概述
It includes specific exceptions and safeguards; application depends on the facts and applicable law.
深入探讨
Article 22(1) gives a data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them. Article 22(2) lists exceptions for necessity in a contract, authorization by Union or Member State law, or explicit consent. Article 22(3) specifies safeguards, including human intervention, an opportunity to express a point of view and to contest the decision, for the exceptions in Article 22(2)(a) and (c). In SCHUFA (C-634/21), the Court held that automated establishment of a credit score can itself fall within Article 22 where a third party gives the score a determining role in a decision.
现实世界的实施
Hypothetical scenario: assess whether a fully automated credit decision has legal or similarly significant effects on a person.
Hypothetical scenario: document whether a contract or explicit-consent exception is being relied on and which safeguards apply.
A person may request relevant meaningful information under Article 15 in the circumstances described by the regulation.
When analyzing a credit score, consider the CJEU’s SCHUFA judgment and whether a third party gives the score a determining role in a decision.
GDPR 和自动化决策的未来
Interpretation of automated decision-making continues through EU and national law. For each use case, document the processing chain, human role, effect on the person, applicable exception and required safeguards, then check current regulatory guidance and case law.
付诸实践
为什么这很重要
- 风险与安全. 灾难性和日常的人工智能危害都取决于谁了解风险以及谁能够采取行动。
- 更清晰的判决. 公众和专业素养决定强有力的安全政策在政治上是否可行。
- 打破炒作. 清晰的解释可以减少炒作、实验室公关和模糊道德剧场的影响。
留意
- 将存在风险视为科幻小说，同时能力复合。
- 混淆了表面产品安全与高度自治下的对准。
- 只给非英语和非专业观众留下低质量的资源。
后续步骤
- 单独的产品危害、误用和失控/失调风险。
- 询问哪些证据会改变您对时间表和严重性的看法。
- 比起营销主张，更喜欢主要来源和具体评估。
- 确定一条行动路径：职业、政策、资金或技能——而不仅仅是意识。
不断探索
常见问题
什么是GDPR和自动决策？
GDPR Article 22 addresses decisions based solely on automated processing, including profiling, when they produce legal effects or similarly significantly affect a person. It includes specific exceptions and safeguards; application depends on the facts and applicable law.
哪一篇 GDPR 文章专门讨论了仅基于自动化处理的决策？
第 22 条赋予个人不接受仅基于自动化处理且具有法律或类似重大影响的决策的权利。
要适用第22条，自动决定一般必须具有什么样的效果？
当决定产生法律效力或类似地对个人产生重大影响（例如贷款被拒绝或工作被拒绝）时，就会触发保护。
For an Article 22(2)(a) contract or (c) explicit-consent exception, which safeguard must the controller provide?
Article 22(3) requires safeguards, at minimum human intervention, an opportunity to express the person’s point of view, and to contest the decision, for the exceptions in Article 22(2)(a) and (c). The provision does not state this same rule for the law-authorization exception in (b).
对于第 22 条，人类仅仅在算法的输出上盖上橡皮图章意味着什么？
有意义的人类参与需要真正的审查和推翻的权力；象征性签署使决定保持在第 22 条的范围内。
What kind of information can a person request about relevant automated decision-making under GDPR Article 15?
Article 15(1)(h) provides access to meaningful information about the logic involved and the significance and envisaged consequences in relevant automated-decision cases.