## 6 Discussion  
The aforementioned extended set of experiments (see Tables 1 and 2) indicates how difficult it is to find a proper balance between privacy and an algorithm's accuracy due \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c} \hline \hline  & & & & & & & & & & & & & \\ \hline  
\end{table} 
Table 2: _Cont._to the variety of hyperparameters that highly affect the overall results. Although there are, indeed, promising techniques (and differential privacy is one of them), it seems that currently, there is no one-size-fits-all solution, whilst the type of the input data seems to also have a dominant role. In any case, it has become evident that it deserves attention to further explore how the hyperparameters affect both privacy and accuracy, even on an ad hoc basis. However, it should be stressed that the context of the use of an ML algorithm is also of high importance. For example, for automated decision-making systems, it is questionable even if accuracy at 83%--as achieved by our experiments--can be considered acceptable despite the fact that, in cases that do not involve personal data processing, it may, indeed, be sufficient. Therefore, a systematic risk analysis is needed for each case, and special emphasis should always be put on the transparency of the processing. This is a very challenging task for all relevant stakeholders (AI product/software developers, organizations using such tools, competent authorities, legislators, etc.). The above challenges also include issues stemming from the obligations that the data controllers have with respect to responding to specific individuals' rights. For example, what if a data subject asks to either access their data that are included in a training dataset or to delete these data? Interestingly enough, according to the GDPR (see Art. 11), if the data controller is able to demonstrate that they are not in a position to identify the data subject, then the GDPR's Articles 15 to 20, which correspond to data subject rights, such as the right of access and the right of data erasure, shall not apply except where the data subject, for the purpose of exercising the rights under those articles, provides additional information enabling the data subject's identification. Therefore, if the training datasets are properly anonymized, and the data controller is able to prove this, there is no obligation for the controller to \"find ways\" to respond to data subject requests, and actually, the data controller is not obliged to maintain, acquire, or process additional information in order to identify the data subject for the sole purpose of fulfilling data subject rights. Of course, the provisions regarding the right that an individual will not be subject to a decision based solely on automated processing still remain. The above illustrates how important it is to establish proper systematic procedures to evaluate a decision-making system based on ML algorithms in terms of its impact on fundamental human rights. In our view, the GDPR's provisions pave the way for some important prerequisites that need to be fulfilled, including the prohibition of fully automated decisions. Moreover, conducting a DPIA is necessary to identify, in time, all the main risks with respect to personal data protection and privacy; however, such a DPIA--which is a generic accountability tool for any personal data process with high risk--should also meticulously consider all the main properties and characteristics of an ML algorithm, striving to provide convincing answers to questions such as:  
1. Is the usage of an ML algorithm fully necessary? If yes, which type of ML algorithm fits better with our needs and why? ;
2. Are the identities of the individuals whose data form the training dataset protected? ;
3. Is it possible to extract personal information concerning the training dataset from the features/parameters of the ML model? ;
4. Is the model resistant to reconstruction attacks, model inversion attacks, and member inference attacks? ;
5.