AI, Personal Data Governance & Cross-Border Compliance

EU SCHUFA Scoring Case

A credit agency automatically generated credit scores for use by third parties such as banks. The Court of Justice of the European Union held that when a score plays a decisive role in a third party's decision, the scoring activity constitutes automated individual decision-making governed by Article 22 of the GDPR.

Final Interpretive Judgment

• The court confirmed that scoring falls under the rules on automated individual decision-making when it plays a decisive role in third-party decisions.
• Such processing requires a valid legal basis and appropriate safeguards for data subjects' rights.

EU Automated Decision-Making Explanation Case

The Court of Justice of the European Union ruled that data subjects are entitled to an explanation sufficient to understand and challenge automated decisions. Such explanations must disclose the concrete procedures and principles applied and illustrate how changes in personal data influence the resulting outcome.

Preliminary Ruling

• The explanation must convey the procedures and principles underlying the automated decision in a concise, intelligible format.
• The explanation must enable the data subject to understand how specific personal data affected the decision and to contest the outcome effectively.

Netherlands SyRI Risk Profiling Case

The Dutch government integrated multi-agency public data to generate fraud risk profiles for social welfare recipients. The court held that the regulatory regime lacked sufficient transparency and auditability, failing to strike a fair balance in its interference with the right to private life.

First-Instance Judgment

• The court held that the legislation governing SyRI violated Article 8 of the European Convention on Human Rights.
• The court determined that the system lacked sufficient transparency and verifiability, failing to maintain a fair balance between the interference with privacy rights and the public objective.

Netherlands Ola Driver Data Access Case

Ride-hailing drivers sought access to platform data used for scoring, fraud detection, earning profiles, and wage deductions. The court distinguished between general profiling, dispatch algorithms, and automated deductions with significant effects, ordering the platform to disclose specific categories of underlying data.

First-Instance Order

• The court ordered Ola to disclose the personal data and segment classifications used to generate certain driver profiles.
• Standard automated dispatching was held not to produce significant effects in this case.

AI & Data Compliance

Map data sources, processing roles, purposes, flows and controls across AI systems.

AI Product Compliance

Embed legal review into design, development, procurement, testing, launch, operation and updates.

Model & Platform Governance

Review admission, risk tiering, content safety, monitoring, audit and accountability for models, algorithms and platforms.

Enterprise AI Governance

Establish enterprise AI planning, tool admission, data permissions, internal policies, training, audit and incident response.