Recently, a new Statutory Law Draft was filed, which seeks to define and establish the standards to be met by private and public entities to ensure respect for human rights when using Artificial Intelligence ("AI").

Specifically, this Bill introduces the following:

• Defines AI as follows:

  “Set of computer techniques, programming system, computational system, physical machines or technological processes that allow developing algorithms and creating computer programs to execute objectives defined by humans, make predictions, recommendations, make decisions, create new knowledge and/or complete cognitive and scientific-technical tasks from the extraction, selection, cutting and organization of available information or any task that requires intelligence such as reasoning or learning.”

• Establishes a series of Principles that must be guaranteed for the development and implementation of AI systems, including, among others, oversight and prevalence of human intelligence, safety and security, sustainable development, proportionality, transparency, and accountability.
• Proposes a risk classification which categorizes AI developments as having an unacceptable, high, limited, or zero risk.
• Establishes the need for a specific and informed consent from data subjects who may be involved in the development or implementation of AI systems.
• Introduces an obligation for natural or legal persons intending to use and implement AI systems to publish an assessment of the risks and potential impact on human and fundamental rights before deploying such systems.
• Sets forth that individuals whose fundamental rights are affected by AI may exercise the following rights: i) request review by a natural person, (ii) file claims, and (iii) request revocation before the competent authority and request precautionary measures.
• Establishes that the minimum age for the use and implementation of AI systems is eighteen (18) years.
• Establishes that entities that because of the use and implementation of IA systems eliminate jobs, must place the disadvantaged worker in a job of equal or superior conditions for a term of no less than six (6) months.
• Proposes a modification to the current Data Protection Law (Law 1581 of 2012) under which it expressly establishes that the competent authority to monitor and guarantee the protection of data in IA systems will be the Superintendence of Industry and Commerce ("SIC"), through the Delegation for the Protection of Personal Data.
• Introduces new powers for the SIC, including: i) auditing algorithms used by AI systems to ensure the protection of personal data, ii) managing a Certification Platform, iii) conducting investigations, ex officio or at the request of parties, among others.
• Establishes that all entities that develop AI systems must register their models in a Certification Platform managed by the SIC, which will review the models and verify that there is no infringement of rights, in order to authorize their use.
• Introduces the following list of activities excluded from the use and implementation of AI systems:
• Behavioral manipulation
• For exploiting the vulnerability of groups or individuals.
• Qualification of profiles for the lending of credit.
• Police prediction of criminal behaviors based on profiles, location or past behaviors.
• Emotion recognition
• Non-targeted extraction of facial images from the internet for the creation of facial recognition databases.
• Real-time remote biometric identification and surveillance.
• Biometric identification for prosecution of serious crimes without judicial authorization.
• Biometric categorization based on gender, race, ethnicity, etc.
• Social or reputational scoring.
• To influence on voters and results of electoral processes.
• To define sentences and judicial decisions.
• To delimitate the freedom of expression.
• Any activity that may lead to significant harm to human rights, fundamental rights and the environment.
• Prohibits public and private companies from transferring and exchanging personal data for the use and implementation of AI systems, unless the risk involved is zero and is excluded from the aforementioned list of activities.

For any additional information on the new provisions included in this Bill, and how they may affect current personal data protection practices, please do not hesitate to contact us.

The Bill is available here.