With AI, automated decisions are becoming routine: credit checks, pre-selection of applications, pricing, fraud checks. Data protection law has long had specific rules for them, which gain importance with the use of AI.
When a decision is covered
Covered are decisions based solely on automated processing, without substantive review by a human, that have a legal effect on the data subject or significantly affect them. An automated recommendation that a human actually reviews is not an automated individual decision; a formal confirmation without genuine review is.
Switzerland: information and hearing
Under Art. 21 FADP, the controller informs the data subject of an automated individual decision. On request, it gives them the opportunity to state their position, and they can ask for the decision to be reviewed by a natural person. Exceptions apply, among others, where the decision relates to a contract and the person’s request is granted, or where they have expressly consented.
EU: the right not to be subject
Art. 22 GDPR gives data subjects the right not to be subject to a decision based solely on automated processing with legal or similarly significant effect, with exceptions for contract, legal authorisation and explicit consent. Even then safeguards are needed, at least the right to human intervention, to express one’s view and to contest the decision. In 2023 the Court of Justice of the EU held that establishing a score can itself be an automated decision where a third party relies on it decisively (case C-634/21).
Relation to the AI Act
The AI Act governs the properties of systems, data protection law the rights of data subjects. For high-risk systems such as creditworthiness assessment, both apply side by side: human oversight under the AI Act and the rights under the FADP and GDPR. The AI Act additionally gives people affected by certain high-risk decisions a right to an explanation.
Practical implementation
Check AI-assisted decision processes for whether a human genuinely decides on substance. Where not, include the information in communication with data subjects, create a route for hearing and human review, and add the information to the privacy notice. The sector perspective for credit decisions is covered in our article on the AI Act in financial services.