Up nextNext guide
California ADMT Rules for Automated Decision-Making
Society
Society GUIDE
GDPR and Automated Decision-Making
GDPR Article 22 addresses decisions based solely on automated processing, including profiling, when they produce legal effects or similarly significantly affect a person.
Listen to this guideAI-narrated · ~2 min
On this page2 min read
Overview
It includes specific exceptions and safeguards; application depends on the facts and applicable law.
Deep Dive
Article 22(1) gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. Article 22(2) lists exceptions for necessity in a contract, authorization by Union or Member State law, or explicit consent. Article 22(3) specifies safeguards, including human intervention, an opportunity to express a point of view and to contest the decision, for the exceptions in Article 22(2)(a) and (c). In SCHUFA (C-634/21), the Court held that automated establishment of a credit score can itself fall within Article 22 where a third party gives the score a determining role in a decision.
Real-World Implementation
Hypothetical scenario: assess whether a fully automated credit decision has legal or similarly significant effects on a person.
Hypothetical scenario: document whether a contract or explicit-consent exception is being relied on and which safeguards apply.
A person may request relevant meaningful information under Article 15 in the circumstances described by the regulation.
When analyzing a credit score, consider the CJEU’s SCHUFA judgment and whether a third party gives the score a determining role in a decision.
The Future of GDPR and Automated Decision-Making
Interpretation of automated decision-making continues through EU and national law. For each use case, document the processing chain, human role, effect on the person, applicable exception and required safeguards, then check current regulatory guidance and case law.
Putting it into practice
Why it matters
- Risk and safety. Catastrophic and everyday AI harms both depend on who understands the risks and who can act.
- Clearer decisions. Public and professional literacy shapes whether strong safety policy is politically possible.
- Cutting through hype. Clear explanations reduce capture by hype, lab PR, and vague ethics theater.
Watch out for
- Treating existential risk as sci-fi while capability compounds.
- Confusing surface product safety with alignment under high autonomy.
- Leaving non-English and non-expert audiences with only low-quality sources.
Next steps
- Separate product harms, misuse, and loss-of-control / misalignment risks.
- Ask what evidence would change your view on timelines and severity.
- Prefer primary sources and concrete evals over marketing claims.
- Identify one action path: career, policy, funding, or skills — not only awareness.
Keep Exploring
Free newsletter
Keep up with AI in 3 minutes a day
One short email each weekday with the three AI stories that actually matter. Free forever, no ads.
One email each weekday. Unsubscribe in one click. We never sell or share your address.
Test yourself
Take the GDPR and Automated Decision-Making quiz
Instant feedback on every answer, and a shareable certificate with a verifiable ID once you pass a course.
Support free AI education. AI Understanding is a 501(c)(3) nonprofit — no ads, no paywall, ever. Make a donation
Frequently asked questions
What is GDPR and Automated Decision-Making?
GDPR Article 22 addresses decisions based solely on automated processing, including profiling, when they produce legal effects or similarly significantly affect a person. It includes specific exceptions and safeguards; application depends on the facts and applicable law.
Which GDPR article specifically addresses decisions based solely on automated processing?
Article 22 grants individuals the right not to be subject to decisions based solely on automated processing that have legal or similarly significant effects.
For Article 22 to apply, the automated decision must generally have what kind of effect?
The protection triggers when a decision produces legal effects or similarly significantly affects the person, such as a loan denial or job rejection.
For an Article 22(2)(a) contract or (c) explicit-consent exception, which safeguard must the controller provide?
Article 22(3) requires safeguards, at minimum human intervention, an opportunity to express the person’s point of view, and to contest the decision, for the exceptions in Article 22(2)(a) and (c). The provision does not state this same rule for the law-authorization exception in (b).
What does a human merely rubber-stamping an algorithm's output mean for Article 22?
Meaningful human involvement requires genuine review and authority to override; a token sign-off keeps the decision within Article 22's scope.
What kind of information can a person request about relevant automated decision-making under GDPR Article 15?
Article 15(1)(h) provides access to meaningful information about the logic involved and the significance and envisaged consequences in relevant automated-decision cases.
Keep learning
Related guides
More guides picked for this topic