*by Fulvio Sarzana of S. Ippolito, Lawyer, Sarzana Law Firm.
The EU Court of Justice on the GDPR and the Artificial Intelligence Act
A ruling by the Court of Justice of the EU on banking credit scoring adds force to the ongoing debate within EU institutions on the Artificial Intelligence Act, addressing for the first time the general scope of Article 22 of the GDPR.
This latter provision establishes the right of the data subject not to be subject to a decision based solely on the automated processing of his or her personal data.
The law also adds that this prohibition is also provided in cases where the processing is carried out for "profiling" purposes.
The factual issue concerned an appeal brought by several German citizens before the Administrative Court of Wiesbaden (Germany) against the refusal of the competent data protection authority to take action against certain activities of SCHUFA, a private company that provides commercial information whose clients are, in particular, banks.
The appellants specifically objected to the "scoring" and the retention of information relating to the provision of financial reliability information taken from public registers.
Scoring is a mathematical statistical method that allows you to determine a prediction about the probability of a future behavior, such as repaying a loan.
Finally, the Court emphasizes that national judges must be able to exercise full review of any legally binding decision of the supervisory authority.
The decision is significant from a regulatory perspective because it addresses the issue of additional national powers to derogate from the GDPR regarding automated decision-making and the legal basis to be adopted if such a derogation is justified by national law. It concludes that the principles regarding data subject rights must be respected, should such a derogation exist.
This is a highly relevant topic because, in the future EU framework for artificial intelligence, national powers of derogation on highly sensitive issues such as biometric video surveillance, which was the subject of the latest "clash" in the EU trilogue that took place in recent days, are still unclear.
The EU Court of Justice on the GDPR and the Artificial Intelligence Act
English 
Italian 