Algorithms Make Decisions About You.
You Have the Right to Know Why.

Most large employers now run every CV through an Applicant Tracking System (ATS) that scores CVs by keyword matching, formatting compliance, employment gap detection, and educational credential parsing. A CV from a strong candidate with a foreign university name, non-standard date formats, or a name that does not match the demographic pattern of previous hires can be rejected before any human sees it.

What you can do: Request confirmation from the employer that your application received human review. Under GDPR (EU/UK) and equivalent legislation, you have the right to request that a solely automated rejection be reviewed by a human. Use a CV adaptor tool to optimise your CV for ATS systems.

Some employers use AI video analysis tools (HireVue, Pymetrics) that score candidates on facial micro-expressions, speech patterns, and word choice. Multiple studies have found these tools perform less accurately on darker skin tones and non-native speakers — systematically disadvantaging exactly the population PLENA serves.

Your rights: In the EU, automated video scoring of candidates constitutes automated decision-making under GDPR Article 22. You have the right to request human review of any decision based substantially on automated processing. In Illinois (USA), the AI Video Interview Act requires employer disclosure. Ask the recruiter explicitly whether your video was scored by an automated system.

Beyond your repayment history, credit and insurance algorithms may use: your postal code (penalising immigrant-dense neighbourhoods), the frequency of address changes (common for newcomers), the time since your first account was opened (disadvantaging recent arrivals), the device you use to apply (mobile vs desktop), and in some jurisdictions, data aggregated from your shopping behaviour, social media, and app usage.

Some of these data uses are restricted or prohibited by law. The problem is that most people do not know to ask what data was used.

Under GDPR (EU/UK), the Equal Credit Opportunity Act (USA), the Financial Consumer Agency of Canada Act (Canada), and equivalent legislation: you have the right to know the principal reasons for a credit or insurance decision, the right to dispute inaccurate data, and the right to request human review of an automated decision. In the EU, you have the explicit right to not be subject to decisions based solely on automated processing that significantly affect you.

In practice: Ask the lender or insurer in writing for the specific factors that led to the decision and whether the decision was made by an automated system. If it was — request human review and provide any context that the algorithm would not have had (e.g. your employment start date, explanation of address changes).

Immigration authorities in Canada, the UK, the EU, Australia, and the USA use AI systems to: risk-score visa applications (assigning likelihood of refusal before human review), verify the authenticity of documents at scale, identify patterns associated with fraud, and flag applications for enhanced scrutiny. Some of these systems have been found to introduce racial and national-origin bias — scoring applicants from certain countries as higher risk based on historical rejection patterns rather than individual merits.

The EU AI Act explicitly classifies AI systems used in migration, asylum, and border control as high-risk. This means: providers must register the system, conduct conformity assessments, maintain documentation, enable human oversight, and ensure the system can be overridden by human decision-makers. If you are in the EU and believe an AI system affected your visa or asylum application, you have the right to request information about whether AI was used and to have the decision reviewed by a human.

Contact the relevant national migration authority and explicitly state that you are requesting information under the EU AI Act regarding the use of automated decision-making in your case.

IRCC (Immigration, Refugees and Citizenship Canada) has used the Chinook system to process large volumes of applications. A Federal Court ruling in 2020 found that automated processing without adequate human review could violate procedural fairness requirements. If you received a refusal that was processed unusually quickly and gave no individual reasoning, you have the right to request written reasons and a reconsideration review. Consult a regulated RCIC or immigration lawyer regarding judicial review if appropriate.

What the EU AI Act does: Creates a risk-tiered framework. High-risk AI (hiring, credit, immigration, education, law enforcement) must meet strict requirements — transparency, human oversight, registration, and conformity assessment. Bans certain AI uses entirely (social scoring by governments, real-time biometric surveillance in public). Gives individuals the right to explanation and human review for high-risk AI decisions.

Timeline — where enforcement stands now (March 2026): Prohibited practices have been enforceable since 2 February 2025. Full enforcement of high-risk AI obligations begins 2 August 2026. Finland was the first EU member state to obtain full AI Act enforcement powers (December 2025). If you are in the EU and an AI system affected a high-risk decision about you — hiring, credit, immigration, education — you can begin exercising your rights now: the law is in force, national authorities are operational.

GDPR Article 22: You have the right to not be subject to a decision based solely on automated processing that significantly affects you. You can request human review. The organisation must explain the logic of the decision in plain language upon request.

Enforcement: Your national Data Protection Authority (DPA). The EU AI Office for GPAI models and cross-border cases. Fines up to €35M or 7% of global turnover for prohibited practices; up to €15M or 3% for high-risk violations. EU AI Act official →

Post-Brexit: UK retained GDPR Article 22 in the UK GDPR. Same right to not be subject to solely automated decisions, same right to human review and explanation. The ICO (Information Commissioner's Office) has published specific guidance on AI decision-making.

Employment: The Equality Act 2010 prohibits indirect discrimination by automated systems. If an AI hiring system disproportionately screens out people of a particular nationality, race, or similar protected characteristic — that is potentially unlawful even if unintentional.

Enforcement: ICO for data rights · EHRC for equality · Financial Ombudsman for financial services. ICO AI guidance →

AIDA (Artificial Intelligence and Data Act): Canada's proposed federal AI legislation was part of Bill C-27, which died on the order paper when Parliament was prorogued in January 2025. AIDA was never passed into law. A new Parliament must re-introduce AI legislation from scratch — no timeline confirmed as of March 2026. Canadians currently have no dedicated federal AI rights law equivalent to the EU AI Act.

Treasury Board Directive on Automated Decision-Making: Still in force for federal government AI systems. Requires impact assessments, human review mechanisms, and explainability based on the impact level of the decision — this gives Canadians meaningful rights against federal government automated decisions specifically.

PIPEDA / Bill C-27 Consumer Privacy Protection Act (CPPA): The privacy law portion of Bill C-27 also lapsed. PIPEDA (the existing federal privacy law) remains in force. Quebec's Law 25 (in force since 2023) is Canada's strongest privacy framework and includes rights around automated decision-making for Quebec residents.

Enforcement: OPC (Office of the Privacy Commissioner) · CHRC for employment discrimination · Quebec Commission d'accès à l'information for Law 25. OPC →

No comprehensive federal AI Act — USA regulation remains sector-specific. Key protections: FCRA (Fair Credit Reporting Act) — right to know reasons for credit decisions, right to dispute. ECOA (Equal Credit Opportunity Act) — credit decisions cannot discriminate by national origin, race, sex. Title VII — employment discrimination applies to AI hiring tools. ADA — disability discrimination prohibition applies to automated assessments.

Federal AI Policy (2025–2026): President Trump's Executive Order on AI (December 11, 2025) and the White House National AI Policy Framework (March 20, 2026) establish a "minimally burdensome" federal standard and created a DOJ AI Litigation Task Force to challenge state AI laws deemed "onerous." A Senate vote of 99–1 rejected a proposed 10-year moratorium on state AI laws (July 2025). The former Biden Executive Order on AI (2023) directing federal agencies on AI civil rights protections was revoked. CFPB guidance that ECOA applies to algorithmic credit decisions remains in effect. FTC enforcement under Operation AI Comply continues, focusing on unsubstantiated AI capability claims.

State laws (active as of March 2026): Illinois AI Video Interview Act · Colorado AI Act (effective June 30, 2026, though under federal challenge) · NYC Local Law 144 (hiring algorithm bias audits) · California AI transparency law (in force January 1, 2026) · New York frontier AI transparency law (effective January 1, 2027). Check your state — the landscape is shifting rapidly. CFPB → EEOC →

Privacy Act 1988 (amended): Gives Australians rights to access personal data held by organisations and to correct inaccurate data used in automated decisions. The Australian Privacy Principles apply to large organisations and government agencies.

AI Governance Framework: Australia has published voluntary AI Ethics Principles but mandatory regulation is developing. The OAIC (Office of the Australian Information Commissioner) investigates complaints about automated data use.

Discrimination law: The Racial Discrimination Act and Sex Discrimination Act apply to automated decisions — an AI system that disproportionately disadvantages people based on race or national origin may be unlawful. OAIC →