The inference hearing¶

Research brief, The Morporkian Civil Liberties Union (MCLU). Open file.

Nobody collected the fact. The grocer knows what was bought. The employer knows the shifts. The physician’s cooperative knows the weight. The carriage company knows the journeys. None of them holds anything remarkable on its own.

Put together by something that is good at putting things together, they produce a sentence nobody ever typed: probably pregnant, probably in difficulty, probably looking for other work, probably living with the person at the second address.

There is no leaked record to point at. The subject supplied none of it. Every input was given willingly for a purpose that had nothing to do with the conclusion.

• What is the standing of a belief a system holds about you that you never told it?

• A subject access request returns what was collected. What returns what was concluded?

Whether a guess is personal data¶

• Gartner on privacy incidents from AI-generated inferences, July 2026, for the shift from data exposure to insight exposure.

• Whether GDPR’s definition of personal data has been held to cover inferences, and which authority said so. Wachter and Mittelstadt on a right to reasonable inferences is the starting point, not the answer.

• Article 22 and automated decision-making: whether it bites when the inference is held and not acted on.

• Any regulator decision ordering disclosure of inferred attributes in response to an access request.

• The AI Act on profiling, and whether an inferred characteristic is treated differently from a collected one.

Last updated: 17 September 2026