An EU bank intends to launch a multi-modal Al platform for customer engagement and automated decision-making assist with the opening of bank…

The scenario describes an AI system used for automated decision-making assistance that has a significant effect on individuals (opening a bank account). Under the EU's General Data Protection Regulation (GDPR), this triggers specific obligations. Article 22 of the GDPR grants individuals the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects. When such processing is necessary for a contract (as in this case), Article 22(3) mandates the implementation of "suitable measures to safeguard the data subject's rights," which explicitly includes the right to obtain human intervention, express one's point of view, and contest the decision. Furthermore, Articles 13 and 14 require transparency, obliging the bank to inform users about the existence and logic of the automated decision-making system.

A. The bank must obtain explicit consent from users under the privacy Directive.

This is incorrect because explicit consent is only one of three possible legal bases for automated decision-making under GDPR Article 22(2); necessity for a contract is another valid basis applicable here.

B. The bank must disclose how the Al system works under the Ell Digital Services Act.

This is incorrect as the Digital Services Act (DSA) primarily regulates online intermediaries and platforms concerning illegal content, not the specific data subject rights related to automated decision-making governed by the GDPR.

C. The bank must subject the Al system an adequacy decision and publish its appropriate safeguards.

This is incorrect because adequacy decisions and appropriate safeguards are mechanisms under GDPR Chapter V that apply specifically to the international transfer of personal data, which is not mentioned in the scenario.

1. General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679:

Article 22(3): "In the cases referred to in points (a) and (c) of paragraph 2

the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests

at least the right to obtain human intervention on the part of the controller

to express his or her point of view and to contest the decision."

Article 13(2)(f): Requires controllers to provide information on "the existence of automated decision-making

including profiling

referred to in Article 22(1) and (4) and

at least in those cases

meaningful information about the logic involved

as well as the significance and the envisaged consequences of such processing for the data subject."

2. European Data Protection Board (EDPB)

Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (wp251rev.01)

Adopted on 3 October 2017

as last Revised and Adopted on 6 February 2018:

Section IV.B

Page 25: "Article 22(3) requires the controller to implement suitable measures to safeguard the data subject’s rights

freedoms and legitimate interests... At a minimum

these should include the measures listed: the right to obtain human intervention

to express their own point of view

and to contest the decision."

3. Goodman

B.

& Flaxman

S. (2017). European Union regulations on algorithmic decision-making and a "right to explanation". AI Magazine

38(3)

50-57. https://doi.org/10.1609/aimag.v38i3.2741

Page 52

Section "GDPR Articles 13-15": This article discusses the transparency obligations

noting that Articles 13-15 require that data subjects be informed about the existence of automated decision-making and be given "meaningful information about the logic involved." This supports the disclosure requirement in the correct answer.