发表机构
University of Witwatersrand; University of Pretoria; University of Amsterdam; University of Hohenheim（威特沃特斯兰德大学; 比勒陀利亚大学; 阿姆斯特丹大学; 霍恩海姆大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文以数据殖民为视角，分析南非现有法律（如POPIA）在应对AI风险上的不足，并提出基于算法影响评估等机制的去殖民化AI治理框架，以维护数字主权。
AI 中文摘要
人工智能不仅是一种技术产物，它也是政治经济、法律斗争和主权争夺的新场所。人工智能系统依赖于对大量数据的持续收集、存储、处理和货币化。在南非，这些数据集日益包含行为、生物识别、金融、消费、健康和公共部门信息。我们的文章以数据殖民作为理论视角，分析南非现有的法律和治理框架能否监管人工智能特有的风险。文章认为，南非现行法律，包括《个人信息保护法》（POPIA），对个人信息进行了规范，但未能充分防止数据殖民。POPIA对于隐私、合法处理、自动化决策和跨境传输仍然重要。然而，数据殖民不能仅仅归结为隐私保护。它涉及所有权、依赖性、基础设施、监控、监管权力、价值提取以及个人和机构挑战算法决策的能力。文章考察了南非在多个领域（如云和数字基础设施、生物识别监控和数字市场）中与人工智能相关的风险。本文认为，南非的法律框架尚未充分规范算法不透明性、外部控制的数字基础设施、生物识别监控、自动化画像、集体数据损害或从南非数据中提取价值的行为。我们主张需要建立一个去殖民化的人工智能治理框架，该框架基于算法影响评估、公共部门人工智能登记册、独立审计、生物识别保障措施、竞争法救济、公共利益数据治理、更强的监管能力和民主控制，以加强南非的数字未来。
英文摘要
AI is not only a technological artefact; it is also a new site of political economy, legal struggle, and sovereignty contestation. AI systems depend on the continuous collection, storage, processing, and monetisation of large volumes of data. In South Africa, these datasets increasingly include behavioural, biometric, financial, consumer, health, and public-sector information. Our article uses data colonisation as a theoretical lens to analyse whether South Africa's existing legal and governance framework can regulate AI-specific risks. It argues that South Africa's current laws, including the Protection of Personal Information Act (POPIA), regulate personal information but do not adequately prevent data colonisation. POPIA remains important for privacy, lawful processing, automated decision-making, and cross-border transfers. However, data colonisation cannot solely be reduced to privacy protection. It concerns ownership, dependency, infrastructure, surveillance, regulatory power, value extraction, and the capacity of people and institutions to challenge algorithmic decisions. The article examines South African AI-related risks in various areas (e.g. cloud and digital infrastructure, biometric surveillance, and digital markets). This paper argues that South Africa's legal framework does not yet adequately regulate algorithmic opacity, externally controlled digital infrastructure, biometric surveillance, automated profiling, collective data harms, or the extraction of value from South African data. We argue for the need of a decolonial AI governance framework based on algorithmic impact assessments, public-sector AI registers, independent audits, biometric safeguards, competition-law remedies, public-interest data governance, stronger regulatory capacity, and democratic control to strengthen South Africa's digital future.
