A loan application rejected within seconds, a job application screened out before anyone has read it, an insurance premium calculated by a statistical model. More and more decisions affecting people's lives are taken, wholly or partly, by automated systems. The GDPR does not ban them outright, but it sets precise limits and gives you tools so that you are not merely the object of a calculation.
Two concepts to tell apart
Profiling
Article 4(4) of Regulation (EU) 2016/679 defines profiling as any form of automated processing that uses personal data to evaluate personal aspects, in particular to analyse or predict work performance, economic situation, health, preferences, interests, reliability, behaviour, location or movements.
Profiling in itself is lawful if it has a legal basis and respects the GDPR's principles. You can always object to profiling for marketing under Article 21.
A decision based solely on automated processing
This is something more specific: a decision taken without meaningful human involvement that produces legal effects concerning you or similarly significantly affects you. This is the case governed by Article 22.
| Situation | Covered by Article 22? |
|---|---|
| Personalised adverts based on interests | As a rule no, except in particularly intrusive cases |
| Online loan application rejected automatically | Yes, if nobody genuinely assesses the file |
| Applications filtered by software that excludes anyone below a threshold | Yes, if the exclusion is automatic |
| Score calculated by a system and then examined by an analyst who can depart from it | No, if the human involvement is real |
Merely token human involvement, where the operator always confirms the system's result, is not enough to take the decision outside Article 22.
The rule and the exceptions
Article 22 states that you have the right not to be subject to a decision based solely on automated processing with those effects. Such a decision is allowed only if it:
- is necessary for entering into or performing a contract between you and the controller;
- is authorised by Union or Member State law, with suitable measures to safeguard your rights;
- is based on your explicit consent.
In cases 1 and 3 the controller must guarantee you at least three safeguards:
- the right to obtain human intervention on the part of the controller;
- the right to express your point of view;
- the right to contest the decision.
Automated decisions based on special categories of data, such as health or ethnic origin, are allowed only under even narrower conditions.
The right to understand
Algorithmic decisions are hard to challenge if you do not know how they were made. Articles 13, 14 and 15 GDPR provide that, where automated decisions are involved, you must receive meaningful information about the logic involved, as well as the significance and envisaged consequences of the processing.
This does not mean getting the algorithm's source code, but an understandable explanation: which factors were considered, how much weight they generally carried, what could have changed the outcome.
The credit score case
The Court of Justice of the European Union, in case C-634/21 (SCHUFA), held that the automated calculation of a creditworthiness score by a specialised company constitutes an automated decision under Article 22 where that score plays a decisive role in a third party's decision, such as a bank's, to enter into a contract or not. This principle matters because it prevents safeguards from being bypassed by separating whoever calculates the score from whoever uses it.
How to respond to an automated decision
- Ask whether the decision was automated. You can do so with an access request under Article 15.
- Ask for information on the logic: which data was used and which factors affected the outcome.
- Check that the data was accurate. Many wrong decisions stem from incorrect data: in that case you can request rectification under Article 16.
- Ask for human intervention and present your point of view, attaching any documents, for example up-to-date proof of income.
- Formally contest the decision and, if you do not receive an adequate reply, lodge a complaint with the data protection authority.
A concrete example
You apply online for financing to buy a household appliance and are refused immediately. Through an access request you discover that the system took into account an old late payment that had in fact been settled. You request rectification of the data and a review by a member of staff, attaching the receipt. A human review based on correct data may lead to a different outcome.
In short
- Profiling evaluates personal aspects; an Article 22 automated decision produces legal or significant effects without real human involvement.
- Solely automated decisions are allowed only by contract, by law or with explicit consent.
- You are entitled to human intervention, to express your view and to contest the decision.
- You can obtain meaningful information about the logic involved.
- Always check the accuracy of the data used: that is often where the error lies.