Reputational scoring and the right to an explanation

Abstract

This paper analyses Ordinance no. 28358 of 6 October 2023, whereby the Italian Court of Cassation ruled for the second time and definitively on the lawfulness of the processing of personal data carried out by the Associazione Mevaluate Onlus consisting in the automated processing of reputational profiles. The paper deals with the three legal questions addressed in the ruling, concerning (i) the information on the “executive scheme” of the reputational scoring system; (ii) the possibility of “per relationem” information to the data subject; (iii) the relationship between data subject’s consent to data processing and contractual clauses. The contribution will also analyse two hypothetical scenarios: (a) how the Court of Cassation could have decided if, instead of the Italian Privacy Code, the General Data Protection Regulation had been applicable to the Mevaluate case; (b) how the Court of Cassation could have decided if the rules currently being adopted at EU level on Artificial Intelligence had already been in force.

Keywords

• reputational scoring
• right to an explanation
• mevaluate
• “executive scheme”
• gdpr
• ai act