  Different approaches have been adopted in addressing the challenges of
Artificial Intelligence (AI), some centred on personal data and others on
ethics, respectively narrowing and broadening the scope of AI regulation. This
contribution aims to demonstrate that a third way is possible, starting from
the acknowledgement of the role that human rights can play in regulating the
impact of data-intensive systems. The focus on human rights is neither a
paradigm shift nor a mere theoretical exercise. Through the analysis of more
than 700 decisions and documents of the data protection authorities of six
countries, we show that human rights already underpin the decisions in the
field of data use. Based on empirical analysis of this evidence, this work
presents a methodology and a model for a Human Rights Impact Assessment (HRIA).
The methodology and related assessment model are focused on AI applications,
whose nature and scale require a proper contextualisation of HRIA methodology.
Moreover, the proposed models provide a more measurable approach to risk
assessment which is consistent with the regulatory proposals centred on risk
thresholds. The proposed methodology is tested in concrete case-studies to
prove its feasibility and effectiveness. The overall goal is to respond to the
growing interest in HRIA, moving from a mere theoretical debate to a concrete
and context-specific implementation in the field of data-intensive applications
based on AI.
