CoChat
Sign Up
Cited by 516Digitalization, Law, and RegulationEthics and Social Impacts of AIExplainable Artificial Intelligence (XAI)

Meaningful information and the right to explanation

Open access
Selbst, Andrew D, Powles, Julia·2017·International Data Privacy Law
DOI 10.1093/idpl/ipx022
Open this paper in CoChat — free accountOpen PDF

Abstract

Key Points There is no single, neat statutory provision labelled the ‘right to explanation’ in Europe’s new General Data Protection Regulation (GDPR). But nor is such a right illusory. Responding to two prominent papers that, in turn, conjure and critique the right to explanation in the context of automated decision-making, we advocate a return to the text of the GDPR. Articles 13–15 provide rights to ‘meaningful information about the logic involved’ in automated decisions. This is a right to explanation, whether one uses the phrase or not. The right to explanation should be interpreted functionally, flexibly, and should, at a minimum, enable a data subject to exercise his or her rights under the GDPR and human rights law. In May 2018, Europe’s new General Data Protection Regulation (GDPR) will apply across all European Union Member States.1 The GDPR is an ambitious, complicated, contested law aimed at making Europe ‘fit for the digital age’.2 Among the law’s many provisions are several related to automated decision-making, notably, Article 22 and certain provisions of Articles 13–15. These provisions, which restrict automated decisions and require associated safeguards, are causing consternation among researchers, lawyers, and others concerned with decisions made by machine learning (ML) or artificial intelligence (AI). ML or AI systems are, among possible modes of decision-making, uniquely in danger of defying any human understanding.3 Automated decisions without any human intervention or understanding would seem to flout European ideas of autonomy and personhood.4 Therefore, these provisions exist to provide some meaningful information to data subjects about how their data is used. There is a fierce disagreement over whether these provisions create a data subject’s ‘right to explanation’. This article seeks to reorient that debate by showing that the plain text of the GDPR supports such a right. The ‘right to explanation’ debate has, in part, so captured imaginations because it is knotty, complex, and a non-trivial technical challenge to harness the full power of ML or AI systems while operating with logic interpretable to humans. This issue has drawn immense interest from the technical community.5 There is also rapidly increasing interest from a legal perspective, with a number of scholars beginning to explore both the importance of explanation as a normative value within the ML or AI context,6 as well as whether there is a requirement for explanation as a matter of positive law.7 The legal debate so far has concerned a conception of the right oddly divorced from the legislative text that best seems to support it. The most prominent contributions are two explosive papers out of Oxford, which immediately shaped the public debate.8 The first paper, by Bryce Goodman and Seth Flaxman, asserts that the GDPR creates a ‘right to explanation’, but does not elaborate much beyond that point.9 The second paper, from Sandra Wachter, Brent Mittelstadt, and Luciano Floridi, asserts that no such right presently exists.10 It does so by unnecessarily constraining the idea of the ‘right to explanation’, while conceiving of a different ‘right to be informed’ that amounts to a right to a particular type of explanation. We believe that Wachter and others' response is an overreaction to Goodman and Flaxman that distorts the debate, and that neither paper meaningfully addresses the most relevant provisions supporting such a right—specifically those that create rights to ‘meaningful information about the logic involved’ in automated decision-making. This debate appears headed in the wrong direction because it is missing such a major piece. Whether one uses the phrase ‘right to explanation’ or not, more attention must be paid to the GDPR’s express requirements and how they relate to its background goals, and more thought must be given to determining what the legislative text actually means. This article offers a positive conception of the right, located in the text and purpose of the GDPR. Articles 13(2)(f), 14(2)(g), and 15(1)(h) of the GDPR require data controllers to provide data subjects with information about ‘the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject’. Articles 13 and 14 are notification duties imposed on data controllers and Article 15 provides a right to access information throughout processing. Article 22(1), in turn, elaborates that data subjects ‘have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her’. Article 22(2)–(4) specifies limited circumstances where automated decision-making is permitted, and provides for different safeguards so t

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1093/idpl/ipx022

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • The GDPR arguably guarantees in law European data subjects' right to an explanation for AI processing of their records.

    “Such a move echoes the European General Data Protection Regulation's tenets, which arguably guarantee in law European data subjects' right to an explanation for AI processing of their records [ 53 ].”

    From Positioning Paradata: A Conceptual Frame for AI Processual Documentation in Archives and Recordkeeping Contexts (2023) · cites this paper as [53]

    The Introduction and Conclusion argue that the GDPR supports a data subject’s right to explanation of automated decisions. But the Articles 13–15 section describes the right in the context of solely automated decisions with legal or similarly significant effects, not AI processing of records generally. (LLM, conf=0.86)

    Experimental — accuracy not yet measured

  • Endeavours have been made to establish the right to explanation at a 'local' and 'ex post' level, targeting individual decisions, based on the GDPR provisions such as notification duties (Articles 13(2)(f) and 14(2)(g)) and the right of access (Article 15(1)(h)).

    “In response, endeavours have been made to establish the right to explanation at a ‘local’ and ‘ex post’ level, targeting individual decisions, based on the aforementioned and other provisions of the GDPR (Goodman and Flaxman, 2017, p. 55; Selbst and Powles, 2017, pp. 235–237), such as notification duties (Articles 13(2)(f) and 14(2)(g)) and the right of access (Article 15(1)(h)).”

    From Automated decision-making in South Korea: a critical review of the revised Personal Information Protection Act (2024) · cites this paper as Selbst and Powles, 2017, pp. 235–237

  • Enabling data subjects to exercise their right to contest a decision is directly dependent on the information or explanation concerning the decision provided by the data controller.

    “Several authors argue that enabling data subjects to exercise their right to contest a decision is directly dependent on the information or explanation concerning the decision provided by the data controller.”

    From Digitizing the public administration and safeguarding individual rights: automated decision-making at the intersection of the GDPR and Polish administrative procedure (2021) · cites this paper as Selbst, Powles (2017): 236

  • Where an automated decision involves personal data, the public body should have recorded the extent of human intervention in their DPIA.

    “Where an automated decision involves personal data, the public body should have recorded the extent of human intervention in their DPIA.”

    From Administrative law and the machines of government: judicial review of automated public-sector decision-making (2019) · cites this paper as [40]

    The ‘Legislative provisions at issue’ and ‘Two caveats’ sections discuss human intervention in automated decisions, but do not say that a public body should record its extent in a DPIA. Searches for ‘DPIA,’ ‘data protection impact assessment,’ and documentation of human oversight found no passage addressing that requirement. Page numbers were unavailable in our copy. (LLM, conf=0.74)

    Experimental — accuracy not yet measured

  • Raghavan et al.'s study makes it clear that the majority of automated hiring systems on the market are developed in the US.

    “Raghavan et al's [40] comprehensive study of automated hiring systems (AHSs) makes it clear that the majority of such systems on the market are developed in the US.”

    From What does it mean to 'solve' the problem of discrimination in hiring?: social, technical and legal perspectives from the UK on automated hiring systems (2020) · cites this paper as [40]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 1

  1. [1]1. B Goodman and S Flaxman, 'European Union Regulations on Algorithmic Decision-Making and a "Right to Explanation"' (2016) ICML Workshop on Human Interpretability in Machine Learning 26, arXiv:1606.08813 (v1). 28 ibid 28. 29 Goodman and Flaxman (n 9) 50, 55. 30 ibid. · arXiv

Cited by

Sorted by citations

Related

Authors
Selbst, A. D., & Powles, J.
Affiliations
  • University of California, Los Angeles (US)
  • University of Cambridge (GB)
ORCID
Venue
International Data Privacy Law
Publisher
Oxford University Press (OUP)
Published
2017-11-01
Volume
7
Issue
4
Pages
233-242
ISSN
  • 2044-3994 (ISSN-L)
  • 2044-4001
DOI
10.1093/idpl/ipx022
OpenAlex
W2768879061
Cited by
516
References
0
Citations by year
2026: 45 · 2025: 42 · 2024: 52 · 2023: 82 · 2022: 58 · 2021: 86 · 2020: 68 · 2019: 62 · 2018: 21
FWCI
426.54
Type
journal article
Language
en
Open access
Locations
International Data Privacy Law (publishedVersion)
Funders
NSF (IIS-1633400 and CNS-1704527)
Topics
  • Social Sciences › Law › Digitalization, Law, and Regulation
  • Social Sciences › Safety Research › Ethics and Social Impacts of AI
  • Physical Sciences › Computer Science › Artificial Intelligence › Explainable Artificial Intelligence (XAI)
Keywords
right to explanation, General Data Protection Regulation, automated decision-making, GDPR Article 22, meaningful information, transparency, data subject rights, machine learning, artificial intelligence, algorithmic accountability, human autonomy, human rights law, interpretability of AI

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review