Human Review, Please: Challenging a Machine-Made Decision in the UK

Automated decision-making is no longer confined to specialist systems. It shapes credit limits, insurance pricing, recruitment shortlists and the administration of public services. Often it works quietly and accurately. Sometimes it produces an outcome that the individual cannot understand, challenge or correct. The question for UK consumers and workers is not whether machines should make decisions, but whether a person can obtain a human explanation and a human review when the consequences are significant.

When a decision is solely automated

Article 22 of the UK GDPR addresses decisions based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect the individual. The key word is ‘solely’. If a human being genuinely considers the output before the decision is made, Article 22 may not apply. A token review, in which a person simply rubber-stamps the machine's conclusion, is unlikely to count as meaningful human involvement.

Examples can include an automated credit refusal, an insurance premium calculated without human input, a recruitment system that rejects candidates before anyone reads their application, or a public body's automated check that suspends a payment. Not every automated decision falls within Article 22. A system that ranks applications but leaves the final choice to a person may sit outside it. Even then, data protection law still requires transparency, fairness and accuracy.

The right to meaningful information

Where Article 22 applies, the controller must put safeguards in place. These include human intervention, an opportunity to express a point of view, and the right to contest the decision. The individual is also entitled to meaningful information about the logic involved, as well as the significance and envisaged consequences of the processing. That information can be requested under Article 15 of the UK GDPR, the right of access, and should be provided at the point data is collected under Articles 13 and 14.

Meaningful information does not usually mean the source code or the full proprietary model. The Information Commissioner's Office has made clear that controllers should explain the logic in plain terms: what data is used, how it is weighted, what the decision means and what happens next. ‘The algorithm decided’ is not an explanation. Nor is a generic privacy notice that mentions automated decision-making without saying how it applies to the individual.

What to ask for — and what not to expect

A well-drafted request should identify the decision, the organisation and the legal basis for the request. It should ask whether the decision was solely automated, what personal data was used, where that data came from, what the logic was, and what the significance and consequences are. It should also ask for human intervention and an opportunity to contest the outcome.

It is reasonable to ask for the information in plain English. It is not reasonable to expect a trade secret to be handed over in full. A controller may withhold information that would adversely affect the rights of others or reveal protected commercial information, but it should still provide the substance of the explanation. The response should normally be given within one month, extendable by up to two further months where the request is complex.

A request that reads well

A formal request can be concise. For example:

‘I am writing to request information about the automated decision made about my [credit application / insurance quote / job application / benefit award] on [date]. Please confirm whether the decision was made solely by automated means and whether Article 22 of the UK GDPR applies. Please provide meaningful information about the logic involved, the personal data used, the source of that data, and the significance and envisaged consequences of the decision. I also request human intervention and an opportunity to contest the decision. Please provide this information within one month.’

Attach proof of identity if required, but do not over-share. Keep a copy of the request and the response. If the organisation asks for more time, ask for the reason in writing.

Contesting the decision

A request for information is not the same as an appeal. Once you have the explanation, state clearly what you believe is wrong: inaccurate data, a missing context, a discriminatory proxy, or a rule that has been applied without discretion. Ask for the data to be rectified if it is wrong. Ask for the decision to be reconsidered by a person with the authority to change it. Provide evidence that the machine could not have seen, such as a correction to your credit file or additional information about your circumstances.

In recruitment, ask for feedback on the automated stage and whether a human will review your application. In credit, ask which credit reference agency was used and check your file. In insurance, ask which factors drove the quote and whether a human underwriter can review it. In public services, use the organisation's complaints and review procedures alongside the data protection request.

Limits, exemptions and escalation

Article 22 is not an absolute right to a human decision in every case. It applies to solely automated decisions with legal or similarly significant effects, and there are exceptions, including where the decision is necessary for a contract, authorised by law, or based on explicit consent. Even where an exception applies, safeguards should be in place. Controllers can refuse manifestly unfounded or excessive requests, and some data protection exemptions may apply.

If the response is inadequate, complain to the organisation's data protection officer first. You can then raise the matter with the Information Commissioner's Office. Sector regulators and ombudsmen may also be relevant: the Financial Ombudsman Service for credit and insurance, the Pensions Ombudsman for some pension decisions, and employment tribunal or Acas routes for recruitment and workplace issues. Keep the timeline and the evidence.

The human point of contact

The purpose of these rights is not to force every decision through a committee. It is to ensure that when a machine's output has serious consequences, a person can ask what happened, correct the record and seek a review. That is a modest safeguard, but an important one. A society that allows automated decisions to become unchallengeable is not merely inefficient; it is unfair. The law already provides a route to the human point of contact. The practical task is to use it clearly, in writing and without apology.