Reinterpreting the Identifiability of Personal Data in the Age of Artificial Intelligence

Abstract

This paper analyzes a significant legal issue pertaining to the application of Artificial Intelligence (AI) to personal data, namely the re-identification of natural persons to their personal data. Since the development and use of AI technologies heavily rely on analyzing large amounts of data and identifying links among them, AI may be used to retrace and de-anonymize data about natural persons, creating new personal data protection risks. Using the permissive theory of data protection law, this paper analyzes the identifiability element of the notion of personal data within the data protection laws of Kenya and the European Union (EU) with a view to explaining how it can be interpreted so as to avoid an overly restrictive data protection regime that could hinder beneficial AI innovations and/or deprive individual data subjects of the protection that the legislator intended them to have. This paper proposes restricting identifiability to the time of data processing at issue, and limiting the assessment of identifiability to the controller or processor, and persons who are likely to receive the information, rather than the public and the broader community of users. That way, the study offers an option that narrows the definition of personal data to reasonable limits that facilitate responsible AI innovation while maintaining adequate and effective protection of data subjects.