Direct answer · GDPR
Automated decisions (Article 22)
A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her (Article 22(1)). The Court of Justice held in SCHUFA that the automated calculation of a credit score by a credit agency is itself such a decision where a bank draws strongly on that score to establish, implement or terminate a contract. Such a decision is only allowed where it is necessary for entering into or performing a contract with the data subject, where it is authorised by Union or Member State law with suitable safeguards, or where it is based on explicit consent (Article 22(2)). In the case of the contract and of consent, the data subject has at least the right to obtain human intervention, to express his or her point of view and to contest the decision (Article 22(3)). Human involvement only takes a decision outside Article 22 if it is meaningful: someone with the authority and competence to change the decision reviews it on the merits. A routine sign-off is not enough (guidelines on automated decision-making, WP251).
For you to establish
- Does a person with real influence decide, or is the outcome adopted as it is?
- On which exception of Article 22(2) does the decision rest?
Articles
- Art. 22(1) GDPR Prohibition of decisions based solely on automated processing with legal effects.
- Art. 22(2)(a) to (c) GDPR Three exceptions: contract, Union or Member State law, explicit consent.
- Art. 22(3) GDPR Human intervention, point of view and contesting the decision.
- Art. 15(1)(h) GDPR Right to meaningful information about the logic involved.
Case law
- SCHUFA (scoring) (CJEU, C-634/21, ECLI:EU:C:2023:957, 2023-12-07)Operative part: calculating a credit score is an automated decision where a third party draws strongly on it.
Guidelines and decisions
- Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679 (Article 29 Working Party, WP251 rev.01, 2018-02-06)Guidelines on automated decision-making and profiling: human involvement must be meaningful.
