A person can be refused a loan, investigated at a border, ranked for employment, or routed toward a more expensive insurance product without anyone possessing a complete record of what the person has done. The institution may instead act on a shadow: a machine-generated collection of inferred traits, relationships, propensities, and predicted outcomes. Some parts of the shadow are copied from records. Other parts are calculated from patterns that the person did not knowingly provide and may not recognize as describing them.
The danger is not simply that the shadow is inaccurate. Every human account is partial, and every institution must sometimes make a decision with incomplete information. The deeper danger is that an inference can become an actionable proxy. Once a score is connected to money, mobility, work, education, or public suspicion, the institution no longer needs to prove the underlying fact. The inference becomes the reason to withhold the opportunity that would have allowed the person to answer it.
This essay concerns the shadow's power in the present: how an inferred proxy becomes actionable evidence without becoming a proven fact. It is not chiefly an argument about whether a person can change over time. That separate question begins where prediction hardens into destiny and institutions refuse to recognize conversion.
From Data to Inference
A record says that a transaction occurred, a device visited a location, or an application was submitted. An inference says something about the person: likely debt stress, probable illness, unstable employment, political affiliation, or elevated fraud risk. The second statement may be produced from thousands of signals, including signals about other people who share a neighborhood, language, device, family connection, or purchasing pattern. It can be statistically useful without being a reliable statement about a particular human being.
The distinction matters because institutions often describe an inferred profile as though it were an observed fact. A “high-risk customer” sounds like a property possessed by the customer. In reality, it may mean that a model found a resemblance to a group whose outcomes were costly in the past. A “likely extremist” may describe a classifier trained on contested labels and incomplete context. A “poor fit” in hiring may encode the employer's historical preference for people who have already had access to similar schools, jobs, or professional networks. The label acquires authority by hiding the choices that produced it.
This is why the digital shadow is not just a dossier. It is an institutional relationship in which a prediction can be treated as evidence, and then as a reason, without the person ever seeing the chain from collection to consequence. The shadow follows the person across contexts that were never morally interchangeable. A late payment can become a hiring signal; a visit to a clinic can become an insurance signal; a relative's conduct can become a travel signal. Context is not a technical ornament. It is part of what a fact means.
The Injustice of an Actionable Proxy
Consider a benefits office that uses an automated fraud score. The score may combine address history, household relationships, form completion patterns, and prior investigations. An applicant whose housing is unstable may resemble cases associated with fraud because unstable households produce irregular records. The office pauses the benefit and asks the applicant to prove innocence. The person now faces a practical injustice even if the model is moderately accurate across the population. The model has converted a correlation into a barrier, while the cost of correcting it falls on someone whose resources are already limited.
Or consider employment. A company may infer that candidates who use certain communication styles or attend certain institutions are more likely to remain in a role. The result can reproduce class, disability, racial, or gender disparities without naming a protected characteristic. A proxy can be discriminatory in effect while its designer insists that the system never receives race or religion as a field. Removing an explicit field does not remove the social meaning carried by geography, language, income, health, school, or network data.
Due process becomes especially fragile when a shadow controls access rather than merely assisting an inquiry. A person is not told what fact is disputed, which source supplied it, what rule applies, or how to submit a correction. There may be a notice, but no intelligible reason; a review button, but no reviewer empowered to disagree; a human signature, but no time to examine the case. The system has formalized the appearance of process while transferring the burden of explanation to the person least able to obtain the relevant records.
When the Error Becomes Self-Confirming
A shadow can also become self-confirming. A low score causes a bank to deny credit, which deprives the applicant of the repayment history that could have improved the next score. A school routes a child away from advanced work, then cites the lack of advanced work as evidence that the original judgment was correct. A platform gives a worker fewer assignments, and later interprets the worker's reduced earnings as evidence of unreliability. The model appears to predict the future while participating in its production.
A feedback loop does not require malicious intent. It can arise from an institution optimizing a narrow objective while ignoring who is excluded, who receives a second chance, and which opportunities generate the data used for the next decision. Statistical performance measured on past outcomes cannot by itself show that the decision is just in a changed circumstance. An accurate map of a previously unequal landscape can still guide an institution toward reproducing the inequality.
Person, Shadow, and the Moral Order
Catholic social thought does not require institutions to pretend that facts are irrelevant. Prudence needs attention to reality, and justice may require distinguishing relevant risks. But the person cannot be exhausted by the profile through which an institution encounters them. The equal dignity and rights defended in Gaudium et Spes 26–27 support the conclusion that a person cannot be reduced to institutional utility, while theCatechism links human dignity to freedom and responsibility (CCC 1700, 1731–1738). A profile can be evidence about a question. It cannot become the person's civic identity by administrative convenience.
This has a direct implication for the common good. The common good is not the maximum predictive efficiency of the most powerful institution. It includes social conditions in which people and communities can participate, recover from error, and pursue their legitimate ends. Subsidiarity, associated withQuadragesimo Anno 79–80 and later Catholic teaching, warns against concentrating decisions at a level that ignores the knowledge and responsibility of persons and smaller communities. A distant score can be administratively cheap while being morally ignorant of the local facts that would change the decision.
The Objection from Scale
The strongest objection is that modern institutions cannot function through case-by-case intuition. Banks must detect fraud, hospitals must allocate scarce care, employers must process thousands of applicants, and public agencies must identify urgent needs. Inference can reveal patterns that no individual reviewer could see. Requiring a full hearing for every score may paralyze an organization and leave honest people exposed to those who exploit procedural delay.
This objection is correct about scale and incomplete about authority. Institutions can use models to sort work, detect anomalies, and suggest questions. The moral threshold is crossed when a suggestion becomes a concealed verdict about a person's entitlement or credibility. Triage can be automated when errors are reversible and stakes are low. As severity, duration, irreversibility, and vulnerability increase, the system must provide stronger notice, evidence, human judgment, and a path to correction. Efficiency does not erase the duty to avoid making an unreviewable proxy decisive.
Nor does fairness require a reviewer to accept every appeal. A reviewer may find that a relevant record is accurate, a legal condition unmet, or a genuine risk unresolved. What matters is that the institution identifies the proposition at issue and permits the person to contest it. A process can reject a claim without reducing the claimant to a suspicious type. Indeed, appeals can reveal systematic errors, missing categories, and rules whose costs have been shifted onto people outside the model's training population.
Prediction, Ranking, Triage, and Adverse Action
“The model decided” hides several different uses. A prediction can estimate an event; a ranking can order scarce attention; triage can route a reversible low-stakes case; an adverse action can deny or restrict an opportunity. They should not share one threshold for notice and review. A model may sort a queue when a person still receives the service and the error can be corrected, yet require a pause, case-level reason, and empowered reviewer before it controls access to housing, income, health, liberty, or essential work.
The comparison should report calibration, subgroup false-positive and false-negative costs, proxy necessity, feedback loops, and who bears the burden of correction. Different fairness aims can conflict when errors cannot all be reduced at once; the institution should disclose the chosen tradeoff and its reasons rather than call one metric neutral. Human review is not automatically fair, so a human baseline and the model-assisted baseline should be compared. The decision remains unjustified if replacing the model merely restores opaque discretion.
GDPR Article 22, the Fair Credit Reporting Act, and the EU AI Act are partial, jurisdiction-specific sources for some of these safeguards, not universal proof that a remedy exists. Whatever the legal regime, the institution should publish the case-level reason, empower a reviewer to reverse the consequence, and restore access or notify downstream recipients when an erroneous shadow has already done harm.
Legal Protections Without Overclaiming
Some legal systems already recognize pieces of this problem, but no single rule creates a universal right to escape profiling. In the European Union, the GDPR contains transparency, data-subject rights, purpose limitation, data minimization, and provisions concerning solely automated decisions with legal or similarly significant effects, including exceptions and safeguards in Article 22. Its application depends on the controller, the processing, the legal basis, and other applicable law. The EU AI Act adds obligations for specified systems and actors on a phased schedule; it does not turn every inference into an unlawful decision or settle every question about private-sector profiling.
In the United States, constitutional due process generally constrains government action, not every private ranking system, and the required procedure depends on the interest, the government role, and the circumstances. The Fair Credit Reporting Act regulates certain consumer reports and gives rights that may include notice and dispute procedures, but it does not cover all data products or all employment and insurance decisions. Sectoral privacy laws and state-level rules add variation. A person should not infer from a model's opacity alone that a particular legal remedy exists. Institutions should not infer from the absence of a remedy that the practice is just.
What a Shadow Owes the Person
A responsible institution should first specify the decision, the legitimate purpose, and the evidence actually needed. “Improve risk management” is too broad to constrain collection or use. The institution should identify which inferences are generated, which are used in decisions, how long they remain active, and which people can see them. It should test whether the proxy is merely a convenient substitute for a protected or irrelevant characteristic and whether the model works for populations with different histories and forms of documentation.
Before a consequential decision, the person should receive notice that an inference materially contributed to the outcome. The notice should state the principal facts and rule in ordinary language. “Our system found you high risk” is not a reason. “We relied on an address mismatch and a record from this source; the mismatch can be corrected by these means” gives a person a starting point. Where disclosure would create a serious security or fraud risk, the institution may need a narrower explanation, but secrecy should not become a blanket excuse for withholding every basis for action.
There must also be a pause and an appeal proportionate to the harm. The reviewer needs authority to examine source data, understand the model's role, consider context, and reverse the outcome. The institution should preserve a record of the version, inputs, human actions, and reasons, subject to appropriate privacy and security controls. A model card or general fairness statement cannot replace a case-specific remedy. Nor can a “human in the loop” who is measured solely by agreement with the score.
Correction Is Not the Whole Remedy
Correcting a database field is necessary but sometimes insufficient. The institution may have already denied a service, circulated a suspicion, missed a deadline, or caused a person to abandon an opportunity. Remedy may require restoring access, reconsidering related decisions, notifying downstream recipients, or compensating a loss where law or policy provides for it. A digital shadow can travel farther than the record from which it was derived. Justice asks not only whether the original cell is now accurate, but whether the institution repairs the consequences of acting on the error.
The Person Casts a Longer Shadow
Data can be useful evidence, but it is never a complete account of the human being who appears within it. The digital shadow is made from the past, from other people, from institutional categories, and from assumptions about what a signal means. It may help direct attention. It cannot inherit the authority owed to a person who can speak, explain, repent, change, and participate in judgment.
A just institution will therefore ask less often, “What does our model say this person is?” and more carefully, “What limited question are we entitled to ask, what evidence answers it, and how can this person challenge our answer?” That change is practical rather than sentimental. It prevents correlations from becoming verdicts, preserves due process where the law requires it, and extends procedural dignity where law has not yet caught up with technical power.
The synthesis is not that institutions must abandon prediction. It is that prediction must remain subordinate to a lawful purpose, proportionate evidence, and a human process capable of correction. The common good cannot be built by making a shadow easier to serve than the person who casts it. If a system is too opaque to explain, too powerful to contest, and too consequential to reverse, the problem is not merely an imperfect model. It is an institution that has forgotten whom its knowledge is for.
Sources and qualifications
The account of dignity, participation, prudence, subsidiarity, and the common good draws on Gaudium et Spes 16, 24, and 26;Quadragesimo Anno 79–80; and the Catechism of the Catholic Church 1700, 1731–1738, 1776–1782, 1806, and 1905–1912. These teachings do not provide a technical fairness metric. They require that social power remain ordered toward the dignity and participation of persons rather than treating administrative categories as final descriptions of them.
References to the GDPR, the EU AI Act, the Fair Credit Reporting Act, and due-process principles are general and jurisdiction-dependent. Their scope, exemptions, effective dates, and remedies differ by context. This essay is not legal advice. The normative claim is broader and more modest: when an inferred profile can materially restrict a person's life, the institution should provide notice, relevant reasons, evidence, and an empowered route to correction.
Source Notes
The council’s account of human dignity, participation, conscience, and social institutions that must serve rather than absorb the person.
The Catholic source for subsidiarity, used to question distant, centralized decisions that ignore local knowledge and responsibility.
The Church’s teaching on dignity, freedom, responsibility, prudence, conscience, and the common good against which profile-based power is evaluated.
The legal framework’s provisions on transparency, data-subject rights, purpose limitation, minimization, and certain solely automated decisions, subject to scope and exceptions.
The European Union’s risk-based framework for specified AI systems, including duties concerning transparency, documentation, human oversight, and risk management.
U.S.-specific federal law governing consumer reports and related notice, accuracy, and dispute rights in its defined consumer-reporting contexts; it does not regulate every data product or decision.
Editorial revision note
This essay completed one self-editing, cross-essay consistency, and strongest-criticism pass. Its controlling thesis was preserved while objections, qualifications, evidence limits, and practical consequences were strengthened.