Automated decision-making

Question 1

Prohibition - Normal personal data

Answer 1

1. The data subject has the right not to be subject to a decision based solely on automated processing including profiling which produces legal effects (must be public authority) or similarly significantly affects him/her:
   - Solely? Someone pressing a button to confirm the decision is enough? There must be some kind of human intervention
   - Only valid for individual decision-making
   - Only if there is legal effect or significant effect
2. Unless:
   - Necessary to perform/enter into a contract
   - Authorised by EU or MS law – Must offer safeguards to protect DS rights
   - Explicit consent

Question 2

Prohibition - Sensitive data

Answer 2

Complete prohibition unless:

1. Explicit consent and for specific purposes
2. Processing is necessary in the public interest – Must be in accordance with the law, proportionate and have safeguards

Question 3

What are the rights against automated decision-making?

Answer 3

1. Right to obtain human intervention
2. Right to express your point of view
3. Right to contest the decision
4. Right to explanation:
   - Not in GDPR (only recital 71)
   - Not a legal requirement – The above mentioned rights are the minimum threshold but there can be more
   - Ex post or ex ante? Only the ECJ will tell

Question 4

Policy recommandations

Answer 4

1. Address both personal and non-personal data (not only personal)
2. Clarify the degree of human intervention necessary
3. Regulate more clearly the right to explanation
4. Clarify the link with accountability – Who is responsible?
5. Should there be a broader regulation of automated decision-making?