerin Korunması Hukuku. İstanbul: On İki Levha.
11. Dreyer, S. ve Schulz, W. (2019). The GDPR and algorithmic decision-making – Safeguarding individual rights, but forgetting society. https://voelkerrechtsblog.org/de/the-gdpr-and-algorithmic-decision-making/ adresinden alınmıştır.
12. Edwards L. ve Veale, M. (2018). Enslaving the Algorithm: From a ‘Right to an Explanation’ to a ‘Right to Better Decisions’? IEEE Security & Privacy, 16(3), 46-54.
13. Edwards L. ve Veale, M. (2017). Slave to the Algorithm? Why a 'Right to an Explanation' Is Probably Not the Remedy You Are Looking For. Duke Law and Technology Review, 16(1), 18-84.
14. European Parliamentary Research Service (2020). The impact of the General Data Protection Regulation (GDPR) on artificial intelligence, https://www.europarl.europa.eu/RegData/etudes/STUD/2020/641530/EPRS_STU(2020)641530_EN.pdf adresinden alınmıştır.
15. European Parliamentary Research Service (2019). Understanding algorithmic decision-making: Opportunities and challenges. https://www.europarl.europa.eu/RegData/etudes/STUD/2019/624261/EPRS_STU(2019)624261_EN.pdf adresinden alınmıştır.
16. Goodman, B. ve Flexman, S. (2017). European Union Regulations on Algorithmic Decision-Making and a ‘Right to Explanation’. AI Magazine, 38(3), 50-57.
17. Google Translate’s gender bias pairs “he” with “hardworking” and “she” with lazy, and other examples. https://qz.com/1141122/google-translates-gender-bias-pairs-he-with-hardworking-and-she-with-lazy-and-other-examples adresinden alı‎nm‎‏ıştı‎r.
18. Heilweil, R. (2020). Why algorithms can be racist and sexist. https://www.vox.com/recode/2020/2/18/21121286/algorithms-bias-discrimination-facial-recognition-transparency adresinden alınmıştır.
19. Hoeren, T. ve Niehoff, M. (2018). Artificial Intelligence in Medical Diagnoses and the Right to Explanation. European Data Protection Law Review, 4(3), 308-319.
20. Italy: Court of Cassation rules that algorithm must be transparent for consent to be valid. https://www.dataguidance.com/news/italy-court-cassation-rules-algorithm-must-be adresinden alınmıştır.
21. Janssen, J. H. N. (2019). The right to explanation: means for ‘white-boxing’ the black-box?. http://arno.uvt.nl/show.cgi?fid=147348 adresinden al‎ınmış‎‏tı‎r.
22. Kaminski, M. E. (2019). The Right to Explanation, Explained. Berkeley Technology Law Journal, 34(1), 189-218.
23. Kanade, V. (2022). Narrow AI vs. General AI vs. Super AI: Key Comparisons. https://www.spiceworks.com/tech/artificial-intelligence/articles/narrow-general-super-ai-difference/ adresinden alınmıştır.
24. Karagöz, D. (2020). Algoritmalar ve Açıklama Hakkı (Yayımlanmamış Yüksek Lisans Tezi). İstanbul Bilgi Üniversitesi, İstanbul.
25. Kavlakoğlu, E. (2020). AI vs. Machine Learning vs. Deep Learning vs. Neural Networks: What’s the Difference? https://www.ibm.com/cloud/blog/ai-vs-machine-learning-vs-deep-learning-vs-neural-networks adresinden alınmıştır.
26. Kim, T. W. ve Routlegde, B. R. (2022). Why a Right to an Explanation of Algorithmic Decision-Making Should Exist: A Trust-Based Approach. Business Ethics Quarterly, 32(1) , 75-102.
27. Machine Bias. https://www.propublica.org/article/machine-bias-risk-assessments-in-criminal-sentencing adresinden alınmıştır.
28. Malgieri, G. ve Comandé, G. (2017). Why a Right to Legibility of Automated Decision-Making Exists in the General Data Protection Regulation. International Data Privacy Law, 7(4), 243-265.
29. Mendoza, I. ve Bygrave, L. A. (2017). The Right Not to Be Subject to Automated Decisions Based on Profiling. University of Oslo Faculty of Law Research Paper No. 2017-20. https://ssrn.com/abstract=2964855 adresinden alınmıştır.
30. Nilsson and others, No C-162/97 19 Kasım 1998.
31. Olckers, A. (2017). How to Teach a Computer to Distinguish Cats from Dogs. https://medium.com/@TheGeekiestOne/how-to-teach-a-computer-to-distinguish-cats-from-dogs-d66cc0679287 adresinden alınmıştır.
32. Privacy International (2017). Data Is Power: Profiling and Automated Decision-Making in GDPR. https://privacyinternational.org/sites/default/files/2018-04/Data%20Is%20Power-Profiling%20and%20Automated%20Decision-Making%20in%20GDPR.pdf adresinden alınmıştır.
33. Saygın, O. (2021). GDPR Kapsamında Algoritmik Şeffaflık. https://www.cottgroup.com/tr/blog/kvkk-gdpr/item/gdpr-kapsaminda-algoritmik-seffaflik-1 adresinden alınmıştır.
34. The Alan Turing Institute (2018). A right to explanation. https://www.turing.ac.uk/research/impact-stories/a-right-to-explanation adresinden alınmıştır.
35. The Norwegian Data Protection Authority (2018). Artificial intelligence and privacy. https://www.datatilsynet.no/globalassets/global/english/ai-and-privacy.pdf adresinden alınmıştır.
36. Ustaran, E. ve Hordern, V. (2017). Automated Decision-Making Under the GDPR – A Right for Individuals or A Prohibition for Controllers? https://www.hldataprotection.com/2017/10/articles/international-eu-privacy/automated-decision-making-under-the-gdpr-a-right-for-individuals-or-a-prohibition-for-controllers/ adresinden alınmıştır.
37. Wachter, S., Mittelstadt, B. ve Floridi, L. (2017). Why a Right to Explanation of Automated Decision-Making Does Not Exist in the General Data Protection Regulation. International Data Privacy Law, 7(2), 76–99.
38. Wachter, S., Mittelstadt, B. ve Russell, C. (2018). Counterfactual Explanations without Opening the Black Box: Automated Decisions and the GDPR. Harvard Journal of Law & Technology, 31(2), 842-884.
39. Xenidis R. ve Senden, L. (2020). EU non-discrimination law in the era of artificial intelligence: Mapping the challenges of algorithmic discrimination. https://cadmus.eui.eu/bitstream/handle/1814/65845/Pre-print%20version%20Chapter%20Xenidis_Senden.pdf?sequence=2&isAllowed=y adresinden alınmıştır.