1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
Article 22 GDPR - Automated individual decision-making, including profiling
2. Paragraph 1 shall not apply if the decision:
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;
(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or
(c) is based on the data subject’s explicit consent.
3. In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Paragraph 1 provides the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects him or her. Both elements must be present, so a decision with meaningful human involvement, or one without legal or similarly significant effects, falls outside the provision.
Paragraph 2 admits three cases. The decision may be necessary for entering into or performing a contract between the data subject and the controller, authorised by Union or Member State law which lays down suitable safeguards, or based on the data subject's explicit consent.
Under paragraph 3 it must implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests, comprising at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. The word "at least" indicates a minimum, so further measures may be needed depending on the processing.
Only exceptionally. Paragraph 4 prohibits basing the decisions referred to in paragraph 2 on the special categories in Article 9(1) unless point (a) or (g) of Article 9(2) applies, that is, explicit consent or substantial public interest under Union or Member State law, and suitable measures to safeguard the data subject's rights, freedoms and legitimate interests are in place.
Profiling, defined in Article 4(4) as automated processing to evaluate personal aspects of a natural person, is expressly included, but it is caught by paragraph 1 only where it forms the basis of a solely automated decision with legal or similarly significant effects. Profiling that merely informs a human decision-maker is not prohibited by Article 22, although it remains subject to the general rules of the Regulation, including the right to object under Article 21.