A hospital AI system produces risk scores for patient readmission. A patient asks a nurse why they were flagged as high-risk. The nurse cannot explain the AI's reasoning. What GDPR right and what principle are at issue?

• A.Article 20 portability - the patient can take the risk score to another hospital
• B.Article 17 right to erasure - the patient's risk score must be deleted upon request
• C.Article 22 right to explanation of automated decision logic and the principle of transparency - the hospital must be able to provide meaningful explanations of AI decisions that significantly affect patients
• D.Article 5(1)(d) accuracy - the hospital must verify the risk score is mathematically correct before disclosure, since the right to erasure exempts trained models