A bank uses purely automated scoring to deny online account applications with no meaningful human review path. Which data-subject protection theme applies?
Select an answer to reveal the explanation.
Short Explanation
When an automated system says no to your bank account and there's no real human to talk to, that's exactly the kind of solely automated decision with significant effects that Article 22-style protections cover. You need safeguards, like a path to human review, not a black-box brick wall.
Full Explanation
Solely automated decisions that produce legal or similarly significant effects—such as denying online bank-account applications with no meaningful human review path—engage Article 22-style protections. Where those rules apply, data subjects should benefit from safeguards such as human intervention, the opportunity to express their point of view, and the ability to contest the decision, together with meaningful transparency about the logic involved and consequences. The claim that rights related to automated decision-making never cover credit or account onboarding is the opposite of typical high-stakes examples. The claim that automated denial is always required by the ePrivacy Directive for every consumer account is wrong; automated denial is not always required by the ePrivacy Directive for consumer accounts. The claim that banks may rely solely on automation only when applicants live outside the EEA is also wrong; living outside the EEA is not what makes sole automation lawful for applicants protected by the GDPR framework discussed here. Exam caveat: significant effect plus solely automated processing should trigger Article 22 analysis and safeguards. Operational check: insert human review for refusals, document meaningful logic explanations, honour contestation requests, and avoid silent black-box denials. Financial and civic eligibility systems that score residents should not be unappealable machines; public trust depends on a path for a human to hear the person’s case.