• Third party audit of algorithms – anticipated
by data impact assessments under Article 24
requiring data controllers to evaluate “the
risks of varying likelihood and severity for
the right and freedoms of natural persons.”
In New Zealand, concerns have been raised about
the use of computer-based risk prediction models
by the Accident Compensation Corporation (ACC)
to profile and target clients. University of Otago
researchers have warned against the dangers
of such tools.243 While final decisions appear to
come down to the case manager, the researchers
raised concerns that “their decisions are guided
by advice generated automatically by a machine,
based on a large set of data extending far
beyond their own experience.” The researchers
recommend that Governments and companies
consider the following when using such tools:
• Accuracy of the tool, including a thorough
description of the data set on which it was
assessed
• Ability to explain how the tool works so that
clients can appeal decision
• Distortion in the way the agency pursues its
policy objectives
• Responsibility to make fair and humane
decisions
• Whether the tool implicitly discriminates
against individuals
• Training employees in the use of the system
6.5 Role of Business
While Governments are primarily responsible
for protecting human rights, the United Nations
Guiding Principles on Business and Human Rights
(UNGPs) make clear that all businesses have a
responsibility to respect human rights.244 The
UNGPs are the authoritative global standard
on business and human rights, endorsed by the
United Nations Human Rights Council in 2011.
They consist of 31 principles that set out the
expectations of states and businesses human
rights.
243 http://www.otago.ac.nz/humanities/news/otago664403.html
244 http://www.ohchr.org/Documents/Publications/GuidingPrinciplesBusinessHR_EN.pdf
Under the UNGPs, States must protect against
human rights abuses within their territory by
third parties, including businesses, and should
set clear expectations that businesses respect
human rights. Businesses are also required to
respect human rights. The foundation principle
of the corporate responsibility to respect human
rights is that businesses should avoid infringing
on the human rights of others and should address
adverse human rights impacts with which they
are involved. The three key components of the
corporate responsibility to respect human rights
can be summarised as:
• A public commitment to respect human
rights: The responsibility to respect human
rights refers to internationally recognised
human rights, including the International
Bill of Human Rights, International Labour
Organization’s
(ILO)
Declaration
on
Fundamental Principles and Rights at Work.
• An ongoing process of human rights due
diligence: This includes an assessment of
risks to human rights; integrating findings
of human rights impact assessments across
relevant internal functions and processes;
and tracking the effectiveness of response
to human rights impacts.
• Having processes in place to enable a
remedy when companies identify that they
have caused or contributed to adverse
human rights impacts
The UNGPs are increasingly important as
businesses gather vast amounts of personal data
about individuals and use it for purposes that it
was not originally intended for, placing individual
data privacy at risk. These issues were recently
brought to light after Facebook admitted that
Cambridge Analytica, a data mining and targeting
company, used the personal data of 87 million
of its users to create psychographic profiles.
The international human rights framework and
importantly the UNGPs are becoming more
relevant as individuals are becoming increasingly
concerned about the use of personal data by
46