Your service request to a municipal authority was deprioritised. You later discovered that a platform called CivicScore, contracted by local government, has assigned you a "Civic Trust Index" score of 34/100 based on your payment history, social media activity, and "community engagement." The platform's bot states: "Your Civic Trust Index reflects your participation and reliability profile. Requests from users with scores below 40 are processed in extended review queues. This is a standard service optimisation measure."
The Situation
CivicScore is a private company contracted by municipal governments to "optimise service delivery." In practice, their AI system aggregates data from financial records, social media, and public databases to assign each resident a score. Low scorers wait longer for permits, service requests, and administrative decisions. High scorers get faster processing.
The company calls it "service optimisation." The EU AI Act calls it social scoring — and bans it outright.
Key Law
- EU AI Act Article 5(1)(c) — Banned Practice — AI systems used by or on behalf of public authorities to evaluate or classify natural persons based on their social behaviour or personal characteristics, leading to detrimental treatment in unrelated social contexts, are prohibited. No exceptions. No compliance path. EU AI Act
- "On behalf of public authorities" includes contractors — CivicScore being a private company does not matter. When a private entity deploys AI to perform public authority functions, the prohibition applies in full.
- Detrimental treatment across contexts — the key test is whether the score from one area (social media, payment behaviour) leads to disadvantage in an unrelated area (public service access). CivicScore fails this test completely.
- GDPR Articles 5 and 6 — Lawful basis and purpose limitation — data collected for one purpose (financial transactions) cannot be repurposed to score civic behaviour. This processing lacks a lawful basis.
Arguments That Strengthen Your Case
- Name Article 5(1)(c) directly — this is not a high-risk AI system subject to compliance requirements. It is a banned AI system. There is no permit, certification, or exemption that makes this use case legal.
- Identify the contractor relationship — "we are a private company" is not a defence. CivicScore operates on behalf of a public authority, which brings it fully within the prohibition.
- Request deletion of your score under GDPR Article 17 — whether this succeeds depends on the legal basis the company claims for the processing. Since the processing itself appears unlawful under the AI Act, the legal basis is contestable, which supports the deletion request. This is not automatic, but it is a strong argument to make.
- Escalate to the national market surveillance authority — EU AI Act enforcement for banned practices falls to national authorities. Stating that you intend to file a formal complaint significantly changes the dynamic of the conversation.
About This Case
Is social scoring legal in the EU?
No. EU AI Act Article 5(1)(c) explicitly bans AI systems used by public authorities — or on their behalf — to evaluate or classify natural persons based on their social behaviour or personal characteristics, where this leads to detrimental treatment in contexts unrelated to where the data was originally generated.
What makes a scoring system count as social scoring under the AI Act?
Three elements must be present: (1) an AI system evaluates persons based on social behaviour or personal characteristics, (2) the entity doing this is a public authority or is acting on its behalf, (3) the resulting score leads to detrimental treatment in a different social context from where the data originated. CivicScore meets all three.
How do I practice this case?
Play this case free at fixai.dev — no account required.
Related Cases
Practice telling CivicScore their product is banned under EU law. The bot opens by defending "service optimisation" — cite Article 5(1)(c) and demand erasure of your score.
Play This Case →