Objective of the sandbox project
Ahus had already started developing the EKG AI algorithm when it was selected to participate in the Data Protection Authority’s regulatory sandbox in the spring of 2022. Ahus wanted to discuss algorithmic bias and how to ensure that the EKG AI returns fair predictions.
There is limited judicial precedent on the requirement of fair algorithms, and the GDPR does not give any clear answers as to how this principle should be interpreted in practice. The objective of this sandbox project has therefore been to explore what a principle of fairness, as established in Article 5, entails, and how this should be interpreted in the context of a specific AI project.
The goal of the sandbox project has been to explore whether the EKG AI has bias, and to propose specific measures to reduce any such bias. The intention behind the measures is to develop algorithms that promote equal treatment and prevent discrimination. In this context, the Equality and Anti-Discrimination Ombud (LDO) has contributed valuable expertise on discrimination legislation.
The purpose of this final report is to communicate the discussions and results of the project to a wider audience, as these may have transfer value for other health projects that use artificial intelligence.
Objectives of the sandbox project:
- What are fairness and algorithmic bias? Gain a better understanding of the concepts “fairness”, “algorithmic bias” and “discriminating algorithms”, as well as to account for regulations that are relevant in this context.
- How to identify algorithmic bias? Explore whether, and if so, to what degree, algorithmic bias exists, or may arise, in Ahus’s EKG AI algorithm.
- Which measures could reduce algorithmic bias? Propose technical and organisational measures to reduce and correct any bias in the algorithm.
Due to considerations of scope, the sandbox project has not considered legal basis requirements for the processing of personal data in this project. We briefly mention, however, that the use of patient data in the development of the decision-support tool was approved by the Norwegian Directorate of Health in January 2022 pursuant to Section 29 of the Health Personnel Act. This decision grants an exemption from confidentiality and constitutes a supplementary legal basis for the processing of personal data pursuant to the GDPR. For more information about the legal basis for processing of health information in connection with the development of algorithms in the health sector, see the final report for the sandbox project Helse Bergen, published in late 2022.
Under Article 35 of the GDPR, a data protection impact assessment (DPIA) is required if the processing of personal data is likely to result in “a high risk” to the rights and freedoms of natural persons. Before Ahus started developing the algorithm EKG AI, they did prepare a DPIA, but this has not been a focus of the sandbox project. However, elements from this report, particularly the method for identifying algorithmic bias, as well as the measures for reducing the risk of algorithmic bias, would be relevant to include in a DPIA.
Read more about DPIA requirements on the Data Protection Authority website.