AI, Personal Data Governance & Cross-Border Compliance

EU SCHUFA Scoring Case

A credit agency automatically generated credit scores for use by third parties such as banks. The Court of Justice of the European Union held that when a score plays a decisive role in a third party's decision, the scoring activity constitutes automated individual decision-making governed by Article 22 of the GDPR.

Preliminary-ruling judgment interpreting EU law

• Automated scoring falls within GDPR Article 22(1) when a third party relies decisively on the score in making a contractual decision.
• It is prohibited in principle unless an Article 22(2) exception and safeguards apply, alongside other GDPR requirements; an Article 6 legal basis alone is insufficient.

EU Automated Decision-Making Explanation Case

Interpreting GDPR Article 15(1)(h), the CJEU required a concise, transparent and intelligible account of the procedures and principles actually used, enabling the individual to understand and challenge the result. Showing how changes in personal data would change the result is one possible explanatory method.

Preliminary-ruling judgment interpreting EU law

• The account must explain the actual procedures and principles so the person can challenge the decision. A complex formula or exhaustive steps alone may be insufficient.
• Showing the effect of data changes is one possible method, not a mandatory format in every case or a duty to disclose the entire algorithm.

Netherlands SyRI Risk Profiling Case

The Dutch government integrated multi-agency public data to generate fraud risk profiles for social welfare recipients. The court held that the regulatory regime lacked sufficient transparency and auditability, failing to strike a fair balance in its interference with the right to private life.

First-instance civil judgment; government did not appeal

• The safeguards failed to strike a fair balance between fraud prevention and private life under ECHR Article 8(2).
• The court declared SUWI Act Article 65 and Chapter 5a of the implementing decree non-binding, rather than invalidating all government data sharing.

Netherlands Ola Driver Data Access Case

UK drivers sought personal data and explanations concerning Ola’s scoring, fraud detection, income profiles, allocation and deductions. The first-instance court partly allowed access in 2021. In 2023 the Amsterdam Court of Appeal found that the fraud-probability scores, income profiles and allocation at issue had significant effects and ordered further explanations.

First-instance order; partly reversed on appeal on 4 April 2023

• The appellate court partly reversed the first instance, finding that the specified fraud scores, income profiles and allocation were solely automated decisions with significant effects under GDPR Articles 22(1) and 15(1)(h).
• Ola had to explain relevant factors, their aggregate-level weights and information needed to understand the reasoning. Guardian alerts did not meet the same threshold on these facts.

AI & Data Compliance

Map data sources, processing roles, purposes, flows and controls across AI systems.

AI Product Compliance

Embed legal review into design, development, procurement, testing, launch, operation and updates.

Model & Platform Governance

Review admission, risk tiering, content safety, monitoring, audit and accountability for models, algorithms and platforms.

Enterprise AI Governance

Establish enterprise AI planning, tool admission, data permissions, internal policies, training, audit and incident response.