Among the many uses of this technology, Artificial Intelligence (AI) has become critical in the personal data processing field. Now, Latin America, as a region, has already started implementing this technology in different areas and industries. However, it is still in the process of consolidating a comprehensive regulation that integrates privacy and data protection principles and guidelines that would be applicable to AI technologies at a regional level. In this article, we review the implementation of AI within the region, to identify the benefits it could offer, along with the risks it could potentially impose on users' data protection and privacy rights, and how they could be mitigated.

1. General overview of AI and privacy legal frameworks in Latin America

Many countries in Latin America have begun implementing AI-based plans and strategies that focus on furthering their economic development and increasing their competitiveness, both as individual countries and together as a region. Furthermore, AI initiatives have rapidly become national plans, policies, and/or strategies to facilitate the use of new technologies in both the private and public sectors of the economy. Some countries are far more advanced than others in the implementation of these policies. This has created some difficulties in the development of initiatives across the region. As further explained in section 3, because of the importance of this issue and the impact that it could have, major efforts are being conducted to open up spaces of cooperation across Latin America.

Personal data processing is one of the components of AI, as data, and in certain situations personal data, is what ultimately fuels its algorithms. In view of this, privacy regulation has become fundamental when implementing these new technologies. In this regard, several Latin American countries have already issued regulations and guidelines aimed at safeguarding the protection of personal data. However, as with most things in Latin America, these rules and regulations are not precisely aligned. Mexico issued it´s personal data protection legislation in 2010, while Colombian, Peruvian and Dominican Republic regulations were enacted in 2011, 2012 and 2013, respectively. Brazil and Panama have only had privacy regulations since 2018 and 2019. Earlier this year, Argentina decided to begin taking all necessary steps to modify and update its data protection law and implement Convention 108. In view of this, each country has implemented its own specific regulation, under a different context and with different purposes. This, of course, has made it more difficult for regulators to unify the region when introducing new technologies.

2. Implementation of IA and its challenges

Several Latin American countries have implemented AI-based initiatives in both public and private sectors. However, given the disparity between local AI regulations and privacy, it cannot be denied that new technologies bring additional challenges. These obstacles have posed difficulties for their use in Latin America, as seen below.

Colombia

In 2020, the Colombian government launched an AI-based tool, the purpose of which was to create:

"a new digital information system that expands the judge's knowledge capabilities without replacing him, through the analysis and structuring of Constitutional Action judgments for review by the Constitutional Court."¹

The objective of this tool was to assist Colombia’s Constitutional Court in the selection of cases that should be reviewed, depending on their significance and recurrence. The system classifies Constitutional Action rulings, known as Tutelas based on previously defined and codified categories, by presenting the information in summary sheets indicating the concurrence or non-concurrence of the categories in a text and allowing the elaboration of statistics and the identification of recurring themes within its jurisprudence as a decision-making tool.

Although the AI tool managed to increase efficiency within the Colombian Constitutional Court, it is still working on the criteria used by the programme to select the Constitutional Action cases that were ultimately being reviewed and decided upon for it to properly identify urgent cases and its disclosure to the public, making it clear how and why some cases are deemed as “less urgent” by the algorithm and if there is any further review available for them. This measure is being taken in order to avoid the risk that the AI algorithm used for the tool becomes “stuck” on certain eligibility criteria and to prevent it from blocking all constitutional actions related to certain subjects from being reviewed by the Court. The algorithm of the programme is being revised and is currently undergoing a final design review.

Chile

The Chilean government also began implementing a computerised process as a pilot programme. Through data analysis from different administrative sources, the objective of the programme seeks to calculate and foresee the risk level that children and teenagers are exposed to of suffering some form of rights violation in the future. The program generates a "risk index" classifying the cases in order of priority, allowing the state to anticipate and intervene in a preventive manner. The system has become a platform for registering, managing and monitoring the cases of children and youths identified as being at greater risk.

This system initially had some issues, specifically related to "false positive" cases. Given the system is supplied by data from various state and administrative sources (i.e. the Civil Registry, the Ministry of Education and the "Chile Grows with You" programme, etc.), it could replicate the biases inherent in such sources. Therefore, there could be a potential overestimation associated with databases that have information mainly from cases that have already been the subject of public policy intervention, which may affect the positioning of children and youths in the ranking. At the same time, this could lead to the neglect of possible children’s rights violations in higher-income sectors, which are not risk free. Algorithmic revisions were conducted and today the programme is being used with the long-term goal of nationwide deployment.

3. Possible solutions for the effective implementation of AI technologies

Artificial Intelligence algorithms still need constant revision and updating in order to correctly adjust to different contexts and situations where they may be implemented. Furthermore, regulators across Latin America must strengthen their legal frameworks, both internally and as a region, for these new technologies to pose effective solutions that protect users´ rights to privacy and data protection.

Below are a couple of alternative scenarios which could allow the implementation of AI-based solutions, while still protecting data and its owners.

Digital economies vs. personal data protection

As mentioned earlier, one of the main issues related to the implementation of AI-based solutions in Latin America is the lack of comprehensive regional data protection regulation. However, to solve this, the Economic Commission for Latin America and the Caribbean (ECLAC) has been striving to develop and implement a national policy integration process for AI technologies. Furthermore, ECLAC believes that it is necessary for the Latin America region to implement mechanisms that guarantee minimum standards of protection for the individual´s personal information. Therefore, the inclusion of data protection principles, such as the principles of data transparency and quality guidelines, in the development of applications/AI systems can help to solidify basic protection standards, without compromising the region´s efforts for greater digital cooperation.

Privacy by Design and by Default

We believe that in order to facilitate the integration of data protection principles into AI systems, the implementation of Privacy by Design and by Default is essential.

In practical terms, different authorities and regulators in the region have begun to recognise the importance of Privacy by Design and by Default and use it in their rulings. Colombia’s Superintendence of Industry and Commerce, which is the country’s Data Protection Authority, has referred to the concept:

"This Superintendence has pointed out that it has been considered as a good practice and even as a proactive measure to, among others, comply with the Principle of Accountability. In addition, by introducing privacy by design, the aim is to guarantee the proper the correct treatment of data used in projects that involve the collection, use or processing of personal data".

"It is important to point out that, although it is not expressly established in Colombia, as an obligation of the Data Controller, its execution is a proactive measure that helps to comply with the Principle of Accountability."²

Likewise in Argentina, the concept was included in a document drafted by the Association for Civil Rights (ADC), as a non-binding but useful guideline related to the inclusion of human rights in Argentina's National AI Plan. In that regard, the Association recognises Privacy by Design as part of a list of fourteen measures aimed at strengthening the issues of privacy, security and protection of personal data within the management of AI. Specifically, the guideline establishes the following:

"Adopt international human rights standards as the main framework through which to assess the effects of AI on human beings. In this context, ethics can play a role but must be complementary to the human rights approach. Thus, the paradigm of "ethics by design" and "privacy by design and default" should be incorporated into any AI initiative that uses personal data."³ (Underline outside of the original text.)

In view of the above, we can see that Latin America as a region is beginning to adopt new concepts and solutions in order to strengthen its data protection principles, which can be integrated in the implementation of new AI technologies.

4. Final considerations

The coordination of data protection with AI technologies can be challenging, especially in a region like Latin America. Using AI technologies that take into account the corresponding data protection implications is key to avoid issues and risks, and thus may ultimately result as a milestone in the technological progress being made and in the solutions being created throughout the region. Therefore, it should be interesting to see Latin America coming together as a region, and develop a stronger legal framework that allows for the effective implementation of AI, while still guaranteeing the security of its citizens and their data.

1. Constitutional Court (27 July 2020).↩
2. Colombian Superintendence of Industry and Commerce, Resolution 64454 of 2021.↩
3. ADC, A Rights Perspective for the National Artificial Intelligence Plan, July 18, 2019.↩