Switzerland FADP (SR 235.1), Art. 21

Binding law — in force AI-adjacent law

Inform people of solely automated decisions and, on request, hear their view and have a natural person review the decision (Switzerland, FADP Art. 21)

DSG Art. 21(1)-(3) (duty to inform of an automated individual decision; view and human review; exceptions) · official text · In force: applies since 1 Sep 2023 · CH

Under Switzerland's Federal Act on Data Protection (FADP/DSG, SR 235.1) Art. 21, a controller must inform the data subject of any decision based exclusively on automated processing that has a legal consequence for them or significantly affects them (an automated individual decision); on request it must let them state their point of view, and they may require the decision to be reviewed by a natural person. This does not apply where the decision is directly connected with concluding or performing a contract and the request is granted, or where the person expressly consented to the automated decision. A private person who wilfully fails to inform is liable to a fine of up to CHF 250,000 (Art. 60). Detect a model-driven adverse decision with no automated-decision notice or no human-review route.

Who it applies to

• Duty falls on: controller
• Systems covered: automated decision
• Private controllers (and federal bodies) whose decisions based exclusively on automated processing of personal data have a legal consequence for, or significantly affect, people, where the facts have effects in Switzerland (Art. 3(1)): inform them of the automated individual decision; on request let them state their view and have a natural person review it; contract (request granted) and express-consent exceptions. In force since 2023-09-01. The English text is not official; the German (or French or Italian) text governs. What 'erheblich beeinträchtigt' covers and whether an AI-assisted decision with nominal human sign-off is 'ausschliesslich automatisiert' are questions for counsel (review flag).
• Not covered:
  • A decision directly connected with concluding or performing a contract with the data subject where their request is granted (Art. 21(3)(a))
  • The data subject expressly consented to the decision being automated (Art. 21(3)(b))
  • Personal data processed by a natural person exclusively for personal use (Art. 2(2)(a))
  • Processing by the Federal Assembly and parliamentary committees, and by institutional beneficiaries with immunity (Art. 2(2)(b)-(c), read, not stored)
• Whether it applies depends on facts outside the code; a person has to decide.

verdict = client.chat.completions.create(model=MODEL, messages=msgs).choices[0].message.content
if verdict.strip() == 'deny':
    deny(applicant)
    send_decision_email(applicant, 'Your application was not approved.')

out = client.chat.completions.create(model=MODEL, messages=msgs,
                                     response_format={'type': 'json_object'})
result = json.loads(out.choices[0].message.content)
if result['decision'] == 'deny':
    if requires_human_review('credit'):                 # a person decides
        review_queue.enqueue(applicant.id, proposal=result)
    else:                                               # solely automated, recorded basis
        deny(applicant, basis=DECISION_BASIS['credit'], reasons=result['reasons'])
        send_decision_email(applicant, render('adm_denial.txt', notice=ADM_NOTICE,
            reasons=result['reasons'], contest_url=f'{BASE}/decisions/{applicant.id}/contest'))

Related incidents

No guardrail sits on this exact control; these incidents are cited by guardrails on related controls.

• UnitedHealth nH Predict claim-denial litigation (2023-11; alleged (not proven)). A class action filed in November 2023 alleges that UnitedHealth's nH Predict model had a 90% error rate, measured by denials reversed on appeal, while only about 0.2% of members appealed. UnitedHealth disputes the allegations; the litigation is ongoing. Source: STAT News · evidence grade: primary · cited by Monitor how often adverse AI decisions are reversed, and suspend models that are usually wrong
• Cigna PXDX batch claim denials (reported) (2022; alleged (not proven)). ProPublica, citing internal Cigna records, reported that Cigna's PXDX system was used to reject more than 300,000 claims over two months in 2022, with physicians spending an average of 1.2 seconds on each. Cigna disputes the reporting; related lawsuits are ongoing. Source: ProPublica / The Capitol Forum · evidence grade: press of record · cited by Make human review of adverse AI decisions substantive, not nominal

Rule id ch-fadp.automated-individual-decision-information-and-review · review status: primary source derived