GDPR and Automated Decision-Making Quiz

Answers and explanations appear as you take the quiz.

1. Which GDPR article specifically addresses decisions based solely on automated processing?
   • Article 22
   • Article 5
   • Article 17
   • Article 35
2. For Article 22 to apply, the automated decision must generally have what kind of effect?
   • Any effect at all, even trivial ones
   • A legal or similarly significant effect
   • Only effects involving money
   • Only effects on EU government employees
3. Which of the following is a recognized exception that can permit solely automated decisions under Article 22?
   • The company is headquartered outside the EU
   • The data was collected before 2018
   • The decision is based on the individual's explicit consent
   • The decision is made on a weekend
4. For an Article 22(2)(a) contract or (c) explicit-consent exception, which safeguard must the controller provide?
   • No safeguard is required once an exception applies
   • Only a right to erase all processing records
   • A guarantee that the decision will be reversed
   • The person can obtain human intervention, express their point of view, and contest the decision
5. What does a human merely rubber-stamping an algorithm's output mean for Article 22?
   • It does not count as meaningful human involvement, so the decision is still solely automated
   • It removes all GDPR obligations
   • It automatically makes the decision legal
   • It converts the decision into a manual one
6. The CJEU's SCHUFA ruling clarified that under GDPR, generating a credit score can itself:
   • Be exempt from all data rules
   • Constitute automated decision-making triggering Article 22 protections
   • Only matter if the person lives in Germany
   • Be ignored if a bank later uses it
7. What kind of information can a person request about relevant automated decision-making under GDPR Article 15?
   • The source code of every software component in all cases
   • A guarantee that the decision will be reversed
   • Meaningful information about the logic involved, significance, and envisaged consequences
   • The identity of every training-data contributor
8. When did the Court of Justice issue its SCHUFA scoring judgment in case C-634/21?
   • December 7, 2016
   • February 13, 2026
   • October 1, 2026
   • December 7, 2023