The American Way — Until Machine Learning Algorithm Beats the Law? Algorithmic Consumer Credit Scoring in the EU and US

Asress Adimi Gikay

DOI: https://doi.org/10.2139/ssrn.3671488

2020-01-01

SSRN Electronic Journal

Abstract:Algorithmic consumer credit scoring has caused anxiety among scholars and policy makers. After a significant legislative effort by the European Union, the General Data Protection Regulation (GDPR) that has provisions tailored to automated decision-making (ADM) was implemented. When the EU Commission and the US Department of Commerce negotiated for US organizations to whom data from EU data controller is transferred to comply with the key principles of EU Data Protection Law under the EU-US Privacy Shield (PS) Framework, the Department of Commerce refused to incorporate the GDPR principles governing ADM in the PS Framework. The EU Commission accepted this refusal reasoning that where US companies make automated decisions with respect to EU data subjects, such as in consumer credit risk scoring, there are laws in the US that protect the consumer from adverse decisions. This view contradicts recommendations for implementing GDPR-Inspired law in the US to tackle the challenges of automated consumer credit scoring. This article argues that despite the differences in the approach to the regulation of automated consumer credit scoring in the EU and the US, consumers are similarly protected in both jurisdictions. Furthermore, US consumer credit laws have the necessary flexibility to ensure that adverse automated decisions are tackled effectively. This article, through analyzing statutes, cases, and empirical evidences, demonstrates that the seemingly comprehensive legal rules governing ADM in the GDPR do not make the EU consumers better off. In addition, the challenges presented by the increasing sophistication of Artificial Intelligence (AI), specially machine learning, place both the EU and the US legal regimes in a similar position as neither jurisdiction is equipped to respond to autonomous, unpredictable and unexplainable algorithms making decisions. US authorities should continue to apply their existing laws until evidence shows the rampant use of machine learning decisions with significant harm to public interest while the EU should take its traditional lead in regulatory reform in this field by elevating the effort to regulating machine learning. In view of the limits of the existing legal rules, the article proposes risk-based approach to regulation and regulatory sand-boxing as good starting points.