| name | ai-data-subject-rights |
| title | Data Subject Rights for AI Systems |
| description | Implements data subject rights mechanisms for AI systems including right to explanation of AI decisions, contestation procedures, human review, model output correction, and training data access. Covers GDPR Arts. 15-22 and AI Act Art. 86. Keywords: data subject rights, AI explanation, contestation, human review, training data access, model correction. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/ai-data-subject-rights |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Data Subject Rights for AI Systems
Overview
AI systems create unique challenges for data subject rights exercise. Traditional rights mechanisms designed for structured databases do not map directly to ML model architectures where personal data is encoded in model weights, reproduced in model outputs, or used in opaque decision processes. This skill provides the framework for implementing each GDPR right (Arts. 15-22) and the AI Act Art. 86 right to explanation in the context of AI processing, addressing both training-time and inference-time rights.
Rights Framework for AI
Right of Access (Art. 15)
| AI Context | Obligation | Implementation |
|---|
| Training data contribution | Confirm whether data subject's data was in training set; provide copy if feasible | Training data catalogue indexed by data subject identifier; membership query |
| AI inference inputs | Provide data used as input to AI decision | Log inference inputs with data subject linkage |
| AI inference outputs | Provide AI decision/score/classification affecting data subject | Decision logging with data subject ID |
| Logic explanation | Art. 15(1)(h): meaningful information about logic of automated decisions | SHAP/LIME explanation on request or system-level explanation |
| Training data source | Art. 14(2)(f): source of data if not collected from data subject | Training data provenance documentation |
Technical Challenges:
- Identifying specific records in massive training datasets
- Determining if a data subject's data is in the training set without running membership inference
- Providing meaningful logic explanation for complex models
Right to Rectification (Art. 16)
| AI Context | Obligation | Implementation |
|---|
| Training data correction | Correct inaccurate data in training dataset | Update training data; assess if model retraining needed |
| Model output correction | Correct inaccurate AI outputs about a data subject | Output correction mechanism; flag in decision system |
| Inference input correction | Correct data used as inference input | Update input data; re-run inference |
: Correcting training data may require model retraining to propagate the correction. For deployed models, correction may need model update or retraining pipeline.
