IS5542 Chap.12 AI Liability, Data Privacy and Algorithmic Bias
AI Liability, Data Privacy and Algorithmic Bias
Who pays when AI causes harm
Tort law lets an injured party claim compensation, and negligence requires duty, breach, causation and damage. Each element is harder with AI: there is no settled standard of a reasonable developer, and a black-box model leaves no causal trail.
Products liability imposes liability without fault for defects, and the EU's 2024 directive now treats software and AI as products.
The liability chain
Responsibility is spread across the model developer, the integrator or deployer, the end user and the person affected, and contracts push risk down the chain without removing it.
When a professional relies on invented output, as in the case of a lawyer who filed fictitious citations, the professional is accountable. Documentation such as model cards, data sheets, impact assessments, bias audits and incident logs is the evidence of reasonable care.
Bias as legal exposure
Disparate-impact doctrine makes a neutral-looking practice unlawful if it harms a protected group, whatever the intent.
Removing a protected attribute does not remove bias carried by proxies, and scale turns small error rates into large aggregate harm.
Privacy rules for data-hungry systems
Data minimisation, a lawful basis for training, erasure rights that sit awkwardly with model weights, and rights around solely automated decisions all shape design. Penalties differ sharply between the EU, the Mainland and Hong Kong.
What this chapter covers
- 01
Tort and criminal liability compared
- 02
The four elements of negligence
- 03
Products liability and software
- 04
Hallucination and professional accountability
- 05
The chain from developer to affected person
- 06
Documentation as evidence of care
- 07
Disparate impact and proxy discrimination
- 08
Deepfake fraud
- 09
Lawful basis, erasure and automated decisions
Worked example · free
Allocate liability for a hallucinated medical dosage
- 2Name the likely legal claims.
- 3Identify each party and its duty.
- 2Explain the difficulty in proving the claim.
Key terms
- Negligence
- A tort requiring proof of a duty of care, its breach, causation and damage on the balance of probabilities.
- Strict Liability
- Liability imposed without proof of fault, as in products liability for defective products.
- Disparate Impact
- Unlawful discrimination arising from a neutral-looking practice that disproportionately harms a protected group, regardless of intent.
- Proxy Discrimination
- Bias carried by features that correlate with a protected characteristic, such as postcode standing in for race.
- Lawful Basis
- The legal ground, such as consent or legitimate interests, on which personal data may be processed, including for training.
- Machine Unlearning
- Methods for removing the influence of specific training data from a trained model, prompted by erasure rights.
- Counterfactual Explanation
- An explanation stating what would have had to be different for an automated decision to change.
- Impact Assessment
- A structured pre-launch review of personal data processing, its necessity, risks and mitigations.
AI Liability, Data Privacy and Algorithmic Bias FAQ
Who is liable when an AI system gives harmful advice?
Potentially several parties along the chain. The developer may face products liability or negligence claims, the organisation that deployed the system owes context-specific duties, and a professional who relied on the output without checking it remains personally accountable. Contract terms shift some risk between them but cannot remove it.
Does removing gender or race from a model make it fair?
Not by itself. Other features such as postcode, name patterns or spending behaviour can carry the removed attribute, so outcomes can still differ by group. Disparate-impact law looks at effects rather than inputs, which is why the course recommends testing outcomes by group and documenting a bias audit.
What rights do people have against automated decisions?
Under the EU rules covered in the lecture, people may not be subject to solely automated decisions with legal or similarly significant effects, such as credit refusals, without safeguards: human review, a chance to state their view and to contest, and meaningful information about the logic, which counterfactual explanations provide best.
Exam move
Take one AI failure from the news and write four lines: the claim, the party in the chain who bears it, the element hardest to prove, and the document that would have helped the defence. Repeat for a bias case and a privacy case until the chain becomes automatic.
Working through AI Liability, Data Privacy and Algorithmic Bias in IS5542? Sia is AskSia’s AI Information Technology tutor — ask any IS5542 AI Liability, Data Privacy and Algorithmic Bias question and get a clear, step-by-step explanation grounded in how IS5542 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
