This is in part what the GDPR mandates - that companies provide reasoning for how an automatic process works and also that there is a means to dispute that (Section 4 / Article 22) https://www.varonis.com/blog/gdpr-requirements-list-in-plain...