Article 22: 1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. 2. Paragraph 1 shall not apply if the decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller; (b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent. 3. In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. Article 35: 1. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data. A single assessment may address a set of similar processing operations that present similar high risks. [...] 3. A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of: (a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;
How this was checked
GDPR on automated decisions and impact assessments
Verified · last checked Settled, with the evidence a claim at this level needs.
Under the GDPR, a data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. That right does not apply where the decision is necessary for entering into or performing a contract between the data subject and the controller, is authorised by Union or member state law that also lays down suitable safeguards, or is based on the data subject's explicit consent; in the contract and consent cases the controller must implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision. Separately, where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons, the controller must carry out a data protection impact assessment before the processing, and one is in particular required for a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the person or similarly significantly affect them.
At a glance
The statement laid out, in its own words. The statement above and its sources are what count.
Decisions based solely on automated processing (Article 22)
- The right not to be subject to such a decision where it produces legal effects or similarly significantly affects the person
- Exceptions: necessary for a contract with the data subject; authorised by Union or member state law with suitable safeguards; based on explicit consent
- In the contract and consent cases, at least the right to human intervention, to express a point of view and to contest the decision
Data protection impact assessment (Article 35)
- Before processing likely to result in a high risk to the rights and freedoms of natural persons
- In particular required for a systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based
Where the book relies on it
- The AI Act at Work: Hiring and Managing People with AI, One sheet per use. About The AI Act at Work: Hiring and Managing People with AI
- The AI Act at Work: Hiring and Managing People with AI, Shifts, tasks and scores. About The AI Act at Work: Hiring and Managing People with AI
- The AI Act at Work: Hiring and Managing People with AI, The oversight log, and the system's own logs. About The AI Act at Work: Hiring and Managing People with AI
- The AI Act at Work: Hiring and Managing People with AI, When someone asks why. About The AI Act at Work: Hiring and Managing People with AI
- The AI Act at Work: Hiring and Managing People with AI, One company, one year. About The AI Act at Work: Hiring and Managing People with AI
- Kind of evidence
- documentarySettled by a first-hand source, quoted below with the day it was read.
The evidence
Every sentence in our books that makes a claim about the world points at a page like this one.