GDPR: a right not to be subject to a solely automated decision
On 27 April 2016 the European Parliament and the Council signed the General Data Protection Regulation (GDPR), applicable from 25 May 2018. Article 22 gives a person the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
Why it matters
A norm directly applicable in every EU state and backed by turnover-based fines set a limit on decisions taken by an algorithm without a person, and gave people a right to know the logic of such a decision. Five years later the AI Act proposal was built as a complement to this regulation, not a replacement.
Article 22(2) lifts the prohibition where the decision is necessary for a contract, authorised by Union or Member State law with suitable safeguards, or based on explicit consent - any one of the three. For contract and consent Article 22(3) requires at least the right to obtain human intervention, to express one's point of view and to contest the decision; Article 22(4) bars such decisions on special categories of data save two exceptions in Article 9(2). Article 15(1)(h) gives a right to know of automated decision-making and to meaningful information about the logic involved, its significance and envisaged consequences; the same line stands in Articles 13 and 14. Recital 71 gives the automatic refusal of an online credit application and e-recruiting without human intervention as examples. For the rights in Articles 12 to 22 Article 83(5) provides fines up to 20 million euros or up to 4% of total worldwide annual turnover, whichever is higher. The record does not claim that the regulation grants a 'right to explanation' of an individual decision: the articles contain no such phrase.