L2-M5 / lesson 1 of 2
A fictional lender considers account history and social-media data.
Start here / A workplace decision
A fictional lender considers account history and social-media data.
The project team has an AI risk label but no defined processing purpose.
Before you read / Think it through
Pause and form your answer, then compare the reasoning. This reflection is not scored.
Identify purposes, necessity and the applicable lawful basis separately.
The ideas below give you a method for this decision. Then work through the rest of this case and try the decisions yourself.
AI Act compliance does not displace the GDPR.
Personal-data processing needs its own lawful assessment.
A system may be low risk under one framework yet high risk for privacy. Avoid treating a product badge as permission to process.
Reuse evidence but map separate requirements.
A lender wants to combine applicants' account histories with social-media data to generate a credit score and automatically reject applications below a threshold. The supplier says the AI Act classification covers privacy. Staff propose collecting ethnicity data to test fairness without further review.