Automated individual decision-making, including profiling

Article 22 of the Applied GDPR provides that individuals have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

It is permitted to uses such methods to make decisions if it:

  1. with the explicit consent of the individual;
  2. is necessary for entering into, or performing a contract between the individual and the controller; or
  3. is authorised by law (which includes suitable safeguards for the rights and freedoms of the individual).

In respect of points 1 and 2 above, the controller must have safeguards in place to protect the rights and freedoms of the individual, to allow them to contest the decision or express their point of view about the decision which should at least include the right to obtain human intervention regarding the decision.

Further in depth information about this right is being generated. In the meantime, you can refer to the UK Information Commissioner's website which includes comprehensive guidance.