Human Rights in the Age of Artificial Intelligence: Challenges and Legal Regulation

1.2 Impact of artificial intelligence on human rights

AI systems are applied across healthcare, law enforcement, finance, business and education sectors but generate significant risks through errors (postal service wrongly convicted over 700 employees, facial recognition error rates of 81 percent, Amazon recruitment algorithm rejected applications based on gender), privacy violations (Clearview AI collected facial images without consent), and lack of transparency that prevents people from understanding why decisions were applied to them (Dutch SyRI fraud detection system applied unequal risk assessment without transparent mechanisms, violating rights to private and family life). Ukraine's government identifies challenges including low research investment, underdeveloped public decision-making mechanisms, poor data digitization, difficulty verifying AI compliance, absence of unified ethical criteria, risks of unemployment, low digital literacy, inadequate information security in state systems, and incomplete legal regulation across education, economy, public administration, cybersecurity and defence, requiring development of ethical and legal frameworks.

2.1 EU legal approach overview

The EU's AI Act, adopted by the European Parliament in 2023 and expected to come into force no earlier than 2026, establishes a risk-tiered regulatory framework with four levels: minimal or no-risk systems for routine tasks with no serious legal consequences, limited-risk systems that affect rights and freedoms but can be controlled when users know they interact with machines, high-risk systems that may seriously impact rights and freedoms and require mandatory certification, human intervention measures, activity logging, quality datasets, detailed documentation, and high reliability and accuracy before market entry (including certain social media recommendation systems as amended by Parliament), and prohibited systems that pose threats to people or society such as those enabling persecution, manipulation, propaganda, or targeting vulnerable groups. The Act requires datasets to be current, complete, error-free and statistically representative to reduce bias and discrimination, imposes limits on systems that could threaten human rights or state interests, mandates informing users when they interact with AI rather than humans, encourages development of codes of conduct for AI actors, emphasizes transparency in AI development and use, and establishes regulatory sandboxes. The transition period allows stakeholders to adapt to compliance requirements, and adoption of the AI Act will directly affect AI regulation in Ukraine, requiring work on mechanisms for implementing international standards into Ukrainian technology projects.

2.2 Regulatory approach in the United States

The US developed a framework with five protection levels: safety and effectiveness of systems, protection from digital discrimination, privacy safeguards for sensitive data in health, work, education, criminal justice and finance sectors, transparency about AI use and impact, and restrictions on automated decision-making that may limit rights and freedoms.

5.1 Privacy by design and default

All entities processing personal data must design adequate protection systems through privacy by design, which requires integrating protection systems throughout all processes from early design stages onwards emphasizing risk prevention, and privacy by default, which means protection should be automatically ensured without user action with minimal data collection principles applied throughout the processing lifecycle from collection to deletion. Legislation including GDPR requires protection of personal data at every stage of processing starting from the design of AI products or services, with data protection authorities recommending clear internal instructions on when and how to use generative AI tools, involvement of data protection specialists in developing procedures and conducting data protection impact assessments, ensuring confidentiality in AI outputs, and mitigating risks of data leaks, bias and discrimination. People should be protected by default without having to prove their right to privacy.

5.2 Risk assessment

Organizations must conduct risk assessments to anticipate situations threatening human rights and freedoms before they occur; Data Protection Impact Assessment (DPIA) under GDPR article 35 analyzes, identifies and minimizes risks to personal data during processing, and is always required for systematic and large-scale profiling with legal effects or substantial impact, large-scale processing of special categories of data or criminal convictions data, and systematic and large-scale monitoring of publicly accessible areas. EU authorities identify additional high-risk indicators including processing using AI, automated decision-making, medical or biometric data processing outside medical contexts, location or behavior tracking, children's data processing for marketing, processing where disclosure threatens health or safety, and large-scale profiling. Under the Digital Services Act, very large online platforms and search engines with over 45 million users must conduct annual broad risk assessments of possible negative impacts including illegal goods and content, disinformation, and threats to fundamental rights; regulators also recommend conducting risk assessments for AI processing even when not legally mandated, and risk assessment can proceed in stages through analyzing data processing operations, defining purpose and methodology, developing adapted methodology by technology stage, and optionally involving external experts.

5.3 Grounds for personal data processing

When AI systems process personal data, they must have a lawful legal basis under Ukrainian law: the data subject's consent; authorization by law for data holders to exercise powers; entering into or performing contracts or pre-contractual steps with the data subject; protecting vital interests; fulfilling legal obligations; or protecting legitimate interests of the data holder or third party unless fundamental rights and freedoms of the data subject override these interests. For machine learning systems, separate lawful grounds must exist for both the training phase and operational deployment phase. The EU GDPR recognizes similar grounds: consent for specific purposes; performing contracts or pre-contractual actions; compliance with legal obligations; protecting vital interests; performing public interest tasks or exercising official authority; or pursuing legitimate interests of the controller or third party except where fundamental rights and freedoms of the data subject, particularly children, override such interests.

5.4 Purposes for data processing

Requires that artificial intelligence systems using personal data must be developed, trained, and deployed with clearly defined purposes established before project development. Specifies that data processing must follow the purpose limitation principle: purposes must be predetermined, justified, and documented to prevent unlawful use, and new purposes are permissible only if compatible with the original purpose.

5.5 Roles in personal data processing

Understanding the roles of AI stakeholders in personal data processing is necessary to determine their rights and obligations, with AI systems based on machine learning operating in two distinct stages - training and development, then operational deployment - each with separate objectives, clear definitions, and lawful bases for data processing. When multiple organizations handle personal data in AI systems, a cloud service provider offering storage and machine learning tools is typically a processor determining only technical aspects and infrastructure, while users are controllers if they decide which data and models to use and set model parameters and evaluation processes. If a processor supplies a resume screening tool and demands extensive personal information about candidates, the data controller must verify whether this data collection volume is justified and should request system modifications or find an alternative provider if not.

5.6 Right to information and data access

Ukrainian law grants individuals personal non-property rights over their data: to know sources, locations, purposes and holder locations; to obtain processing conditions and recipient information; to access their data; to receive confirmation within thirty calendar days of whether data is processed; to lodge motivated objections; to request changes or deletion if processing is unlawful or data inaccurate; to protect data from unlawful processing, loss, damage, concealment and false or defamatory information; to file complaints with the Ombudsman or court; to pursue legal remedies; to add restrictions or withdraw consent; and to know automated processing mechanisms. Data controllers must provide access free of charge and without delay, respond even if no data is processed, and implement technical and organizational measures enabling timely deletion while maintaining system functions. Individuals may request deletion or object if processing is unlawful or inaccurate, or if they withdraw consent or no longer need the data, except where exceptions apply by law, and organizations must provide meaningful information about the logic and consequences of automated decisions.