Art. 22 GDPR – Automated individual decision-making, including profiling
- The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
- Paragraph 1 shall not apply if the decision:
- is necessary for entering into, or performance of, a contract between the data subject and a data controller;
- is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or
- is based on the data subject’s explicit consent.
- In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.
- Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.
Frequently Asked Questions about Article 22
+ What does the GDPR say about automated decision-making?
Article 22 gives individuals the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on them.
+When is automated decision-making allowed under the GDPR?
It is permitted where necessary for a contract, authorised by law, or based on explicit consent, with safeguards such as the right to human intervention and to contest the decision.
+ Does Article 22 apply to AI and profiling?
Yes. Where AI or profiling makes solely automated decisions with significant effects on a person, Article 22 applies and individuals must be given meaningful safeguards.