Challenging an automated decision
Organisations use automated systems to make decisions about people without human involvement, for example an online decision after you apply for credit, or a recruitment aptitude test using pre-programmed algorithms and criteria (UK ICO).
Your rights in the UK and the EU
- In the UK, you have the right not to be subject to a decision based solely on automated processing if the decision affects your legal rights or other equally important matters, such as the automatic refusal of an online credit application (UK ICO).
- Organisations may make such decisions only if the decision is necessary for a contract between you and the organisation, authorised by law, or based on your explicit consent (UK ICO).
- Where an organisation is allowed to make decisions based solely on automated processing, it should offer simple ways for you to express your view, get an explanation of the decision, request human intervention and challenge the decision (UK ICO).
- Put it in writing. A request can be verbal or in writing; the ICO recommends following up any verbal request in writing. If you are unhappy with how the organisation handled your request, complain to it first; if you remain dissatisfied, you can complain to the ICO (UK ICO).
- The ICO says this guidance is under review because of changes made by the Data (Use and Access) Act (UK ICO).
- In the EU, the Court of Justice ruled in February 2025 that a person subject to an automated credit assessment is entitled to an explanation of how the decision was taken. The company must describe the procedure and principles actually applied, so that the person can understand which of their personal data were used and how; merely communicating an algorithm is not enough (Court of Justice of the EU).
- If the company considers that the information contains trade secrets, it must provide that information to the competent supervisory authority or court, which decides how much the person is entitled to see (Court of Justice of the EU).
In the United States
- If a lender turns down your application for a loan or line of credit, it must send you a notice giving the specific reasons, or telling you that you have the right to learn the reasons if you ask within 60 days (CFPB).
- If the lender rejected your application based on your credit report, it must also give you the numerical credit score it used and the key factors that affected your score (CFPB).
- If you find information in your credit report that you believe is inaccurate, you can dispute it with the credit reporting company and the company that provided the information. If you have a problem with credit reporting, you can submit a complaint to the Consumer Financial Protection Bureau (CFPB).
Sources
- Your rights relating to decisions being made about you without human involvement, UK Information Commissioner's Office.
- Automated credit assessment: the data subject is entitled to an explanation as to how the decision was taken in respect of him or her, press release of the Court of Justice of the European Union, 27 February 2025.
- What can I do if my credit application was denied because of my credit report?, US Consumer Financial Protection Bureau.