Update concepts for Scoring and Decision to cover overlap

[coolharsh55]

As per the recent 2023-MAR-16 opinion of Advocate General on Case C 634/21 (see English translation below), there is a consideration when scoring by itself is also considered a decision. Therefore for DPV we should check how we are able to represent a Score is also a Decision. Then Automated Decision Making should be equivalent to Automated Scoring. If not, we would need Automated Scoring, and then specify the produced Score is a Decision, which would make it Automated Decision Making.

39. Finally, it should be noted that, since the actions attributable to a private financial institution can also have serious consequences for the independence and freedom of action of the person concerned in a market economy, especially when it comes to collecting the solvency of a loan applicant(14), I do not see any objective reason for limiting the term “decision” to the purely public sphere, i. The classification of an opinion adopted as a "decision" to the data subject requires, in my opinion, a case-by-case examination, taking into account the specific circumstances and the severity of the effects on the legal, economic and social status of that person(15).

40. On the basis of the criteria set out in the above paragraphs, it is then to be determined which is the relevant “decision” in the present case. As mentioned above, there is, on the one hand, the action by which a bank accepts or refuses to grant the applicant a loan, and on the other hand, the score value resulting from a profiling procedure carried out by SCHUFA. I believe that it is impossible to answer this question categorically, since the classification depends on the circumstances of the individual case. In concrete terms, the way in which the decision-making process is structured is essential. This procedure typically includes several phases, such as profiling, creating the score value and deciding on the granting of the loan in the actual sense.

41. I believe it is clear that although a financial institution can take over this procedure, it does not prevent anything from contractually transferring certain tasks to a credit agency, e.g. profiling and scoring. Art. 22 para. 1 GDPR, however, requires that these tasks be performed by one or more positions. Having said that there is no significant role to play the possible transfer of certain powers to an external service provider in the analysis, since such a transfer generally follows economic and organisational considerations, which may vary from case to case.

42. On the other hand, the aspect that seems to me to play a decisive role is the one who is connected with the question of whether the decision-making process is designed in such a way that the scoring carried out by the credit agency precaution evaluates the decision of the financial institution to grant or reject the loan. If the scoring takes place without any intervention by a person, which could verify the scoring result and the correctness of the decision to be made with regard to the loan applicant, it seems logical to assume that the scoring itself is the “decision” in the sense of Art. 22 para. 1 GDPR.

[ghurlbot]

Comment by @coolharsh55 via IRC channel #dpvcg on irc.w3.org

this was discussed in today's meeting with no objections to go ahead and implement it.

[ghurlbot]

Comment by @coolharsh55 via IRC channel #dpvcg on irc.w3.org

this was discussed in today's meeting with the conclusion that concepts to represent Scoring and Decision Making should be present in DPV, but to wait for the CJEU decision before adding the implication of Automation to DPV-GDPR

[coolharsh55]

Added AutomatedScoringOfIndividuals with Definition: Processing that involves automated scoring of individuals; and Usage Note: Scoring can lead to the action being considered Decision Making if the scoring is itself a decision - see 2023-MAR-16 opinion of Advocate General on Case C 634/21. Therefore, the assessment of whether scoring was automated or not is important given the legal obligations surrounding automated decision making e.g. in GDPR