European Union regulations on algorithmic decision-making and a "right to explanation"

The General Data Protection Regulation, adopted in April 2016 and applied across the EU from May 2018, replaced a 1995 directive with a single law that applies to any organization processing EU residents' personal data, wherever it is based, with fines of up to 20 million euro or 4% of global revenue. Goodman and Flaxman, two Oxford researchers, wrote this short paper to explain to the machine learning community which parts of the law affect models.

The central provision is Article 22. People have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. There are exceptions, when the decision is needed for a contract, authorized by law, or based on explicit consent, but even then the organization must provide safeguards, at least the right to human intervention, to express a view and to contest the decision. Decisions based on special categories of data, such as health, ethnicity or religion, need extra safeguards. Separately, Articles 13 and 14 require "meaningful information about the logic involved" when profiling occurs.

The paper focuses on two challenges. The first is non-discrimination. A narrow reading only forbids using sensitive variables directly, which does little because other variables, such as postal code, correlate with them. A broad reading forbids anything correlated with sensitive variables, which may leave nothing useful, especially in large datasets. The authors add "uncertainty bias": a model that approves only when it is confident will disadvantage a group that is under-represented in the data, because its predictions for that group are less certain. In their simulation, two groups repay loans equally often, yet the smaller group is refused when it makes up less than about 30% of the sample.

The second is explanation. If people are owed meaningful information about the logic of a decision, models must be explainable in human terms: how inputs relate to outputs, and which features matter most. That is easy for linear models and hard for ensembles and deep networks. The authors call these "good problems to have" and ask computer scientists to build algorithms and evaluation methods that avoid discrimination and support explanation.

Ask the Article 22 question at scoping. If the system will make decisions about people (credit, hiring, insurance, access to services, account closures) with no meaningful human involvement, and the decisions significantly affect them, the customer's legal team needs to be involved before design. Often the answer is a human in the loop with real authority, which changes the architecture and the staffing plan.

Dropping sensitive columns is not a fairness plan. Proxies such as location, language or browsing patterns carry the same information. Test outcomes by group where it is lawful and agreed with the customer, and document what was tested.

Uncertainty bias is a design choice you can see. A rule like "approve only if we are confident" punishes groups with less data. Our rerun shows that deciding on the estimate itself, or collecting more data for the smaller group, removes most of the gap. Check how decision rules use uncertainty before launch.

Plan for explanations and contests from day one. Logging the inputs, model version and reasons for each decision, and a path for a person to contest it, are much cheaper to build in than to add after a complaint. Local explanation methods such as LIME, or simpler models, make the "logic involved" possible to state.

Do not present this as legal advice. The paper is an early reading by researchers, and lawyers have since disputed whether GDPR creates a general right to explanation at all. Bring the questions; let the customer's counsel answer them.