Right not to be subject to automated decisions

What it is

The right not to be subject to automated decisions is the right not to be subject to decisions based solely on automated processing (algorithms, artificial intelligence) that produce legal effects or similarly significantly affect you.

In short: “An algorithm alone cannot decide my fate”.

For the right to apply, all of these elements must be present:

• a decision (not just a recommendation);
• based solely on automation (no meaningful human involvement);
• with a legal or similarly significant effect on the person.

Profiling

The definition

The GDPR (Art. 4.4) defines it as any form of automated processing of personal data to evaluate personal aspects: performance at work, economic situation, health, preferences, interests, reliability, behaviour, location.

Examples of profiling

• Credit scoring (creditworthiness)
• Behavioural scoring in insurance
• Automated recruitment (AI screening of CVs)
• Bank fraud detection
• Predictive policing
• Marketing segmentation

When it is lawful

Profiling in itself is lawful if:

• ✓ there is consent or another legal basis;
• ✓ the information provided is clear (existence, logic, consequences);
• ✓ it does not produce automated decisions under Art. 22 (or falls within the exceptions).

It is unlawful if:

• ✕ it concerns sensitive data without the conditions of Art. 9.2;
• ✕ it produces automated decisions without human involvement;
• ✕ information or consent is missing.

The 3 exceptions: when an automated decision is lawful (Art. 22.2)

Art. 22.1 prohibits purely automated decisions, but Art. 22.2 provides three exceptions.

a) Necessary for a contract (Art. 22.2.a)

The automated decision is necessary to enter into or perform a contract.

Lawful examples

• Automatic approval of a small loan (under €5,000) according to a standard policy.
• Automatic calculation of an online insurance premium based on objective parameters.

Not necessary

• The automatic rejection of a mortgage: the bank can always include a human review.

Interpretation: it is a narrow exception, to be used rarely.

b) Authorised by law (Art. 22.2.b)

EU or national law expressly provides for it, with suitable safeguards.

Examples

• Bank anti-fraud algorithms (anti-money-laundering rules, with guarantees of appeal).
• Automated tax calculation systems.

c) Explicit consent (Art. 22.2.c)

The data subject has given explicit consent to the automated decision. Consent must be:

• specific: for that particular decision;
• informed: it must explain the logic and the consequences;
• freely given: it can be withdrawn;
• unambiguous: given through a clear affirmative action.