It's been in Irish law for some time (which makes it applicable to the majority of US tech giants). Unfortunately Ireland isn't hq for a lot of the big finance

It's been in Irish law for some time (which makes it applicable to the majority of US tech giants). Unfortunately Ireland isn't hq for a lot of the big finance and insurance firms which would probably be more useful in this situation. Anyway, here is the latest version of the law: TLDR; if it impacts you it should require a human decision and be appeal-able. Also there is a right to review code but I'm not sure how that works: the right of a data subject not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her shall, in addition to the grounds identified in Article 22(2)(a) and (c), not apply where— (a) the decision is authorised or required by or under an enactment, and (b) either— (i) the effect of that decision is to grant a request of the data subject, or (ii) in all other cases (where subparagraph (i) is not applicable), adequate steps have been taken by the controller to safeguard the legitimate interests of the data subject which steps shall include the making of arrangements to enable him or her to— (I) make representations to the controller in relation to the decision, (II) request human intervention in the decision-making process, (III) request to appeal the decision.