Right not to be subject to solely automated decision-making
Despite its title, Article 22 is a general prohibition, not a right to be invoked - it applies regardless of the data subject's actions. It is narrow: it bites only on decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject. Such processing is allowed only if authorised by law, necessary for a contract, or based on explicit consent - and only with suitable safeguards, including human intervention, expressing a view, an explanation, and the right to challenge. Fake human involvement does not escape Article 22.
Article 22(1) is a general prohibition on decisions based solely on automated processing, applying irrespective of whether the data subject invokes it. It is narrow: it applies only where the decision produces legal effects or similarly significantly affects the person.
| Element | Detail |
|---|---|
| Trigger | Decision based SOLELY on automated processing |
| Effect | Produces legal effects OR similarly significantly affects the data subject |
| Gateway 1 | Authorised by EU/member-state law |
| Gateway 2 | Necessary for entering into or performing a contract |
| Gateway 3 | Based on the data subject's explicit consent |
| Always | Suitable safeguards required (human intervention, express view, explanation, challenge) |
WP 251: a controller cannot avoid Article 22 by fabricating human involvement. If someone rubber-stamps an automatically generated profile with no actual influence on the outcome, the decision is still 'based solely on automated processing'.