Automated Decision-Making and Profiling
Article 22 of the GDPR provides individuals with the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects.
What is Automated Decision-Making?
Automated decision-making is the process of making a decision by automated means without human involvement. Examples include:
- Automated credit scoring
- Online aptitude tests for recruitment
- Automated insurance premium calculations
- Algorithmic fraud detection that results in contract termination
What is Profiling?
Article 4(4) defines profiling as any form of automated processing used to evaluate certain personal aspects relating to an individual, particularly to analyze or predict aspects concerning:
- Performance at work
- Economic situation
- Health
- Personal preferences
- Interests
- Reliability
- Behavior
- Location or movements
When is Solely Automated Decision-Making Allowed?
Solely automated decision-making with legal or significant effects is only permitted when:
- Necessary for entering into or performing a contract between the data subject and controller
- Authorized by Union or Member State law with suitable safeguards
- Based on explicit consent from the data subject
Legal or Similarly Significant Effects
A decision produces legal or similarly significant effects when it:
- Affects someone's legal rights (e.g., right to vote, bring legal action)
- Significantly affects someone's circumstances, behavior, or choices
- Has a prolonged or permanent impact
- Leads to exclusion or discrimination
Safeguards and Rights
When automated decision-making is permitted, organizations must implement safeguards including:
- Providing meaningful information about the logic involved
- The significance and envisaged consequences for the data subject
- The right to obtain human intervention
- The right to express their point of view
- The right to contest the decision
- Regular checks to ensure systems are working as intended
Special Category Data
Automated decisions based on special category data are subject to even stricter requirements and should not be made unless explicit consent is obtained or substantial public interest applies, with suitable safeguards in place.