Proposal: reformulation of automated individual decision-making (Article 22 GDPR)

What it is about

Article 22 would no longer be framed as a right not to be subject to an automated decision. It becomes an exhaustive list of cases where such a decision is allowed: where necessary for entering into or performing a contract (regardless of whether the decision could be taken otherwise than by solely automated means), where authorised by Union or Member State law with suitable safeguards, or where based on explicit consent. Recital 38 says the fact that a human could take the decision does not prevent solely automated processing, but where several equally effective solutions exist the least intrusive must be used. The EDPB and EDPS (Joint Opinion 2/2026, paras 65 to 72) want to keep the wording of a prohibition in principle, as the CJEU held in SCHUFA (C-634/21). They support the clarification on contracts but want the phrase 'regardless of whether the decision could be taken otherwise' kept only in the recital, not in the enacting terms. The European Parliament is building its position through a joint ITRE and LIBE draft report of 22 June 2026; no committee vote has taken place.

What this means in practice

If the Commission text survives, you could more easily justify fully automated decisions in a contractual context, even where a human could have taken the decision. The Article 22(3) safeguards (human intervention, expressing a view, contesting) remain. The supervisory authorities also accept that the mere possibility of a human decision is no obstacle. They do insist that you choose the least intrusive equally effective means and that the prohibition stays the starting point. The proposal is still under negotiation, so do not adjust your decision-making to it yet.

The GDPR articles concerned

• Article 22: Automated individual decision-making, including profiling