Data Privacy and Artificial Intelligence in the Digital Society: A Comparative Analysis of Legal Frameworks for Personal Data Protection

Abstract

In today's digital society, artificial intelligence takes over the processing of personal data; yet the legal structure that regulates this data is based on a different, matricidal way of handling information, where collection, purpose-use, are separate and recognizable events. This article delves into this structural mismatch and asks how far performance in this regard has been achieved by five apparent representative regimes; the EU, India, the US, China and Brazil. In a functional comparative approach, it compares each regime in terms of seven institutional dimensions: constitutional anchoring, scope of non-consensual processing grounds, guarantees against automated decision making, independence of the regulators, and control over the transfer of data to other States, limitedness of State exemptions, and level of sanctions imposed. Three findings emerge. In the first example, there is a high level of convergence between the terms of statutes while the institutions of which they are a part form a strong field of divergence, with institutions even sharing names. Second, consent is the keystone of most regimes, and in the case of India, it is the most; and it is very poorly adapted to where AI processing is most concentrated, for which no jurisdiction has yet provided a solution. Thirdly, existing rights of erasure and access fail to consider the case where a trained model it or amounted to personal data.