Automated credit assessment: human review and challenge

An automated credit assessment can decide access to credit, insurance cover or a job application. If the decision is based solely on automated processing and has legal or similarly significant effects, Article 22 GDPR applies. The business must then examine the exception, the information provided and the safeguards for human review with particular care.

This article explains how to identify an Article 22 decision, how to distinguish a score or profile from the final decision and how to provide a meaningful route to human review and challenge. Software that only sorts information for a later human decision is not automatically an Article 22 decision. The actual process is decisive.

Article 22(1) GDPR protects data subjects from being subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. The assessment therefore does not depend on whether a business calls the system AI, a scorecard or a rules engine. The actual processing steps and the effect of the final decision matter.

An automated rejection of a credit application, refusal of an insurance product or complete exclusion from a recruitment process may reach the required level of significance. The same is not true of every internal prioritisation. If a score is only used as an indication and a person then decides independently, the human contribution must genuinely affect the outcome.

Businesses should map the process from receipt of the data to the communication of the decision. Record data sources, features, thresholds, exceptions, the person with decision-making authority and the concrete consequence. The glossary entry on automated decision-making explains the basic terms. The definition of profiling supports the preliminary distinction.

A credit score may be created from payment history, public information, application details or other data sources. Creating such a profile is not automatically the restricted decision under Article 22 GDPR. The key question is whether the result triggers a decision about the person without meaningful human review.

The effect must be considered in the person’s actual circumstances. A negative score may affect housing finance, access to insurance or professional selection. Even a decision that is formally described as a refusal may have major economic consequences. A general statement about the technical accuracy of the model does not answer the legal question.

The business should describe the decision and its effects separately. What action is triggered automatically? What alternatives remain? Could a person decide differently in the same case? What information does the data subject receive? These questions show whether software merely supports a decision or effectively determines it.

Article 22(2) GDPR lists three exceptions. The decision may be necessary for entering into or performing a contract, expressly authorised by Union or Member State law, or based on the person’s explicit consent. The selected exception must fit the specific decision. Convenience or a general reference to efficiency is not enough.

For contractual necessity and explicit consent, Article 22(3) GDPR requires suitable measures to protect rights and freedoms. At a minimum, this includes the possibility of human intervention, presenting the person’s point of view and contesting the decision. The business should therefore name a responsible reviewer who can genuinely reassess the case with the necessary information.

Article 22(4) GDPR limits decisions based on special categories of personal data referred to in Article 9(1) GDPR. Such a decision is generally not permitted unless the additional conditions in that provision are met and suitable safeguards are in place. In practice, the source of data, feature selection and possible proxy features must be reviewed before deployment.

Articles 13 and 14 GDPR require information about the existence of automated decision-making, including profiling, in the situations covered by those provisions. In the relevant cases, the data subject must also receive meaningful information about the logic involved and the significance and envisaged consequences of the processing. A purely technical model description is not enough if the person cannot understand what the decision means.

Where a score uses data that was not collected directly from the person, the available information about its source must also be considered. Article 15 GDPR supplements these information rights through the right of access and expressly refers to automated decision-making and profiling. The response must therefore explain the processing and its effects clearly, without treating business secrecy as a blanket reason to refuse access.

In practice, the information should start with the decision. Which data categories were considered? What role did the score play? Which decision followed? What effects did it have? How can the person request human review? The data subject rights and access topic explains the general framework. The article on an Article 15 access request supports the preparation of a concrete response.

Human review is not established merely because an employee clicks a confirmation button at the end. The person must receive the relevant information, assess the case independently and be able to change the decision. Someone who can only confirm the technical output, request no further material or is instructed never to depart from the score is not exercising meaningful review.

The challenge route should be explained in clear terms. Data subjects should know whom to contact, which information may assist the review and when they can expect a response. A submission should not be rejected merely because a technical error message is unclear. The review and its outcome should also be recorded so that the decision can be understood later.

Businesses benefit from a separate process for automated decisions: secure the challenge, verify identity only where necessary, assemble decision data and relevant documents, carry out an independent human review and communicate the result clearly. The review should also test whether a data error, unsuitable feature or incorrect allocation caused the result.

For accountability, businesses should record which decision is automated, which sources and features are used, which Article 22(2) GDPR exception is relied on and which safeguards are available. The record should also cover the information notices, the route to human review, responsibility for challenges and retention of the relevant decision record.

Common errors arise when a score is treated as the decision without checking the final human step. Another weakness is a general privacy notice that explains neither the significance of the assessment nor how to challenge it. There may also be a gap between the business and the external model provider. A business using an external model must understand the relevant sources, currency and logic well enough to assess its own processing.

Before changing the model, the organisation should check whether the data, groups, thresholds or effects have changed. The privacy compliance and governance topic supports the organisation of responsibilities and evidence. A clear review trail is especially important where automated decisions repeatedly affect many people in the same way.

We can review the decision process, data sources, Article 22 GDPR exception, information and route to human review with you. Contact us with the process map, assessment criteria, information notices and an example decision so that the effects and the sensible next step can be assessed in a structured way.