Regulating Social Scoring Systems

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Social scoring systems already evaluate millions of Brazilians in decisions about credit, employment, and public services, but regulation of the practice is still in its infancy in the country.

What social scoring systems are and why they need regulation

Social scoring systems are automated mechanisms that assign scores to individuals based on their behavior, history, and personal characteristics. These scores are used to make decisions that directly affect people’s lives, from granting credit to prioritizing people in public service queues. Unlike traditional credit scoring, which looks mainly at financial history, social scoring systems can draw on web browsing data, social media interactions, spending patterns, geographic location, and even personal connections.

In Brazil, these technologies are expanding rapidly in both the private sector and public administration. Financial technology companies use scoring algorithms that go far beyond conventional credit analysis, incorporating behavioral variables that the data subject often does not even know about. In the public sector, there are initiatives that use automated scores to screen beneficiaries of social programs, prioritize inspections, and even allocate resources in public safety policies. This spread raises profound questions about algorithmic discrimination, transparency, and due process of law.

The need for specific regulation stems from the potential of these systems to perpetuate and amplify structural inequalities. Algorithms trained on historical data tend to reproduce biases present in society, disproportionately penalizing vulnerable populations. A person who lives in a particular low-income outlying neighborhood, for example, may automatically receive a lower score, not because of anything they have done, but because of the statistical correlation between where they live and socioeconomic indicators. This dynamic turns social prejudice into decisions that appear objective and technical.

The Brazilian and international regulatory landscape

The General Data Protection Law (LGPD, Law No. 13.709/2018) is the main body of Brazilian law that applies to social scoring systems. Article 20 of the LGPD gives data subjects the right to request review of decisions made solely on the basis of automated processing of personal data, including decisions meant to define personal, professional, consumer, and credit profiles. This provision establishes an essential safeguard, although applying it in practice still faces considerable challenges, especially regarding how effective the review is and how transparent the criteria are.

Besides the LGPD, the Positive Credit Registry Law (Law No. 12.414/2011, as amended by Complementary Law No. 166/2019) specifically regulates credit scoring, setting rules on how databases are formed, the rights of registered individuals, and the responsibilities of database managers. However, this legislation was designed for the traditional model of credit analysis and does not adequately cover newer forms of scoring that incorporate behavioral variables and non-financial data. There is, therefore, a significant regulatory gap between what current legislation provides and today’s technological reality.

Internationally, there are varied approaches that could inspire Brazilian lawmakers. The European Union, through the AI Act (Artificial Intelligence Regulation), classified social scoring systems operated by public authorities as posing an unacceptable risk and expressly banned them. European legislation also imposes strict transparency and impact assessment obligations on AI systems used in decisions that affect fundamental rights. In the United States, regulation remains fragmented, with state-level and sector-specific initiatives such as the Fair Credit Reporting Act, which offers limited protection in the face of the sophistication of new systems.

The absence of specific regulation for social scoring does not mean the absence of rights: the LGPD, the Consumer Protection Code, and the Federal Constitution itself already provide grounds for challenging discriminatory algorithmic decisions.

Brazil’s Legal Framework for Artificial Intelligence (Bill 2338/2023) is an attempt to fill these gaps. The bill provides for classifying AI systems by risk level, with proportional obligations for transparency, auditability, and accountability. Social scoring systems used for decisions in areas such as credit, employment, education, and public services are likely to be classified as high-risk, making them subject to stricter requirements. The progress of this bill is being closely watched, as it could represent a significant advance in protecting citizens’ rights against automated decision-making.

Concrete risks and impacts on fundamental rights

Social scoring systems pose tangible risks that directly affect constitutionally protected rights. The first and most obvious is the risk of algorithmic discrimination. When algorithms use variables correlated with race, gender, social class, or geographic location, they produce results that, although formally neutral, have a disproportionate impact on historically marginalized groups. There are cases under review in which scoring systems assign lower scores to residents of certain areas, informal workers, or people whose spending patterns are associated with lower income brackets, creating additional barriers to credit, employment, and services.

The second significant risk involves the opacity of decision-making criteria. Most social scoring systems operate as “black boxes,” in which the scoring criteria are protected as trade secrets or are simply too complex to be explained in an understandable way to the data subject. This opacity undermines the right to defend yourself and to be heard, because how can you challenge a decision when its grounds are inaccessible? Brazilian case law has gradually recognized that algorithmic transparency is a condition for the effective exercise of rights, although the contours of this requirement are still taking shape.

There is also the risk of cascading effects. A low score in one system can feed into other systems, creating a cycle of progressive exclusion. A person who receives an unfavorable score on a credit platform may, as a result, have trouble renting a home, which in turn can affect their score in other contexts. This negative feedback loop is particularly serious because it operates invisibly to the affected individual, who often does not know the source of the restrictions they face.

From a fundamental rights perspective, social scoring systems implicate guarantees set out in Articles 1 and 5 of the Federal Constitution, including human dignity, equality, privacy, liberty, and due process of law. When an algorithm determines, without meaningful human involvement, that a person does not deserve credit, should not be hired, or does not have priority in a public service, that amounts to a restriction of rights that requires adequate justification and a real opportunity to challenge it.

Paths to effective regulation in Brazil

Building an adequate regulatory framework for social scoring systems in Brazil requires combining different legal and institutional tools. First, it is essential to pass specific artificial intelligence legislation that sets clear obligations for algorithmic transparency. That means not only the right to know that an automated system made a decision, but also the right to understand, in accessible terms, which factors influenced the score and how those factors were weighed.

Second, algorithmic impact assessments should be mandatory for social scoring systems that affect fundamental rights. These assessments, similar to the Personal Data Protection Impact Report provided for in the LGPD, should be carried out before the system is deployed and updated periodically. They should include testing for bias and discrimination, an analysis of whether the data used is proportionate to the intended purpose, and mechanisms to correct any distortions identified.

Creating effective mechanisms for challenge and human review is another fundamental pillar. The right to review under Article 20 of the LGPD needs to be regulated so that the review is substantive (not merely formal) and so that the burden of showing the decision was correct falls on the system’s operator, not on the affected individual. Shifting the burden of proof in this way is consistent with the principles of the Consumer Protection Code and with the logic of protecting the vulnerable party in the relationship.

Finally, the National Data Protection Authority (ANPD) should play a central role in overseeing and regulating social scoring systems. The ANPD already has authority to act in this area under the LGPD, but it needs technical and human resources commensurate with the complexity of the task. Cooperation with bodies such as the Public Prosecutor’s Office, the Procons (consumer protection agencies), and CADE (Brazil’s antitrust authority) can strengthen oversight capacity and ensure a multidisciplinary approach that addresses the data protection, competition, and consumer dimensions of the problem.

How you can protect yourself today

While specific regulation is not yet in place, Brazilian citizens already have legal tools to challenge decisions based on social scoring. The first step is to exercise your right of access to your data under the LGPD, asking the party responsible for the processing which personal data is being used, how the score is calculated, and which factors determined the decision. You can make this request directly to the data controller and, if it is refused or the response is unsatisfactory, take it to the ANPD through a data subject petition.

When you find that an automated decision produced a discriminatory or disproportionate result, you can seek judicial review based on the LGPD, the Consumer Protection Code, and the Federal Constitution. Collective redress, through public civil actions brought by the Public Prosecutor’s Office or by consumer advocacy associations, is particularly well suited when a scoring system systematically affects a large group of people.

You should also pay attention to data collection practices. Many social scoring systems rely on data collected by apps, digital platforms, and connected devices, often under lengthy terms of use that few people read in full. Reviewing the permissions you have granted to apps, limiting data sharing where possible, and regularly exercising your right to have unnecessary data deleted are preventive steps that can reduce your exposure to unwanted scoring systems.

This subject is directly related to credit and scoring, which we address in a dedicated article.

To round out your reading, see also the firm’s article on AI in education.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.