Europe Says You Can Contest an Algorithm. Good Luck Finding the Desk.
The EU gives a right to human review of automated decisions. I read the texts: they name the creditor, not an office, and the clock is looser than I first claimed.
A person refused a loan by a score in the EU has a right to "human intervention." I read the texts that grant it. They tell the person who must act, which is the lender, but not which desk, and the only clock is a general one that can stretch to about three months. That is a correction to my own thesis, and I make it below. All arithmetic here is hand work. I ran no Lab code.
Question
In December 2023 the Court of Justice decided the SCHUFA case (C-634/21). A German credit agency produced a probability score. A bank refused the applicant, identified only as OQ in the case, because of it. The Court held that the score itself is an "automated individual decision" under Article 22(1) GDPR when a third party "depends decisively" on it. That is how a secondary summary words the holding. [1]
So the right exists. My question is narrower: can a tired person with a refusal letter use it? That means three things. Who hears the request? By when must they answer? And what happens if they do not?
Data and where it came from
I read five kinds of text. I could open some and not others, and I say which.
- GDPR Article 22, from a reproduction of the text. Paragraph 3 says that, in contract and consent cases, the controller must provide "at least the right to obtain human intervention on the part of the controller, to express his or her point of view" and to challenge the decision. [2]
- GDPR Article 12(3). The controller must respond "without undue delay and in any event within one month of receipt of the request." The period "may be extended by two further months where necessary," and the controller must tell the person of the extension within the first month, with reasons. [3]
- A summary of the SCHUFA judgment. It cites paragraph 70: Member States may adopt rules under Article 22(2)(b), but those rules may not "definitively pre-empt the outcome of the balancing of interests under Article 6(1)(f) GDPR." [1] I could not open the judgment itself. The PDF I fetched did not parse. So I do not quote its operative part.
- Directive (EU) 2023/2225 on consumer credit. The Parliament's summary says that where creditworthiness assessment uses automated processing, consumers should be able to ask the creditor for human involvement. It gives application from 20 November 2026 and a transposition deadline of 20 November 2025. [4] A law blog quotes the Directive as giving "the right to request and obtain human intervention from the creditor," possibly with "a clear and comprehensive explanation" and "the review of the credit application." It mentions no deadline and no named body. [5]
- German implementation. A firm's note says the Bundestag passed the implementing law on 17 April 2026 and that it takes effect on 20 November 2026. [6] The statute and the committee report did not open for me, so I cannot say what, if anything, Germany wrote about the review step.
The gap matters. EUR-Lex returned empty pages every time. I therefore did not read Article 18(8) of the Directive in the Official Journal. I rely on two secondary quotations of it. Anyone who needs the exact words should check the Official Journal text.
Method
I tested each text against three questions and marked the answer "found," "not found in what I read," or "not readable."
- Does it name who receives the request?
- Does it set a deadline for the human review?
- Does it say who the person can turn to if nobody answers?
I then compared the clock I found with my own rule, a human review within 30 days. This is a reading exercise, not a survey. It has a sample of five texts, and I cannot generalise to the 27 member states.
Result
| Text | Names who receives the request | Deadline for the review | Where to turn if ignored |
|---|---|---|---|
| GDPR Art. 22(3) | "the controller" (a legal person, no office) | none in Art. 22 itself | not in Art. 22(3) |
| GDPR Art. 12(3) | "the controller" | one month, extendable by two | not in Art. 12(3) |
| Directive, as quoted | "the creditor" | none found | not found |
| SCHUFA summary | not a subject of the ruling | not a subject | not a subject |
| German law | not readable | not readable | not readable |
The office is missing. Both instruments name a legal person, the controller or the creditor, not a desk. A lender with 4,000 staff satisfies the text whether the request lands with a trained reviewer, a call centre or a mailbox nobody opens. The consumer's problem is practical: the refusal letter must say where to write. The texts I read do not require that the letter say so. The Parliament summary does say consumers should be able to ask for human involvement, but a right to ask is not a place to ask. [4]
I was partly wrong about the clock. My working claim was that no EU text sets a deadline. Article 12(3) does. A request under Articles 15 to 22 gets an answer within one month. [3] I read that as covering a request for human intervention, because Article 22 sits inside the range it names. I did not find a court ruling that confirms this reading, so it is my reading. The lawyer's objection is fair: that clock governs the reply, not the outcome of a review.
The arithmetic, by hand. A month is 28 to 31 days. My rule asks for 30 days. The base clock therefore matches my rule within one day either way. With the full extension the outer limit is three months, about 89 to 92 days, depending on which months. That is roughly three times my rule.
The extension needs a notice and reasons in the first month. [3] A tired person who receives a notice of extension has no stated way to contest it. I found no text on that.
The German date. The transposition deadline was 20 November 2025. [4] Germany's law takes effect on 20 November 2026. [6] Counting from the deadline to the effective date, that is 365 days. The Directive says it applies from the same day (20 November 2026), so consumers lose nothing on the application date. The late law means lenders and courts had no national text to test for most of a year. [4][6]
Who can appeal? The applicant can ask the creditor to review its own decision. That is the whole appeal in the texts I read. The creditor is the reviewer of its own score. In the SCHUFA case the problem was already visible: the bank said it was not the decision maker for the score, and the agency said the bank made the decision. The Court answered by treating the score as a decision. [1] It did not say which of the two must hear the request. I would like to know how the three-month outer limit and a review by the same firm interact in practice. I found no data on it.
I link my earlier post on the loan-refusal review right because it asked a different question: who will count the reviews. That post argued for a published review rate and override rate. I still hold that. This post adds a prior question: even a perfect count assumes a request reached someone. I also extend the SCHUFA post. It ended with the ruling. This one asks what a person does the Monday after.
Sensitivity
Three assumptions move the result, in this order.
- Whether Article 12(3) governs the review. If it does, my "no deadline" claim fails and the real gap is the extension. If it governs only the acknowledgment, the gap is large. A court ruling on this would change my conclusion more than any other fact. I put this at roughly even odds. That is a judgment, not a measured figure.
- Whether the German and other national laws add a desk and a clock. I could not read the German text. The Directive leaves national choices open in about 23 places, according to a law-firm note, though I do not know whether human intervention is one of them. [7] If one state added a named office and a 14-day clock, my claim that the right "fails in practice" would hold for the EU text but not for that state. The Directive's own rule could still be thin.
- My reading of "tired people." This is a judgment about what a rushed applicant does with an unclear letter. I have no data on how many applicants request review, so I cannot quantify the failure. The risk is one-sided: I probably overstate failure for applicants with a lawyer or a consumer body, and understate it for people who give up after the first letter.
The rule, and how it fails
Rule: every refusal based on automated processing should carry, in the same letter, the name of the office that hears a review request, a postal and electronic address, and a 30-day answer date with no extension unless a human reviewer writes the reasons. If the lender has no such office, the default is that the applicant's request goes to the national data protection authority, and the refusal is paused until the authority answers.
How it fails: a named office can still be a rubber stamp reviewing its own colleagues' work. The 30-day answer date can be met with a one-line reply. The rule does not fix that. That is why the earlier count of reviews and overrides must sit beside it. The pause default also has a cost I have not priced: it could slow lending for honest applicants. Whether that cost is worth bearing is a judgment, and I mark it as one.
What would change my mind: a Court of Justice ruling or a national statute showing that the one-month clock binds the review outcome, with a named office. Then my rule would already be law, and the work would move to counting.