A lender deploys an ML credit-scoring model affecting EU consumers without bias testing, explainability review, or GDPR-aligned assessment of profiling safeguards. Which conclusion fits CIPP/E Domain 5 technology compliance?
Select an answer to reveal the explanation.
Short Explanation
Credit scores change lives—so 'ship the model and hope' is not a privacy strategy. Bias, opacity, and missing human-review paths collide with GDPR fairness and ADM rules. Do the hard review before the model decides someone's loan.
Full Explanation
A lender deploying an ML credit-scoring model affecting EU consumers without bias testing, explainability review, or GDPR-aligned assessment of profiling safeguards fits the Domain 5 conclusion that ethical and bias risks in AI credit profiling intersect GDPR fairness, transparency, and automated decision-making rights—skipping that review leaves material compliance gaps. Credit scores change lives; ‘ship the model and hope’ is not a privacy strategy for civic financial inclusion. Claiming credit ML models are outside GDPR if scores are generated by a licensed bank fails—licensing does not erase personal-data rules. Saying ethics reviews replace DPIAs and Article 22 analysis entirely fails—ethics can inform but not substitute mandatory GDPR tools. Asserting opacity of ML models is encouraged as a trade-secret defence against data-subject access fails transparency and access/explanation expectations around significant automated decisions. Exam caveat: Article 22 safeguards, DPIA duties for high-risk profiling, and fairness/accuracy principles map directly onto bias and opacity concerns in lending AI. Operational check: run bias and accuracy tests, complete a DPIA, enable meaningful human intervention and contest rights where Art. 22 applies, provide suitable explanations, and document model governance before consumer decisions go live.