Data Protection in Cloud Robotics - Transparency and Security Issues

I. Introduction

‘Cloud computing’² refers to the use of a shared pool of flexible, on-demand, computing resources — servers, data storage, network access, database management, application software, including specialized services and capabilities such as blockchain and artificial intelligence (AI) — over the internet. It is a model that allows efficient use of resources- by hiring rather than owning the resources through remote access of data and services to achieve economies of scale. While accessing data or software from different locations in our online transactions are common examples of cloud computing, nowadays, robots³ such as medical robots, assistive robots also use such technologies. The benefits of cloud computing – greater processing capability, reliability, scalability, agility, efficiency, which accrue from robust computation, storage, and communication resources of modern data centres in the cloud, are also available to robots when connected to the cloud. It also enables humans to command or delegate tasks to robots remotely through networks without being physically present⁴. Thus, cloud robotics is a culmination of physical robots and virtual AI- with cloud connectedness for memory, computation, and processing capability.

Obviously, such complex ecosystems would require a regulatory and legal framework, which ought to be an efficient sum of legal provisions applicable to its various components. While on the one hand, legal issues pertaining to cloud computing are applicable law, jurisdiction, accountability, protection of personal data of the end-users (confidential data theft attacks), data portability, intellectual property rights issues such as copyright⁵, on the other hand, legal issues about robots are their legal status, product liability, damages, invasion of privacy, protection of information, rights of robots⁶. Therefore, the combination of cloud services with a robot gives rise to legal concerns of a higher order. Being a multi-layered networked ecosystem consisting of products and services, it faces a fragmented regulatory environment – general product safety directives for robots, liability directives for robots, regulations for industrial robots and medical robots, directives for radio equipment as well as GDPR for data protection. However, the application of these directives and regulations in cloud robotics cannot be straightforward because of its multidimensional characteristics.

A cloud robotics ecosystem works in different planes- storage plane, data plane, control plane, application plane, and robot having complex and interdependent chains of responsibility. As early as 2011, Weng and Zhao, while examining various legal and regulatory issues of networked robotics, had concluded that “there is a high possibility of cloud-enabled networked robots to transfer risk bi-directionally between the physical and digital world” ⁷. This transfer of risks into two worlds, tangible and intangible, ‘poses greater challenges to regulatory frameworks than the mere-standalone robot’⁸. These challenges include but not limited to diverse legal obligations and liabilities such as data ownership, data privacy, and protection compliance requirements, uncertainties regarding software security, and fragmented contractual arrangements⁹. Out of these, because of the dual characteristics (physical-cyber or tangible-intangible) of a robotic cloud ecosystem, data security and transparency issues have been foremost concerns for system integrators, manufacturers, developers, users, and regulators. As cloud robotics handle an enormous amount of sensitive data, any data breach and lack of transparency are grave concerns and necessitates the identification of the commands, controls, and processes involved in the event to formulate and establish remedial legal and regulatory measures.

II. Controlling and processing in cloud robotics

Addressing transparency and data security issues in any computing services, be it on-site or cloud services, would necessarily require identification of the ‘controller’ and ‘processor’¹⁰ of data to allocate responsibilities as enshrined under Art 24 and Art 28 of GDPR. Since cloud robots involve multiple players- cloud service providers, robot suppliers (hardware manufacturers), software developers, their sub-vendors, and users with complex interconnectedness, determining which player should be held accountable for what and identifying precisely the ‘controller’ and the ‘processor’ is challenging. While a ‘Controller’ or ‘Joint Controllers’ are obliged to implement various measures to demonstrate compliance of regulations¹¹, because of the very nature of the transactions which takes place in the case of cloud computing, it becomes difficult, though not impossible, to identify controller and processor in a cloud robotics ecosystem. In the case of cloud robotics, the developer of the software that controls the robot, the persons responsible for operating the robot, starting the software, and maintaining it, and the end-user could be the controller. Even an advanced robot that is autonomous and can learn through experience could be performing the tasks of a controller. The dilemma is - as per GDPR, a controller has to be 'a natural or legal person'. Identifying the role of the processor is also equally strenuous in cloud robotics, especially in an environment where robots provide services. Usually, the PaaS Provider¹² is the processor in cloud robotics, which depends on how the robot is configured, e.g., whether the robot includes applications from other providers or whether it has access to other technologies.

Addressing any challenge arising from the complexity of players involved requires identification and mapping of precise interactions and communications between the different players, such as robot2robot, wearable2robot, robot2cloud, person2cloud, sensors2cloud, sensors2robot¹³. This mapping would be relevant for understanding robot learning processes – regarding the source of information, trust, and security – but also for a clear division of responsibilities, which should be carefully modelled and detailed in a contract between the different players and also needs to take into account for the complexity of the relationship between the players. However, if in the future, certain types of robots are given ‘electronic personality’, as suggested by the European Parliament¹⁴, it is to be seen whether a robot might itself be treated as a data controller or a data processor.

III. Addressing transparency issues

Transparency requires that the intended public or data subjects must know and understand what, how, why, and by whom such information is being collected, even if the reasons and methods are technologically sophisticated¹⁵. However, major cloud service providers (including online players such as Google, Facebook) indulge in the trade of anonymized and aggregated metadata. Although a significant revenue stream and accepted practice and business model to reduce the cost of the service, such practices raise concerns about transparency and user rights ¹⁶.

In a multi-layered interconnected complex physical-cyber ecosystem such as cloud robotics, the issue of transparency and user rights gets further aggravated. In a robotic cloud ecosystem, if the cloud service providers such as PaaS follow this business model, it would mean that they would be involved in retailing meta-data acquired from robots to third-party customers such as advertising companies. While this may be a profit-making point for the PaaS provider, there is a potential lack of transparency due to the interactions of PaaS with robots.

Such lack of transparency in cloud robotics is particularly problematic in healthcare systems, given the sensitivity of the health-related data coupled with the scope and extent of the data collection, including data from the intimate sphere of users. The domestic care robots usually collect health-related data, and thus the resulting potential complexity and reach of information that could be derived from such data are particularly worrisome. This trade-off of data, especially in the healthcare sector, would leave users vulnerable and would raise additional concerns about the utilization of data derived from such robots¹⁷. It would, therefore, need to be clarified whether transparency and opt-out requirements in this context which potentially exceed transparency requirements in another commercial context, due to the particularly sensitive nature of the data used. The European Parliament, while proposing civil law rules on robotics, also highlights the principles of transparency so that the rationale of decisions of robots and AI is comprehensible to humans¹⁸.

Article 12-15 of GDPR requires controllers data subjects with transparent information on identity and contact details of the data controller(s); the purpose(s) and the legal bases of data processing; the recipients or categories of recipients of personal data (if any); where applicable, the intention to transfer data outside the EU and the adequacy decision or appropriate safeguards applied; the duration of personal data is being stored; and data subjects’ rights¹⁹. Further, when discussing transparency, we must refer to the right to explanation enshrined under Recital 71, GDPR²⁰. According to this right, there is a need to provide 'meaningful information' regarding the machine's autonomous decision making and, hence, obliges the controller to explain the decisions arising from autonomous assessments by the robot and allow the users to challenge such decisions²¹. 'Meaningful information,' i.e., understanding of the autonomous decision made by the robots, may be difficult to deliver in practice as machine learning algorithms may sometimes be complex, and their learning processes may also be dynamic and opaque. In many cases, for instance, it may not be enough to merely have access to all algorithms and data in order to replicate, predict, and thus, explain system behaviour. This is because the algorithmic process may have evolved as the new training data have been incorporated²².

About cloud robotics, providing accurate and accessible information about the nature of the robot's information processing is particularly challenging. The complexities of data processing in cloud robotics ecosystems compound the potential lack of transparency even to those responsible for communicating with end-users. Such complexities arise in the context of the exact implementation of service provision or potentially varying conditions of sub-contracting elements, further resulting in uncertainties regarding who provides which aspect of services, where those services are located, and what potential risks are associated with them²³.

In this regard, the European Parliament has recommended that designers ensure traceability of the robot's decision-making steps, predictability of robot behaviour, and maximum transparency in programming. The recommendations also include “to develop tracing tools at the robot’s design stage. These tools will facilitate accounting and explanation of robot behaviour, even if limited, at the various levels intended for experts, operators, and users”²⁴. However, this solves only the transparency issues associated with the physical part of cloud robotics.

IV. Data security in cloud robotics ecosystem

Another significant concern for cloud robotics is data security. With the robots being combined with the cloud, it is more feasible to transfer additional information and data with a correspondingly higher risk of data breaches between different entities as compared to a standalone robot. In cloud computing Software Define Network models, a random anonymous controller (out of many) issues a command for data transmissions to reduce the threat on a particular controller. At the same time, verifiable outsourcing protocol can be deployed in the data plane for cloud service providers²⁵. Still, highly sensitive data (e.g., private health-related personal data) could potentially be intercepted while robots communicate with cloud servers. Due to the scheme of PaaS (client-server paradigm), the exchange of data from the device (robot) to the PaaS endpoint (cloud) must also be secured, and this will most often be the responsibility of the data-controller (developer or owner) as the process flow is always initiated from the device to the cloud²⁶. Nevertheless, instances of data breaches have to be reported in compliance with Art 33 and Art 34 of GDPR²⁷.

Therefore, it is imperative to assign clear responsibilities for data security and ensure that the appropriate processes are in place to identify and communicate any emerging risks or breaches. The robotic cloud ecosystem must be verifiable for its integrity and security by the user or a trusted third party to ensure that no malicious code which can cause data breach is running. The European Parliament recommends that designers should introduce trustworthy system design principles across all aspects of a robot’s operation, for both hardware and software design, and for any data processing on or off the platform for security purposes²⁸. The system should have in-built features to keep private information secure. Overall, technological solutions to data security must be data protection compliant, i.e., they should ensure an adequate level of protection of personal data, as per the requirements of Art. 32 GDPR²⁹. The minimum to expect from any cloud robotic ecosystem is to have safeguards in the form of due diligence of its players, executing legally binding contracts, restricting access, use and disclosure of personal information, establishing technical, organizational safeguards, and above all, notifying data subjects in case of any breach.

V. Conclusion

By introducing anonymous, randomized controllers, data integrity, audit & verification, transparency, and security issues could be addressed in cloud computing. However, the risks associated with cloud robotics, such as missing or disrupted connectivity and the proliferation of attack services, deserve increased scrutiny of technologists, legislators, and regulators. The growing interdependence between robots and cloud services raises a number of legal and regulatory challenges, including the adaptation of safety regulations, application of data protection rules, and attributing liabilities.

Because of the self-evolving nature of robots, applying the provisions of the GDPR in a cloud robotics ecosystem appears to be inadequate. While the job of ‘controller’ and ‘processor’ as defined under GDPR is mostly executed by robots, they cannot be controller or processor (by virtue of not being a person). Till the time robots are given the status of ‘electronic personality’, the actual ‘controllers’ and ‘processors’ may not be held accountable. Nevertheless, a broader legal framework encompassing robots and cloud computing legal concerns would be helpful for cloud robotics. The dual tangible - virtual elements of cloud robotics with the possibility to transfer risk bi-directionally, the complexity of delivery ecosystems, and multiple participants in obligations and rights necessitates the development of a more integrated regulatory framework.

*****

VI. Bibliography

1. Delvaux M, ‘Report with Recommendations to the Commission on Civil Law Rules on Robotics (2015/2103(INL))’ (European Parliament 2017) P8_TA(2017)0051 <http://www.europarl.europa.eu/doceo/document/TA-8-2017-0051_EN.pdf> accessed 29 January 2020

2. Du Z and others, ‘Robot Cloud: Bridging the Power of Robotics and Cloud Computing’ (2017) 74 Future Generation Computer Systems 337 <https://linkinghub.elsevier.com/retrieve/pii/S0167739X16000042> accessed 16 May 2020

3. EU, ‘European Parliament Resolution of 16 February 2017 with Recommendations to the Commission on Civil Law Rules on Robotics (2015/2103(INL))’ 19 <https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52017IP0051&from=EN> accessed 16 May 2020

4. ——, ‘Article 12-15, GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council’ <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&rid=3> accessed 24 July 2020

5. ——, ‘Article 26, GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council’ <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&rid=3> accessed 24 July 2020

6. ——, ‘Article 32, GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council’ <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&rid=3> accessed 24 July 2020

7. ——, ‘Article 33 and 34, GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council’ <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&rid=3> accessed 24 July 2020

8. ——, ‘GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council’ <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&rid=3> accessed 24 July 2020

9. ——, ‘Recital 58, GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council’ <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&rid=3> accessed 24 July 2020

10. ——, ‘Recital 71, GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council’ <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&rid=3> accessed 24 July 2020

11. Fosch-Villaronga E and others, ‘Cloud Services for Robotic Nurses? Assessing Legal and Ethical Issues in the Use of Cloud Services for Healthcare Robots’, 2018 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS) (IEEE 2018) <https://ieeexplore.ieee.org/document/8593591/> accessed 16 May 2020

12. Fosch-Villaronga E and Millard C, ‘Cloud Robotics Law and Regulation’ (2019) 119 Robotics and Autonomous Systems 77 <https://linkinghub.elsevier.com/retrieve/pii/S092188901930051X> accessed 16 May 2020

13. Hourani H and Abdallah M, Cloud Computing: Legal and Security Issues (2018)

14. Ishii K, ‘Comparative Legal Study on Privacy and Personal Data Protection for Robots Equipped with Artificial Intelligence: Looking at Functional and Technological Aspects’ (2019) 34 AI & SOCIETY 509 <https://doi.org/10.1007/s00146-017-0758-8> accessed 16 May 2020

15. ‘ISO 8373:2012(En), Robots and Robotic Devices — Vocabulary’ <https://www.iso.org/obp/ui/#iso:std:iso:8373:ed-2:v1:en:term:4.3> accessed 24 July 2020

16. Kroll JA and others, ‘Accountable Algorithms’ 165 University of Pennsylvania Law Review 74

17. Leenes R and others, ‘Regulatory Challenges of Robotics: Some Guidelines for Addressing Legal and Ethical Issues’ (2017) 9 Law, Innovation and Technology 1 <https://doi.org/10.1080/17579961.2017.1304921> accessed 16 May 2020

18. ‘Legal Issues around Cloud Computing’ (Rick’s Cloud, 2 July 2013) <https://rickscloud.com/legal-issues-around-cloud-computing/> accessed 16 May 2020

19. Mell P and Grance T, ‘The NIST Definition of Cloud Computing’ 7 <https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf> accessed 16 May 2020

20. Roche J, ‘Cloud Computing: Legal Issues’ 8 <https://www.researchgate.net/publication/301222790_Cloud_Computing_Legal_Issues> accessed 16 May 2020

21. Sedenberg E, Chuang J and Mulligan D, ‘Designing Commercial Therapeutic Robots for Privacy Preserving Systems and Ethical Research Practices within the Home’ (2016) 8 International Journal of Social Robotics 575 <http://arxiv.org/abs/1606.04033> accessed 16 May 2020

22. Shen J and others, ‘Cloud Based Data Protection in Anonymously Controlled SDN’ (2018) 2018 Security and Communication Networks 1 <https://www.researchgate.net/publication/322796933_Cloud_Based_Data_Protection_in_Anonymously_Controlled_SDN> accessed 24 July 2020

23. Wan J and others, ‘Cloud Robotics: Current Status and Open Issues’ [2016] IEEE Access 1 <http://ieeexplore.ieee.org/document/7482658/> accessed 16 May 2020

24. Weng Y-H and Zhao STH, ‘The Legal Challenges of Networked Robotics: From the Safety Intelligence Perspective’ in Monica Palmirani and others (eds), AI Approaches to the Complexity of Legal Systems. Models and Ethical Challenges for Legal Systems, Legal Language and Legal Ontologies, Argumentation and Software Agents, vol 7639 (Springer Berlin Heidelberg 2012) <http://link.springer.com/10.1007/978-3-642-35731-2_4> accessed 16 May 2020

25. ‘What Is PaaS? Platform as a Service | Microsoft Azure’ <https://azure.microsoft.com/en-us/overview/what-is-paas/> accessed 25 May 2020

*****