The GDPR v Machine Learning Algorithms

10 May 2019 by

Matthew Fisher is a doctor and aspiring barrister with an interest and experience in MedTech.

Josef. K the protagonist of Kafka’s novel ‘The Trial’ was an ambitious and successful banker prior to his unexpected arrest. The criminal charges brought against him were never explained because they were beyond the comprehension of all but the most senior judges. Attempting to understand his guilt, consumed K’s every thought – he was distracted at work, subservient to his lawyer and ultimately docile when led to his execution. ‘The Trial’ eloquently argued that transparency is a prerequisite of accountability. In the Age of the Algorithm, Kafka’s novel is now more relevant than ever.

Machine learning algorithms increasingly regulate our lives making decisions about us in finance, education, employment and justice. Ultimately, it will become pervasive in most, if not all aspects of decision making in the foreseeable future. But what is a machine learning algorithm? How does it decide? What rights do data subjects have? This article aims to answer all three of these questions.

What are Machine Learning Algorithms?

An algorithm is a set of instructions which are followed to complete a task. For example, place bowl on table, pour in both cereal and milk, finally eat with spoon. A more complex example from healthcare is the CHAD VASC score. It allows clinicians to make evidenced based decisions when prescribing blood thinners for patients at risk of stroke. The score is comprised of eight separate questions such as age, sex and blood pressure. The answers to these questions are the algorithm’s variables, which determine the CHAD VASC score. Two of the variables – age greater than 75 and having had a previous stroke are double weighted to reflect their significant predictive value.

The CHAD VASC algorithm is the product of research studies performed by human clinicians and the algorithm’s weighted variables are fixed. However, machine learning algorithms require no human input and the weighted variables can change to reflect new data inputs and outputs. It is a form of artificial intelligence because it allows computers to automatically draw inferences when presented with new data, without being explicitly programmed for the task.

A common type of machine learning algorithm is an artificial neural network which imitates the human brain. The neural network functions via interconnected neurons, which are the algorithms weighted variables. The connections between neurons become stronger if the algorithm arrives at the correct answer and weaker if it arrives at the wrong answer. The system has an input layer (i.e. data on age, sex and blood pressure), hidden layers and an output layer (% risk of stroke). There are large numbers of connections between each of these layers which can be refined. With time and large data sets, billions of refinements can develop into an algorithm that is very successful at its given task.

How do Machine Learning Algorithms decide?

A complex machine learning algorithm is one with many variables. In these algorithms, the input and output layers are known but the hidden decision-making layers remain hidden. These complex models cannot be explained in their entirety, which has led to their media label of ‘black boxes’.

To understand why this is the case it is necessary to consider the ‘curse of dimensionality’ from computer science. Data can be represented geometrically – if there are two variables all the data can be displayed on a two dimensional xy graph and with three variables, a three dimensional xyz graph.

However, in complex systems there are thousands of variables, requiring thousands of dimensions. It is important at this point to distinguish between low-dimensional settings such as the three-dimensional physical space of everyday experience, from the high-dimensional spaces which arise when analysing data.

Therefore, in high-dimensional spaces such as complex machine learning algorithms it is possible to have thousands of dimensions. As the number of dimensions (variables) increases, the number of ways in which all the potential values can be combined grows – exponentially.

It is the ‘curse of dimensionality’ that turns complex machine learning algorithms into black boxes because their hidden decision-making layers are beyond human comprehension. Arguably, it is possible to provide an explanation for a specific variable in a complex system. However, this is challenging for several reasons, which are beyond the scope of this article.

The Rights of Data Subjects – Article 22(1) of the General Data Protection Regulation

The GDPR has been incorporated into the Data Protection Act 2018 and as per section 3 of the European Union (Withdrawal) Act 2018 it will remain a part of domestic law after the United Kingdom’s exit from the EU.

Article 22(1) of the GDPR states that

the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

The Data Protection Working Party, which is an advisory body to the EU on data protection and privacy, has provided some examples of “legal effects” – cancellation of a contract, denial of social benefits or the refusal of citizenship.  It has also provided examples of “similarly significant decision”, which includes “decisions that affect someone’s access to health services” i.e. a patient whose risk of stroke and therefore treatment is determined solely by a machine learning algorithm.

This is not science fiction, the Topol Review an independent report written on behalf of the Health Secretary states that

rather than relying on a concept of the normal derived from population studies (i.e. CHAD VASC), AI techniques such as deep learning will be used to define normality for an individual, and hence identify any deviation from it, using that individual’s genomic, anatomical, phenotypic and environmental data, and its variations over time.

This is truly personalised medicine because by combining all the variables that make up you, a stroke prevention management plan can be tailored specifically with you in mind. Personalised medicine will result in considerably better patient outcomes. However, only Dr Algorithm can administer such a complex system. He will make decisions for you and about you. In this, scenario human doctors and health professionals will be akin to the low-level court officials and guards in “The Trial” – merely implementing the unexplainable decisions made by a higher authority.

However, this dystopian/ utopian future must first circumvent Article 22(1) of the GDPR. Article 22(1) only applies when the processing is done solely by automated means but in the above scenario humans remain ‘in the loop’. However, human involvement can be rendered nominal secondary to “automation bias” a phenomenon whereby humans either over or under-rely on decision making tools. It is fair to assume that human doctors will over rely on complex machine learning algorithms, either through choice or insurance, rendering their involvement in the decision-making process illusory.

There are exceptions from the prohibition set out in Article 22(2). These apply where the decision is necessary for the performance or entering of a contract, authorised by Union or Member State law or made with the explicit consent of the data subject.

However, if none of the exceptions apply and the role of human doctors is proven to be illusory Articles 13(2)(f) and 14(2)(g) will apply – the right to be informed. If the controller is making automated decisions as described in Article 22(1) they must “provide meaningful information about the logic involved”. However, as established it is not possible to provide logical explanations of the decision-making processes underlying complex machine learning algorithms. If the algorithm is simple having only a few variables combined in a straightforward way it is easier to explain the decision-making process but the algorithm does not perform very well. Therefore, we will end up with a trade-off between performance and explicability. Is a Kafkaesque world a price worth paying for dramatically improved health outcomes.


The technology behind today’s machine learning algorithms is not new, most dates from the ‘70s, ‘80s, and ‘90s. What has changed is the vast quantities of data that corporations and governments store on all of us, feeding the algorithms which make decisions for us and about us. As we leave 4G behind and enter a new world of 5G and the of ‘internet of things’ our data trails will grow exponentially, as will the role that algorithms play in our lives.

The GDPR has provided subjects with powerful rights and controllers with serious obligations. The law must now determine how best to interpret and implement this powerful piece of legislation. If done well the benefits of machine learning algorithms will lead to a fairer, more prosperous society. If done badly, it will lead to a wildly unequal society and give rise to a new digital aristocracy. A sentiment Stephen Hawking agreed with:

the rise of powerful AI will be either the best, or the worst thing, ever to happen to humanity. We do not yet know which.

Welcome to the UKHRB

This blog is run by 1 Crown Office Row barristers' chambers. Subscribe for free updates here. The blog's editorial team is:
Commissioning Editor: Jonathan Metzer
Editorial Team: Rosalind English
Angus McCullough QC David Hart QC
Martin Downs
Jim Duffy

Free email updates

Enter your email address to subscribe to this blog for free and receive weekly notifications of new posts by email.




7/7 Bombings 9/11 A1P1 Aarhus Abortion Abu Qatada Abuse Access to justice adoption AI air pollution air travel ALBA Allergy Al Qaeda Amnesty International animal rights Animals anonymity Article 1 Protocol 1 Article 2 article 3 Article 4 article 5 Article 6 Article 8 Article 9 article 10 Article 11 article 13 Article 14 article 263 TFEU Artificial Intelligence Asbestos Assange assisted suicide asylum asylum seekers Australia autism badgers benefits Bill of Rights biotechnology birds directive blogging Bloody Sunday brexit Bribery British Waterways Board Catholic Church Catholicism Chagos Islanders Charter of Fundamental Rights child protection Children children's rights China christianity circumcision citizenship civil liberties campaigners civil partnerships climate change clinical negligence closed material procedure Coercion Cologne Commission on a Bill of Rights common buzzard common law communications competition confidentiality confiscation order conscientious objection consent conservation constitution contact order contempt of court Control orders Copyright coronavirus costs costs budgets Court of Protection crime criminal law Criminal Legal Aid criminal records Cybersecurity Damages data protection death penalty declaration of incompatibility defamation DEFRA Democracy village deportation deprivation of liberty derogations Detention devolution Dignitas dignity Dignity in Dying diplomacy director of public prosecutions disability Disability-related harassment disciplinary hearing disclosure Discrimination Discrimination law disease divorce DNA doctors does it matter? domestic violence Dominic Grieve don't ask don't ask don't tell don't tell Doogan and Wood double conviction DPP guidelines drones duty of care ECHR economic and social rights economic loss ECtHR Education election Employment Environment environmental information Equality Act Equality Act 2010 ethics Ethiopia EU EU Charter of Fundamental Rights EU costs EU law European Convention on Human Rights European Court of Human Rights European Court of Justice european disability forum European Sanctions Blog Eurozone euthanasia evidence Exclusion extra-jurisdictional reach of ECHR extra-territoriality extradition extradition act extradition procedures extradition review extraordinary rendition Facebook Facebook contempt facial recognition fair procedures Fair Trial faith courts fake news Family family courts family law family legal aid Family life fatal accidents act Fertility fertility treatment FGM fisheries fishing rights foreign criminals foreign office foreign policy France freedom of assembly Freedom of Association Freedom of Expression freedom of information Freedom of Information Act 2000 freedom of movement freedom of speech free speech game birds gangbo gang injunctions Garry Mann gary dobson Gary McFarlane gay discrimination Gay marriage gay rights gay soldiers Gaza Gaza conflict Gender General Dental Council General Election General Medical Council genetic discrimination genetic engineering genetic information genetics genetic testing Google government Grenfell grooming Gun Control gwyneth paltrow gypsies habitats habitats protection Halsbury's Law Exchange hammerton v uk happy new year harassment Hardeep Singh Haringey Council Harkins and Edwards Health healthcare health insurance Heathrow heist heightened scrutiny Henry VII Henry VIII herd immunity hereditary disorder High Court of Justiciary Hirst v UK HIV HJ Iran HM (Iraq) v The Secretary of state for the home department [2010] EWCA Civ 1322 Holder holkham beach holocaust homelessness Home Office Home Office v Tariq homeopathy hooding Hounslow v Powell House of Commons Housing housing benefits Howard League for Penal Reform how judges decide cases hra damages claim Hrant Dink HRLA HS2 hs2 challenge hts Human Fertilisation and Embryology Act Human Fertilisation and Embryology Authority human genome human rights Human Rights Act Human Rights Act 1998 human rights advocacy Human rights and the UK constitution human rights commission human rights conventions human rights damages Human Rights Day human rights decisions Human Rights Information Project human rights news Human Rights Watch human right to education human trafficking hunting Huntington's Disease HXA hyper injunctions Igor Sutyagin illegality defence immigration Immigration/Extradition Immigration Act 2014 immigration appeals immigration detention immigration judge immigration rules immunity increase of sanction India Indonesia Infrastructure Planning Committee inherent jurisdiction inherited disease Inhuman and degrading treatment injunction Inquest Inquests insult insurance insurmountable obstacles intelligence services act intercept evidence interception interests of the child interim remedies international international conflict international criminal court international humanitarian law international human rights international human rights law international law international treaty obligations internet internet service providers internment internship inuit investigation investigative duty in vitro fertilisation Iran iranian bank sanctions Iranian nuclear program Iraq Iraqi asylum seeker Iraq War Ireland irrationality islam Israel Italy iTunes IVF ivory ban jackson reforms Janowiec and Others v Russia ( Japan Jason Smith Jeet Singh Jefferies Jeremy Corbyn jeremy hunt job Jogee John Hemming John Terry joint enterprise joint tenancy Jon Guant Joseph v Spiller journalism judaism judges Judges and Juries judging Judicial activism judicial brevity judicial deference judicial review Judicial Review reform judiciary Julian Assange jurisdiction jury trial JUSTICE Justice and Security Act Justice and Security Bill Justice and Security Green Paper Justice Human Rights Awards JUSTICE Human Rights Awards 2010 just satisfaction Katyn Massacre Kay v Lambeth Kay v UK Ken Clarke Ken Pease Kerry McCarthy Kettling Kings College Klimas koran burning Labour Lady Hale lansley NHS reforms LASPO Law Commission Law Pod UK Law Society Law Society of Scotland leave to enter leave to remain legal aid legal aid cuts Legal Aid desert Legal Aid Reforms legal blogs Legal Certainty legal naughty step Legal Ombudsman legal representation legitimate expectation let as a dwelling Leveson Inquiry Levi Bellfield lewisham hospital closure lgbtq liability Libel libel reform Liberal Democrat Conference Liberty libraries closure library closures Libya licence conditions licence to shoot life insurance life sentence life support limestone pavements limitation lisbon treaty Lithuania Litigation litvinenko live exports local authorities locked in syndrome london borough of merton London Legal Walk London Probation Trust Lord Bingham Lord Bingham of Cornhill Lord Blair Lord Goldsmith lord irvine Lord Judge speech Lord Kerr Lord Lester Lord Neuberger Lord Phillips Lord Rodger Lord Sumption Lord Taylor LSC tender luftur rahman machine learning MAGA Magna Carta mail on sunday Majority Verdict Malcolm Kennedy malice Margaret Thatcher Margin of Appreciation margin of discretion Maria Gallastegui marriage material support maternity pay Matthew Woods Mattu v The University Hospitals of Coventry and Warwickshire NHS Trust [2011] EWHC 2068 (QB) Maya the Cat Mba v London Borough Of Merton McKenzie friend Media and Censorship Medical medical liability medical negligence medical qualifications medical records medicine mental capacity Mental Capacity Act Mental Capacity Act 2005 Mental Health mental health act mental health advocacy mental health awareness Mental Health Courts Mental illness merits review MGN v UK michael gove Midwives migrant crisis Milly Dowler Ministerial Code Ministry of Justice Ministry of Justice cuts misfeasance in public office modern slavery morality morocco mortuaries motherhood Motor Neurone disease Moulton Mousa MP expenses Mr Gul Mr Justice Eady MS (Palestinian Territories) (FC) (Appellant) v Secretary of State for the Home Department murder murder reform Musician's Union Muslim NADA v. SWITZERLAND - 10593/08 - HEJUD [2012] ECHR 1691 naked rambler Naomi Campbell nationality National Pro Bono Week national security Natural England nature conservation naturism Nazi negligence Neuberger neuroscience Newcastle university news News of the World new Supreme Court President NHS NHS Risk Register Nick Clegg Nicklinson Niqaab Noise Regulations 2005 Northern Ireland nuclear challenges nuisance nursing nursing home Obituary Occupy London offensive jokes Offensive Speech offensive t shirt oil spill olympics open justice oppress OPQ v BJM orchestra Osama Bin Laden Oxford University paramountcy principle parental rights parenthood parking spaces parliamentary expenses parliamentary expenses scandal Parliamentary sovereignty Parliament square parole board passive smoking pastor Terry Jones patents Pathway Students Patrick Quinn murder Pensions persecution personal data Personal Injury personality rights perversity Peter and Hazelmary Bull PF and EF v UK Phil Woolas phone hacking phone taps physical and mental disabilities physician assisted death Pinnock Piracy Plagiarism planning planning human rights planning system plebgate POCA podcast points Poland Police police investigations police liability police misconduct police powers police surveillance Policy Exchange report political judges Politics Politics/Public Order poor reporting Pope Pope's visit Pope Benedict portal possession proceedings power of attorney PoW letters to ministers pre-nup pre-nuptial Pre-trial detention predator control pregnancy press press briefing press freedom Prince Charles prince of wales princess caroline of monaco principle of subsidiarity prior restraint prison Prisoners prisoners rights prisoners voting prisoner vote prisoner votes prisoner voting prison numbers Prisons prison vote privacy privacy injunction privacy law through the front door Private life private nuisance private use proceeds of crime Professional Discipline Property proportionality prosecution Protection of Freedoms Act Protection of Freedoms Bill Protest protest camp protest rights Protocol 15 psychiatric hospitals Public/Private public access publication public authorities Public Bodies Bill public inquiries public interest public interest environmental litigation public interest immunity Public Order Public Sector Equality Duty putting the past behind quango quantum quarantine Queen's Speech queer in the 21st century R (on the application of) v Secretary of State for the Home Department & Ors [2011] EWCA Civ 895 R (on the application of) v The General Medical Council [2013] EWHC 2839 (Admin) R (on the application of EH) v Secretary of State for the Home Department [2012] EWHC 2569 (Admin) R (on the application of G) v The Governors of X School Rabone and another v Pennine Care NHS Foundation Trust [2012] UKSC 2 race relations Rachel Corrie Radmacher Raed Salah Mahajna Raed Saleh Ramsgate raptors rehabilitation Reith Lectures Religion resuscitation RightsInfo right to die right to family life right to life Right to Privacy right to swim riots Roma Romania Round Up Royals Russia saudi arabia Scotland secrecy secret justice Secret trials security services sexual offence Sikhism Smoking social media social workers South Africa south african constitution Spain special advocates spending cuts Standing starvation statelessness stem cells stop and search Strasbourg super injunctions Supreme Court Supreme Court of Canada surrogacy surveillance swine flu Syria Tax Taxi technology Terrorism terrorism act tort Torture travel treason treaty accession trial by jury TTIP Turkey Twitter UK Ukraine unfair consultation universal jurisdiction unlawful detention USA US Supreme Court vaccination vicarious liability Wales War Crimes Wars Welfare Western Sahara Whistleblowing Wikileaks wildlife wind farms WomenInLaw Worboys wrongful birth YearInReview Zimbabwe


This blog is maintained for information purposes only. It is not intended to be a source of legal advice and must not be relied upon as such. Blog posts reflect the views and opinions of their individual authors, not of chambers as a whole.

Our privacy policy can be found on our ‘subscribe’ page or by clicking here.

%d bloggers like this: