Can Individuals Request Access to The Logic Used by An Organization in Its Automatic Decision Making?
It depends.
While most modern data privacy statutes allow individuals to request access to the personal information held by an organization about the individual, they do not confer upon individuals a right to understand how or why a business has made decisions about them. That said, one privacy statute – the California Privacy Rights Act set to go into force in 2023 – has instructed the state data protection authority to issue regulations that will require business to provide in response to an access request “meaningful information about the logic involved” in automated decision making as well as “the likely outcome of the process with respect to the consumer.”1 The obligation to disclose information regarding the logic used for automatic decision-making may ultimately conflict with businesses exemption under the CPRA to disclose trade secrets.2
1 Cal. Civ. Code 1798.185(a)(16) (2021).
2 Cal. Civ. Code 1798.100(f); 1798.185(a)(3) (2021).
