What is Automated decision-making (GDPR Art. 22)?
Automated decision-making under GDPR Article 22 refers to decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect a person. Individuals have a right not to be subject to such decisions, subject to limited exceptions with safeguards.
The exceptions in Article 22 include explicit consent, necessity for a contract, or authorisation by law, and each requires suitable safeguards such as the right to obtain human intervention and to contest the decision. Whether a given AI use falls within Article 22 is a legal judgement.
Source: Regulation (EU) 2016/679 (GDPR), EUR-Lex. Last reviewed . General information, not legal advice.