Article 22

Automated individual decision-making, including profiling

Chapter 3 | Rights of Data Subjects | 📖 4 min read

1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

2. Paragraph 1 shall not apply if the decision:

(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;

(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

(c) is based on the data subject's explicit consent.

3. In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) of Article 9(2) or point (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.

Understanding This Article

Article 22 addresses one of the most important digital age concerns: fully automated decision-making that significantly affects individuals. This provision recognizes that humans should not be subject to decisions made entirely by algorithms without the opportunity for human review and intervention.

Paragraph 1 - Core Protection: Establishes the right not to be subject to decisions based solely on automated processing that produce:

Legal effects: Impact legal rights or status (e.g., contract cancellation, denial of benefits)
Similarly significant effects: Substantially affect the person (e.g., automatic job application rejection, loan denial, insurance price increases, social media bans)

The key word is "solely" - if there's meaningful human involvement, Article 22 doesn't apply (though other GDPR provisions still do).

Paragraph 2 - Three Exceptions: Automated decision-making is permitted when:

(a) Contract necessity: Needed to enter into or perform a contract (e.g., automatic credit approval for instant loans)
(b) Legal authorization: Explicitly authorized by law with safeguards
(c) Explicit consent: Based on explicit consent (note: higher bar than regular consent)

Paragraph 3 - Safeguards Required: For exceptions (a) and (c), controllers must provide:

Right to obtain human intervention
Ability to express one's point of view
Right to contest the decision

Paragraph 4 - Special Category Prohibition: Automated decisions cannot be based on sensitive data (race, health, political opinions, etc.) unless explicit consent or substantial public interest applies, with suitable safeguards.

Key Points

Right not to be subject to solely automated decisions with legal or similarly significant effects
Three exceptions: necessary for contract, authorized by law, or based on explicit consent
Must provide human intervention, allow expression of views, and enable contestation
Cannot use special category data for automated decisions (except with explicit consent or substantial public interest)
Applies to decisions like credit approval, recruitment, insurance pricing, algorithmic content moderation

Practical Application

Example 1 - Permitted with Safeguards (Loan Application):

A bank uses an AI system to instantly approve or deny loans based on credit scores and financial data. This is permitted under exception (a) as necessary for contract performance. However, the bank must:

Allow denied applicants to request human review
Enable them to provide additional context or explanation
Allow contestation of the decision
Provide meaningful information about the logic involved (Article 13/14)

Example 2 - Not Permitted (Job Applications):

An employer uses AI to automatically screen job applications, rejecting 80% without human review. These rejections significantly affect applicants but aren't necessary for contract performance (no contract exists yet). This violates Article 22 unless explicit consent is obtained or law authorizes it - both unlikely scenarios.

Example 3 - Permitted with Explicit Consent (Streaming Recommendations):

A streaming service wants to use automated profiling to decide which content to show users. If this produces significant effects (e.g., filtering out categories entirely), they could obtain explicit consent and provide mechanisms for human review and contestation of content decisions.

Example 4 - Special Category Data Prohibition:

A health insurer cannot use fully automated processing of health data (Article 9(1)) to deny coverage, even with consent, unless substantial public interest grounds exist (Article 9(2)(g)) with appropriate safeguards.

Example 5 - Meaningful Human Involvement (Not Article 22):

A university uses an algorithm to score applications but human admissions officers review all files and make final decisions. This isn't "solely" automated processing, so Article 22 doesn't apply - though transparency obligations (Articles 13-14) and other GDPR principles still do.

Implementation Checklist:

Identify all automated decision-making processes
Assess whether they produce legal or similarly significant effects
Determine if processing is solely automated or involves meaningful human input
If Article 22 applies, identify applicable exception
Implement required safeguards:
- Human intervention mechanism
- Ability to express views
- Contestation procedure
Provide transparency about automated decision-making (Articles 13-14)
Document decisions and safeguards
Train staff on handling human review requests

What is "Meaningful Human Involvement"?

To avoid Article 22, human involvement must be more than rubber-stamping. It requires:

Authority to override the automated decision
Competence to consider all relevant factors
Actual review of the individual case, not just spot checks