Automated Decisions, Consumer Protection & Algorithmic Scoring

EU SCHUFA Scoring Case

A credit agency automatically generated credit scores for use by third parties such as banks. The Court of Justice of the European Union held that when a score plays a decisive role in a third party's decision, the scoring activity constitutes automated individual decision-making governed by Article 22 of the GDPR.

Preliminary-ruling judgment interpreting EU law

• Automated scoring falls within GDPR Article 22(1) when a third party relies decisively on the score in making a contractual decision.
• It is prohibited in principle unless an Article 22(2) exception and safeguards apply, alongside other GDPR requirements; an Article 6 legal basis alone is insufficient.

US COMPAS Sentencing Case

Criminal sentencing materials incorporated a commercial COMPAS recidivism risk score. The court permitted limited consideration of the score, required clear warnings regarding the tool's limitations, and prohibited using the score to determine sentence severity or whether incarceration is warranted.

State Supreme Court judgment affirming denial of resentencing

• The court affirmed the post-conviction order denying resentencing.
• COMPAS could be considered with warnings about its limits and independent sentencing factors. Scores could not determine incarceration or sentence length, or decisively determine whether community supervision would be safe and effective.

EU Automated Decision-Making Explanation Case

Interpreting GDPR Article 15(1)(h), the CJEU required a concise, transparent and intelligible account of the procedures and principles actually used, enabling the individual to understand and challenge the result. Showing how changes in personal data would change the result is one possible explanatory method.

Preliminary-ruling judgment interpreting EU law

• The account must explain the actual procedures and principles so the person can challenge the decision. A complex formula or exhaustive steps alone may be insufficient.
• Showing the effect of data changes is one possible method, not a mandatory format in every case or a duty to disclose the entire algorithm.

UK Police Live Facial Recognition Case

South Wales Police deployed a live facial recognition system in public spaces. The Court of Appeal held that the criteria for watchlists and deployment locations lacked sufficient legal constraints, and identified deficiencies in the data protection impact assessment and compliance with the public sector equality duty.

Appellate Judgment

• The court allowed grounds concerning legal clarity, the data-protection impact assessment and the public-sector equality duty, addressing this deployment and its then-existing framework.
• There were defects in the limits on watchlist and deployment-location discretion, impact assessment and performance of the equality duty.

Ewert v. Canada Risk Assessment Case

The Supreme Court of Canada held that the correctional authority breached its statutory duty by failing to reasonably validate psychometric and actuarial risk tools for Indigenous people. It did not establish empirical bias or uphold all Charter claims. The case is used as a comparative example of algorithm governance.

Supreme Court Judgment

• The Supreme Court partly allowed the appeal and declared a breach of section 24(1) of the Corrections and Conditional Release Act.
• The correctional authority had long known of potential cultural bias but failed to take reasonable steps to verify the tools for Indigenous offenders.

AI & Data Compliance

Map data sources, processing roles, purposes, flows and controls across AI systems.

AI Product Compliance

Embed legal review into design, development, procurement, testing, launch, operation and updates.

Model & Platform Governance

Review admission, risk tiering, content safety, monitoring, audit and accountability for models, algorithms and platforms.