You apply for a service and receive an immediate rejection. Nobody can explain the result beyond saying that “the system decided”. You suspect that software assessed your information, but you cannot tell which details mattered or whether anyone checked them.
Artificial intelligence is increasingly discussed in everyday decisions, yet an automated outcome does not become lawful simply because a computer produced it. South African law already contains protections that may matter. The Protection of Personal Information Act, known as POPIA, includes a specific provision on automated decision making.
The practical starting point is to establish what actually happened. A chatbot answering a question, a system flagging an application and software making a final decision are different situations.
Find out what role the system played
Ask the organisation whether the decision was made entirely by automated processing or whether a person assessed it. Request a description of the information used and the route for querying the result.
Do not assume that an instant response proves AI was involved. A conventional rule might reject an incomplete form. Equally, a staff member pressing “approve” after receiving a score does not tell you how carefully the underlying information was considered.
Keep the rejection notice, application details and any explanation. Record the questions you asked and the responses. You are trying to establish the decision process, rather than prove that a particular technology is inherently unfair.
What POPIA says about automated decisions
Section 71 addresses decisions based solely on automated processing of personal information intended to profile aspects such as work performance, creditworthiness, reliability, location, health, preferences or conduct. It applies where the decision has legal consequences for the person or substantially affects them.
The protection is qualified. The Act provides exceptions for certain decisions connected with concluding or performing a contract and for decisions governed by law or a code of conduct with appropriate safeguards. Where the relevant contractual exception requires protective measures, those include an opportunity to make representations and sufficient information about the underlying logic to enable those representations.
The https://www.gov.za/sites/default/files/gcis_document/201409/3706726-11act4of2013protectionofpersonalinforcorrect.pdftext of POPIA is the source for these requirements. Section 71 does not create an unlimited right to inspect every computer system or require a human to redo every routine calculation.
Ask whether the information is accurate
Sometimes the most useful challenge concerns the input. An old address, an incorrect debt record or information attached to the wrong person can affect an assessment before any sophisticated technology comes into play.
POPIA includes rights relating to access to personal information and correction or deletion in specified circumstances. These rights have conditions and procedures. Ask the organisation how to exercise them and which information it holds about you.
For example, suppose an application lists your monthly income as R8,000 instead of R18,000. Your first request should identify that discrepancy and provide reliable proof. A broad accusation that the algorithm is biased may leave the obvious factual correction unresolved.
Keep copies of the original and corrected information. Ask whether the correction will trigger reassessment or whether you must submit a separate request. Do not assume that updating a profile automatically reverses an earlier decision.
Suppose an application is rejected because a system links you to someone else’s unpaid account. A useful challenge identifies the incorrect link and supplies suitable evidence distinguishing the two people. It also asks whether correcting the record will trigger a fresh assessment. Requesting a human review without identifying the error may leave the same inaccurate information in use.
After any correction, ask for confirmation of the result and check the next decision. A repaired database entry and a reconsidered application are separate outcomes. Keeping track of both helps establish whether the original problem has actually been addressed.
Make a request that can be answered
You can ask for an explanation without demanding programming code. A practical request might cover:
- Whether the outcome was based solely on automated processing.
- Which categories of personal information were used.
- Whether information came from another organisation.
- How you can correct an inaccurate record.
- Whether representations or a review are available.
- Which team is responsible for responding to the request.
Keep the request specific to your application. If you are challenging a refusal, explain what appears wrong and what supporting information you can provide. Ask for a reference number and a written response.
Avoid sending unnecessary identity documents to an unverified address. Use the organisation’s established channel, and confirm that it is the appropriate place for sensitive information.
Look beyond the technology label
The legal issue may involve more than POPIA. A public body using software still needs to exercise its powers lawfully. A credit decision may raise questions under credit legislation. An employment decision may involve labour law or discrimination.
There is no single complaint route that resolves every use of AI. Identify the relationship first. Are you a customer, employee, applicant or person affected by a public decision? Then identify the harm. Was inaccurate information used, was a protected characteristic treated unfairly, or was a procedure omitted?
If a government decision is involved, the Department of Justice’s https://www.justice.gov.za/paja/about/review.htmadministrative justice guidance explains the role of review and internal remedies. That framework does not disappear because an official relied on software.
Distinguish unfairness from disappointment
An organisation may lawfully decline an application. The fact that the outcome was automated does not establish that you met the eligibility requirements. It also does not excuse an inaccurate or unlawful process.
Separate the questions in your correspondence. First, is the information correct? Second, what criteria were applied? Third, was the decision process lawful? Finally, what review or complaint mechanism is available?
This structure helps avoid an unproductive exchange in which you discuss AI in general while the organisation responds only that you did not qualify. Focus on your actual record and the consequences of the decision.
Escalate a personal information complaint carefully
The Information Regulator handles POPIA complaints within its mandate. Its https://inforegulator.org.za/popia/POPIA information and complaint guidance sets out the available procedures. A data protection complaint and an appeal against the underlying refusal are not necessarily the same thing.
Check any separate deadline for challenging the decision. Do not assume that contacting the Regulator suspends a court time limit, an employment referral period or a contractual deadline.
Your complaint file should contain the outcome, the information you believe is inaccurate, your requests to the organisation and the responses. Explain what you want investigated. If the problem involves several issues, say which concern relates to personal information and which concerns the decision itself.
What businesses should check before using AI
A business considering automated assessments should start with the decision it plans to make. What will happen to a person if the system produces a particular output? Which personal information is necessary? Who can correct mistakes?
Make responsibility clear before deploying the tool. A supplier’s statement that its software is “compliant” is not a substitute for checking how your organisation will use it. Staff need to know when to escalate a query and who can reconsider an outcome.
Consider a trial in which staff record why an output was accepted or rejected. This can expose missing information and unclear criteria before the tool affects customers. Keep security, access and retention arrangements under review, especially when information is sent to an external service.
Ask for a process you can understand
You do not need technical expertise to question a decision that affects you. Start with the information, the consequence and the route for making representations. Preserve the record and pursue the appropriate deadline.
“The system decided” is a description of a process, not a complete explanation of your rights. A focused request gives the organisation an opportunity to correct a mistake and gives you a stronger basis for deciding what to do if it will not.
