Automated decisions under Law 25: what to tell the person

An enterprise that uses personal information so that a decision is made exclusively by automated processing informs the person no later than when it informs them of the decision. An internal credit score, an access refusal, a selection of applicants or a price that leaves the tool without a person deciding: the rule covers those cases.

What the person can ask for

• The personal information used to make the decision.
• The reasons, and the principal factors and parameters that led to the decision.
• The right to have the personal information used to make the decision corrected.

The person is also given the opportunity to present observations to a staff member who is in a position to review the decision. A form that only confirms the result, without naming who can review it, does not do that.

When the rule does not apply the same way

If someone in the enterprise reviews the file and makes the decision, the processing is no longer exclusively automated. Keep a record of that review: who decided, on what basis, and what was changed. A validation click without reading the file leaves the decision inside the rule.

Profiling, which evaluates preferences or behaviour, is a separate collection. If it then feeds a decision made exclusively by automation, both duties apply: inform the person before the technology is activated, then inform them of the decision.

Write into the procedure when the notice is sent, the address for requests and the role that reviews. Keep the request and the answer with the file.