{"$schema":"https://policywindow.org/critique/api/schema","generated_by":"agi-social-scientist","url":"https://policywindow.org/critique/r/data-protection-regulation","attestation":{"ok":true,"checks":[{"id":"coverage","label":"Coverage matrix re-derived from codings matches the published aggregate","pass":true,"detail":"12 codings → 5×6 matrix"},{"id":"gaps","label":"Re-derived empty cells are exactly the published gaps (identity, not just count)","pass":true,"detail":"24 re-derived; same cells; 24 published"},{"id":"included","label":"Unique included papers match the published inclusion count","pass":true,"detail":"12 re-derived vs 12 published"},{"id":"excluded","label":"Excluded records match the published exclusion count","pass":true,"detail":"17 re-derived vs 17 published"},{"id":"spans","label":"Every inclusion carries a verbatim rationale span (AGISS P1: ≥20 chars)","pass":true,"detail":"shortest span 58 chars (min 20)"}],"derived":{"coverage":{"rights_and_remedies":{"conceptual_normative":0,"legal_doctrinal":5,"empirical_qualitative":0,"empirical_quantitative":0,"technical_review_survey":0,"review_synthesis":0},"compliance_engineering":{"conceptual_normative":0,"legal_doctrinal":0,"empirical_qualitative":0,"empirical_quantitative":0,"technical_review_survey":3,"review_synthesis":0},"public_sector_judicial_review":{"conceptual_normative":0,"legal_doctrinal":1,"empirical_qualitative":0,"empirical_quantitative":0,"technical_review_survey":0,"review_synthesis":0},"health_sector_application":{"conceptual_normative":1,"legal_doctrinal":0,"empirical_qualitative":0,"empirical_quantitative":0,"technical_review_survey":0,"review_synthesis":1},"regulation_overviews":{"conceptual_normative":1,"legal_doctrinal":0,"empirical_qualitative":0,"empirical_quantitative":0,"technical_review_survey":0,"review_synthesis":0}},"totalCodings":12,"uniqueIncluded":12,"emptyCells":24,"excluded":17,"minSpanLength":58},"reportHash":"70b08d31a3678196","corpusHash":"c8bde2ddcf21d5be"},"id":"data-protection-regulation","reviewId":"CR-REV-004","agissStem":"data-protection-regulation","question":"What does the scholarly literature report on data protection regulation in the context of AI?","title":"Evidence gap map: data protection regulation in the AI literature","reviewKind":"evidence_gap_map","method":"scoping_review_v1","headline":"Across a 5x6 framework matrix, 24 of 30 cells have no papers in this corpus of 12 included records; the populated cells concentrate in aspect 'rights_and_remedies' (5 papers) and evidence type 'legal_doctrinal' (6 papers).","verdict":"evidence_gap_map conducted over 29 records (12 included, 17 excluded with reasons): a coverage map with 24 named empty cells. Counts only — no importance adjudication (Sacred Rule 9); the report re-derives offline from corpus + codings.","coderModelId":"in-session:claude-agent","codingFrame":{"aspects":["rights_and_remedies","compliance_engineering","public_sector_judicial_review","health_sector_application","regulation_overviews"],"evidenceTypes":["conceptual_normative","legal_doctrinal","empirical_qualitative","empirical_quantitative","technical_review_survey","review_synthesis"]},"coverage":{"compliance_engineering":{"conceptual_normative":0,"empirical_qualitative":0,"empirical_quantitative":0,"legal_doctrinal":0,"review_synthesis":0,"technical_review_survey":3},"health_sector_application":{"conceptual_normative":1,"empirical_qualitative":0,"empirical_quantitative":0,"legal_doctrinal":0,"review_synthesis":1,"technical_review_survey":0},"public_sector_judicial_review":{"conceptual_normative":0,"empirical_qualitative":0,"empirical_quantitative":0,"legal_doctrinal":1,"review_synthesis":0,"technical_review_survey":0},"regulation_overviews":{"conceptual_normative":1,"empirical_qualitative":0,"empirical_quantitative":0,"legal_doctrinal":0,"review_synthesis":0,"technical_review_survey":0},"rights_and_remedies":{"conceptual_normative":0,"empirical_qualitative":0,"empirical_quantitative":0,"legal_doctrinal":5,"review_synthesis":0,"technical_review_survey":0}},"gaps":["rights_and_remedies x conceptual_normative: 0 papers","rights_and_remedies x empirical_qualitative: 0 papers","rights_and_remedies x empirical_quantitative: 0 papers","rights_and_remedies x technical_review_survey: 0 papers","rights_and_remedies x review_synthesis: 0 papers","compliance_engineering x conceptual_normative: 0 papers","compliance_engineering x legal_doctrinal: 0 papers","compliance_engineering x empirical_qualitative: 0 papers","compliance_engineering x empirical_quantitative: 0 papers","compliance_engineering x review_synthesis: 0 papers","public_sector_judicial_review x conceptual_normative: 0 papers","public_sector_judicial_review x empirical_qualitative: 0 papers","public_sector_judicial_review x empirical_quantitative: 0 papers","public_sector_judicial_review x technical_review_survey: 0 papers","public_sector_judicial_review x review_synthesis: 0 papers","health_sector_application x legal_doctrinal: 0 papers","health_sector_application x empirical_qualitative: 0 papers","health_sector_application x empirical_quantitative: 0 papers","health_sector_application x technical_review_survey: 0 papers","regulation_overviews x legal_doctrinal: 0 papers","regulation_overviews x empirical_qualitative: 0 papers","regulation_overviews x empirical_quantitative: 0 papers","regulation_overviews x technical_review_survey: 0 papers","regulation_overviews x review_synthesis: 0 papers"],"disclosedFragilities":["scoping retrieval with fixed queries, not a systematic search (coverage is query-bounded)","coding from abstracts only — full texts were not consulted; cells count papers, not extracted effect estimates","single-annotator coding (in-session:claude-agent); no second coder, no kappa","corpus bounded to 29 retrieved records; counts are corpus-relative, not field-level claims"],"nCorpus":29,"nIncluded":12,"nExcluded":17,"reportHash":"70b08d31a3678196","corpusHash":"c8bde2ddcf21d5be","selection":{"method":"review_selector_v1","selectedKind":"evidence_gap_map","features":{"corpus_kind":"mixed","full_texts_available":false,"has_quantitative_effects":false,"n_studies":29,"n_with_abstracts":25,"outcomes_comparable":false},"selectionHash":"b43a8bc3c9476dcb","verdict":"Review-kind selection for 'What does the scholarly literature report on data protection regulation in the context of AI?': SELECTED evidence_gap_map; 0 kind(s) rejected with their failed requirements recorded. A methodological screen (Sacred Rule 9): the selection is disclosed on the article and the selected kind's own discipline still applies at conduct time."},"includedCodings":[{"openalexId":"W2467510144","title":"EU regulations on algorithmic decision-making and a \"right to explanation\".","venue":"arXiv (Cornell University)","year":2016,"doi":null,"aspect":"rights_and_remedies","evidenceType":"legal_doctrinal","rationaleSpan":"We summarize the potential impact that the European Union's new General Data Protection Regulation will have on the routine use of machine learning algorithms"},{"openalexId":"W2493343568","title":"European Union Regulations on Algorithmic Decision Making and a “Right to Explanation”","venue":"AI Magazine","year":2017,"doi":"10.1609/aimag.v38i3.2741","aspect":"rights_and_remedies","evidenceType":"legal_doctrinal","rationaleSpan":"place restrictions on automated individual decision making"},{"openalexId":"W2795807997","title":"The General Data Protection Regulation","venue":"","year":2018,"doi":"10.1145/3170427.3170632","aspect":"regulation_overviews","evidenceType":"conceptual_normative","rationaleSpan":"Awareness of the responsibility is emerging as a key concern for the HCI community"},{"openalexId":"W2899579542","title":"A Right to Reasonable Inferences: Re-Thinking Data Protection Law in the Age of Big Data and AI","venue":"","year":2018,"doi":"10.31228/osf.io/mu2kf","aspect":"rights_and_remedies","evidenceType":"legal_doctrinal","rationaleSpan":"Big Data analytics and artificial intelligence (AI) draw non-intuitive and unverifiable inferences and predictions about the behaviors, preferences, and private lives of individuals"},{"openalexId":"W2963473400","title":"Human intervention in automated decision-making","venue":"","year":2019,"doi":"10.1145/3322640.3326699","aspect":"rights_and_remedies","evidenceType":"legal_doctrinal","rationaleSpan":"a right to human intervention on decision-making supported by artificial intelligence"},{"openalexId":"W3123074717","title":"Administrative law and the machines of government: judicial review of automated public-sector decision-making","venue":"Legal Studies","year":2019,"doi":"10.1017/lst.2019.9","aspect":"public_sector_judicial_review","evidenceType":"legal_doctrinal","rationaleSpan":"there is no clear understanding of how English administrative law will apply to this kind of decision-making"},{"openalexId":"W3124443940","title":"Why a Right to Explanation of Automated Decision-Making Does Not Exist in the General Data Protection Regulation","venue":"International Data Privacy Law","year":2017,"doi":"10.1093/idpl/ipx005","aspect":"rights_and_remedies","evidenceType":"legal_doctrinal","rationaleSpan":"there are several reasons to doubt both the legal existence and the feasibility of such a right"},{"openalexId":"W3174532363","title":"Amnesiac Machine Learning","venue":"","year":2021,"doi":"10.1609/aaai.v35i13.17371","aspect":"compliance_engineering","evidenceType":"technical_review_survey","rationaleSpan":"It gives EU residents the ability to request deletion of their personal data, including training records used to train machine learning models"},{"openalexId":"W3183843234","title":"A combined rule-based and machine learning approach for automated GDPR compliance checking","venue":"","year":2021,"doi":"10.1145/3462757.3466081","aspect":"compliance_engineering","evidenceType":"technical_review_survey","rationaleSpan":"The General Data Protection Regulation (GDPR) requires data controllers to implement end-to-end compliance"},{"openalexId":"W3200759624","title":"Privacy and artificial intelligence: challenges for protecting health information in a new era","venue":"BMC Medical Ethics","year":2021,"doi":"10.1186/s12910-021-00687-3","aspect":"health_sector_application","evidenceType":"review_synthesis","rationaleSpan":"Advances in healthcare artificial intelligence (AI) are occurring rapidly and there is a growing discussion about managing its development"},{"openalexId":"W4221106857","title":"Legal and Ethical Consideration in Artificial Intelligence in Healthcare: Who Takes Responsibility?","venue":"Frontiers in Surgery","year":2022,"doi":"10.3389/fsurg.2022.862322","aspect":"health_sector_application","evidenceType":"conceptual_normative","rationaleSpan":"The legal and ethical issues that confront society due to Artificial Intelligence (AI) include privacy and surveillance, bias or discrimination"},{"openalexId":"W4411613979","title":"Secure Data Backup Strategies for Machine Learning: Compliance and Risk Mitigation Regulatory requirements (GDPR, HIPAA, etc.)","venue":"International Journal of Emerging Trends in Computer Science and Information Technology","year":2020,"doi":"10.63282/3050-9246.ijetcsit-v1i1p104","aspect":"compliance_engineering","evidenceType":"technical_review_survey","rationaleSpan":"organizations find it more difficult to ensure data confidentiality, integrity, and compliance with strict criteria"}],"excludedPapers":[{"openalexId":"W2111275873","title":"Use (and abuse) of expert elicitation in support of decision making for public policy","venue":"Proceedings of the National Academy of Sciences","year":2014,"doi":"10.1073/pnas.1319946111","exclusionReason":"off-topic: expert elicitation methodology; not AI data protection"},{"openalexId":"W2582721310","title":"Why a Right to Explanation of Automated Decision-Making Does Not Exist in the General Data Protection Regulation","venue":"SSRN Electronic Journal","year":2016,"doi":"10.2139/ssrn.2903469","exclusionReason":"no abstract available for coding (abstracts-only protocol)"},{"openalexId":"W2899768131","title":"Machine learning in medicine: Addressing ethical challenges","venue":"PLoS Medicine","year":2018,"doi":"10.1371/journal.pmed.1002689","exclusionReason":"off-topic: ethics commentary on ML in medicine; data protection regulation not the subject"},{"openalexId":"W2899809344","title":"Administrative Law and the Machines of Government: Judicial Review of Automated Public-Sector Decision-Making","venue":"SSRN Electronic Journal","year":2018,"doi":"10.2139/ssrn.3226913","exclusionReason":"no abstract available for coding (abstracts-only protocol)"},{"openalexId":"W2950865323","title":"Edge Intelligence: Paving the Last Mile of Artificial Intelligence With Edge Computing","venue":"Proceedings of the IEEE","year":2019,"doi":"10.1109/jproc.2019.2918951","exclusionReason":"off-topic: edge computing architectures"},{"openalexId":"W2969625533","title":"Artificial Intelligence (AI): Multidisciplinary perspectives on emerging challenges, opportunities, and agenda for research, practice and policy","venue":"International Journal of Information Management","year":2019,"doi":"10.1016/j.ijinfomgt.2019.08.002","exclusionReason":"off-topic: broad AI overview"},{"openalexId":"W2979906316","title":"How artificial intelligence will change the future of marketing","venue":"Journal of the Academy of Marketing Science","year":2019,"doi":"10.1007/s11747-019-00696-0","exclusionReason":"off-topic: AI in marketing"},{"openalexId":"W2981731882","title":"Explainable Artificial Intelligence (XAI): Concepts, taxonomies, opportunities and challenges toward responsible AI","venue":"Information Fusion","year":2019,"doi":"10.1016/j.inffus.2019.12.012","exclusionReason":"no abstract available for coding (abstracts-only protocol)"},{"openalexId":"W2982580298","title":"Key challenges for delivering clinical impact with artificial intelligence","venue":"BMC Medicine","year":2019,"doi":"10.1186/s12916-019-1426-2","exclusionReason":"off-topic: clinical AI deployment challenges"},{"openalexId":"W2997468044","title":"In AI we trust? Perceptions about automated decision-making by artificial intelligence","venue":"AI & Society","year":2020,"doi":"10.1007/s00146-019-00931-w","exclusionReason":"no abstract available for coding (abstracts-only protocol)"},{"openalexId":"W3000463950","title":"Explainable Machine Learning in Credit Risk Management","venue":"Computational Economics","year":2020,"doi":"10.1007/s10614-020-10042-0","exclusionReason":"off-topic: explainable credit-risk model"},{"openalexId":"W3000603264","title":"The role of artificial intelligence in achieving the Sustainable Development Goals","venue":"Nature Communications","year":2020,"doi":"10.1038/s41467-019-14108-y","exclusionReason":"off-topic: AI effects on SDGs"},{"openalexId":"W3012501605","title":"The future of digital health with federated learning","venue":"npj Digital Medicine","year":2020,"doi":"10.1038/s41746-020-00323-1","exclusionReason":"off-topic: federated learning methods; regulation not the subject"},{"openalexId":"W3104128335","title":"Challenges in Deploying Machine Learning: A Survey of Case Studies","venue":"ACM Computing Surveys","year":2022,"doi":"10.1145/3533378","exclusionReason":"off-topic: ML deployment survey"},{"openalexId":"W3138815606","title":"Membership Inference Attacks on Machine Learning: A Survey","venue":"ACM Computing Surveys","year":2022,"doi":"10.1145/3523273","exclusionReason":"off-topic: membership-inference attack survey; regulation not the subject"},{"openalexId":"W4386958277","title":"Revolutionizing healthcare: the role of artificial intelligence in clinical practice","venue":"BMC Medical Education","year":2023,"doi":"10.1186/s12909-023-04698-z","exclusionReason":"off-topic: AI-in-clinical-practice review"},{"openalexId":"W4402843978","title":"Interpretable machine learning","venue":"","year":2020,"doi":"10.58248/pn633","exclusionReason":"off-topic: interpretable ML methods"}],"narrativeMarkdown":"# Evidence gap map: data protection regulation in the AI literature\n\n## In plain terms\n\nThis is the first topic the engine chose for itself from its own reading: \"data protection regulation\" surfaced as a candidate while mapping earlier corpora, was measured live against policy and scholarly volumes, and entered the study queue as robust. The map of its literature: rich legal-doctrinal debate about rights — the contested \"right to explanation,\" human intervention, reasonable inferences — and a growing compliance-engineering strand, with 24 of 30 matrix cells empty and not one included paper reporting empirical study of the regulation operating in practice.\n\n**Finding (screened coverage map):** Across a 5x6 framework matrix, 24 of 30 cells have no papers in this corpus of 12 included records; the populated cells concentrate in aspect 'rights_and_remedies' (5 papers) and evidence type 'legal_doctrinal' (6 papers).\n\n## Background\n\nPolicy Window's research engine selected the review kind BEFORE this article was drafted: a review-kind selector matched the question (\"What does the scholarly literature report on data protection regulation in the context of AI?\") and the measured corpus features (29 records, 25 with abstracts, no comparable quantitative effects, abstracts only) to an evidence gap map (selection `b43a8bc3c9476dcb`). The article's status is a screened candidate routed to human review, not an adjudicated truth (Sacred Rule 9).\n\n## Method\n\nEvery record was coded exactly once against a declared frame — five regulation aspects (rights and remedies, compliance engineering, public-sector judicial review, health-sector application, regulation overviews) by six evidence types — with a verbatim rationale span per inclusion and a stated reason per exclusion (17 records excluded: off-topic or no abstract). Review report `70b08d31a3678196`; corpus `c8bde2ddcf21d5be`.\n\n## What the map shows\n\nThe populated region: the right-to-explanation debate in its full arc (the claim that the GDPR mandates explanation, the doctrinal rebuttal that no such right exists, the proposed right to reasonable inferences, the right to human intervention), judicial-review analysis of automated public-sector decisions, technical compliance work (GDPR compliance checking, machine unlearning for the right to be forgotten), and health-sector commentary. The named empty cells include every regulation aspect crossed with empirical evidence of either kind — the fourth serviced topic in a row whose corpus contains no included paper measuring the regulation in operation.\n\n## Limitations (disclosed by the engine)\n\n- scoping retrieval with fixed queries, not a systematic search (coverage is query-bounded)\n- coding from abstracts only — full texts were not consulted; cells count papers, not extracted effect estimates\n- single-annotator coding (in-session:claude-agent); no second coder, no kappa\n- corpus bounded to 29 retrieved records; counts are corpus-relative, not field-level claims\n\n## Verify\n\nEvery count above re-derives offline from the committed corpus and codings — no model, no network, no trust in the institute required: `PYTHONPATH=src python scripts/verify_review_data_protection_regulation.py  # exit 0 = re-derives offline`\n","verifyCommand":"PYTHONPATH=src python scripts/verify_review_data_protection_regulation.py  # exit 0 = re-derives offline","aiAgiCategories":["law_regulation","AI_governance"],"publicationDate":"2026-06-14","published":true}