GDPR Article 22: Automated individual decision-making, including profiling
Article 22 of the GDPR Explained
A data subject has the right to not be subject to a decision based solely on automated processing, including profiling, if that decision produces legal effects concerning them or similarly significantly affects them.
Exceptions exist:
- If the decision is necessary for entering into, or the performance of, a contract;
- If it is authorised by EU or Member State law;
- If it is based on the data subject's explicit consent.
Even in these cases, additional safeguards are required (human intervention, possibility to express one's point of view, etc.).
Why This Article Matters for Your GDPR Compliance
Automated processing operations are becoming increasingly frequent (AI, scoring, recommendations). This right protects against unfair or opaque decisions and mandates transparency in algorithmic processes.
Examples of Application of Article 22 of the GDPR
- A bank loan is automatically refused based on an algorithm: the individual must be able to challenge the decision and obtain human review.
- Recruitment relies on an automatic scoring tool: the candidate can request an explanation and present their arguments.
- An insurance company sets its prices via a behavioural profiling tool: the user must be informed and be able to refuse such processing if it is exclusively automated.
Related Resources
Accelerate Your Compliance in a Few Clicks
Thanks to our all-in-one solution, you can accelerate and ensure your compliance easily:
- Automate your compliance with our GDPR software
- Supported or outsourced by our DPO experts
- Raise awareness among your teams with our GDPR training e-learning
Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.
How to comply with Article 22 of the GDPR?