Providers and deployers should carefully assess whether other applicable Union and national legislation applies to any particular AI scoring system used in their activities, in particular if there is more specific legislation that strictly regulates the types of data that can be used as relevant and necessary for specific evaluation purposes and if there are more specific rules and procedures to ensure justified and fair treatment.
AI-enabled social scoring practices by private parties acting as traders in business-to-consumer relations may also be in breach of Union consumer protection law, i.e. Directive 2005/29/EC on unfair business-to-consumer commercial practices (the ‘UCPD’). The UCPD prohibits commercial practices if they are contrary to the requirements of professional diligence and materially distort or are likely to materially distort the economic behaviour of the average consumer or average member of the group with regard to the product (Article 5 UCPD). The scoring practices may also be found misleading (Articles 6-7 UCPD) subject to case-by-case assessment of the impact of the commercial practice on the consumer’s transactional decision.
Social scoring, whether by public or by private parties, may also be in breach of Union data protection law s , for example as regards the legal ground for processing (lawfulness), the data protection principles ( e.g., data minimisation and necessity, fairness, transparency) , and any other obligatio ns, including the rules on solely automated individual decision-making, where relevant.
Where the evaluation or classification is based on one of the grounds protected from discrimination (e.g., age, religion, racial or ethnic origin, sex etc.) or results directly or indirectly in discriminationof those groups, such a practice will also be subject to Union non-discrimination law.
The Consumer Credit Directive (EU) 2023/2225127 may also be relevant in this context. Article 18(3) CCD requires that the assessment of creditworthiness is carried out based on relevant and accurate information on the consumer’s income and expenses and other financial and economic circumstances which is necessary and proportionate to the nature, duration, value and risks of the credit for the consumer. That information may include evidence of income or other sources of repayment, information on financial assets and liabilities, or information on other financial commitments. The CCD explicitly prohibits special categories of personal data to be included in the information and to obtain information from s ocial networks. The European Banking Authority’s Guidelines on loan origination and monitoring128 further specify the relevant information for the purpose of creditworthiness assessment s. This specification of the type of data in these sectoral laws for specific evaluation purposes are relevant considerations to be taken into account when determining whether a practice falls within the scope of the prohibition in Article 5(1)(c) AI Act.
Similarly, AI systems used for the evaluation and classification of persons for anti-money laundering and terrorism financing purposes should also comply with relevant Union legislation on these matters.