GDPR Art. 22 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Automated individual decision-making, including profiling

Profiling Marketing Automated Decision-Making
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679
  1. 1.

    The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

    Automated Decision-Making Marketing Profiling 149
  2. 2.

    Paragraph 1 shall not apply if the decision:

    33
    1. a)
      is necessary for entering into, or performance of, a contract between the data subject and a data controller;
      Controllers Personal Data Processing
    2. b)
      is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
      Legitimate Interest Lawful Basis Controllers
    3. c)
      is based on the data subject's explicit consent.
      Consent Personal Data
  3. 3.

    In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

    Legitimate Interest Controllers Lawful Basis 52
  4. 4.

    Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.

    Legitimate Interest Lawful Basis Types of Special Categories of Personal Data 13

Enforcement

Cited in 26 fines totalling €1.7B

Top authority: 🇪🇺Italian Data Protection Authority (Garante) (7) · median fine €100,000 · see all enforcement for Art. 22 →

Connections by provision

22(1) 78 Case Law 29 Enforcement 37 Guidance 5 Literature .md
Case Law 78
Court of Justice of the European Union - Case C-422/24 - AB Storstockholms Lokaltrafik. High Court examines DPA inquiry into Meta's refusal of raw data access and portability Österreichische Datenschutzbehörde v CRIF RW v Österreichische Post AG Philippe Latombe v European Commission WhatsApp Ireland Ltd v European Data Protection Board Tribunal of Bologna orders Comet s.p.a. to fulfil data subject's Art. 15 GDPR access Austrian FAC: DPA rightly found loyalty program consent for profiling invalid under GDPR +70 more
Enforcement 29
Website providing legal information: Insufficient fulfilment of information obligations AEPD: CaixaBank requested excessive inheritance documentation from heirs AEPD fines MÁS SOL ENERGÍA for marketing call to Robinson List subscriber Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on Datatilsynet reprimands Danish Tax Administration for access request delays (2019-2024) NAIH (Hungary) - NAIH-11443-3/2026 NAIH (Hungary) - NAIH-450-7-2026 NAIH (Hungary) - NAIH-4462-5-2026 +21 more
Guidance 37
EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT One-Stop-Shop case digest on right of access EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) Guidelines 3/2025 on the interplay between the DSA and the GDPR Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT +29 more
Literature 5
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation HOW GDPR TREATS AUTOMATED DECISION-MAKING CJEU: The Rating of a Natural Person’s Creditworthiness by a Credit Rating Agency Constitutes Profiling and Can Be an Automated Decision under Article 22 GDPR The data subject’s right to access to information under GDPR and the right of the data controller to protect its know-how General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?
22(2) 5 Case Law 3 Enforcement 25 Guidance .md
Case Law 5
OQ v Land Hessen ¶62 OQ v Land Hessen ¶54 OQ v Land Hessen ¶53 OQ v Land Hessen ¶64 OQ v Land Hessen
Enforcement 3
Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on ¶30 Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on ¶92 Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on
Guidance 25
EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB Annual Report 2022 Contribution of the EDPB to the evaluation of the GDPR under Article 97 Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines 3/2025 on the interplay between the DSA and the GDPR EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR EDPB contribution to the EBA public consultation on draft regulatory technical standards on AML/CFT +17 more
22(2)(a) 5 Guidance 2 Literature .md
Guidance 5
EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision Study on the secondary use of personal data in the context of scientific research ¶64 Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision ¶64 EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework (
Literature 2
HOW GDPR TREATS AUTOMATED DECISION-MAKING If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
22(2)(b) 8 Case Law 5 Guidance 1 Literature .md
Case Law 8
OQ v Land Hessen ¶71 OQ v Land Hessen ¶70 OQ v Land Hessen ¶68 OQ v Land Hessen ¶65 OQ v Land Hessen ¶25 OQ v Land Hessen ¶20 OQ v Land Hessen ¶72 OQ v Land Hessen
Guidance 5
Study on the secondary use of personal data in the context of scientific research Guidelines 3/2025 on the interplay between the DSA and the GDPR ¶42 Guidelines 3/2025 on the interplay between the DSA and the GDPR ¶44 Guidelines 3/2025 on the interplay between the DSA and the GDPR ¶31 Guidelines 3/2025 on the interplay between the DSA and the GDPR
Literature 1
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
22(2)(c) 5 Guidance 2 Literature .md
Guidance 5
Guidelines 05/2020 on consent under Regulation 2016/679 Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 ¶55 Guidelines 05/2020 on consent under Regulation 2016/679 ¶37 Guidelines 05/2020 on consent under Regulation 2016/679 ¶13 Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679
Literature 2
HOW GDPR TREATS AUTOMATED DECISION-MAKING If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation
22(3) 10 Case Law 20 Enforcement 18 Guidance 3 Literature 1 News .md
Case Law 10
BVwG - W254 2253353-1 CK v Magistrat der Stadt Wien OQ v Land Hessen ¶33 CK v Magistrat der Stadt Wien ¶84 BVwG - W254 2253353-1 ¶64 OQ v Land Hessen ¶32 CK v Magistrat der Stadt Wien ¶85 BVwG - W254 2253353-1 +2 more
Enforcement 20
Foodinho s.r.l.: Non-compliance with general data processing principles Italian DPA sanctions Experian Italia for incomplete Art. 15 GDPR access responses on Garante per la protezione dei dati personali (Italy) - 483/2026 Foodinho Srl: Non-compliance with general data processing principles Italian DPA finds Cerved Group failed to disclose creditworthiness scores in Art. 15 Deutsche Kreditbank: Insufficient fulfilment of data subjects rights HDPA (Greece) - 12/2026 Deliveroo Italy s.r.l.: Non-compliance with general data processing principles +12 more
Guidance 18
EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( Guidelines 3/2025 on the interplay between the DSA and the GDPR Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) Guidelines 03/2021 on the application of Article 65(1)(a) GDPR ¶88 EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 +10 more
Literature 3
If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens? HOW GDPR TREATS AUTOMATED DECISION-MAKING
News 1
GDPR complaint: Airbnb hosts at the mercy of algorithms
22(4) 3 Case Law 8 Guidance 2 Literature .md
Case Law 3
OQ v Land Hessen ¶68 OQ v Land Hessen ¶55 OQ v Land Hessen
Guidance 8
Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR Guidelines 3/2025 on the interplay between the DSA and the GDPR ¶33 Guidelines 3/2025 on the interplay between the DSA and the GDPR ¶65 Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR ¶62 Guidelines 3/2025 on the interplay between the DSA and the GDPR ¶61 Guidelines 3/2025 on the interplay between the DSA and the GDPR ¶60 Guidelines 3/2025 on the interplay between the DSA and the GDPR ¶42 Guidelines 3/2025 on the interplay between the DSA and the GDPR
Literature 2
‘Leading by Science’ through Covid-19: the GDPR Automated Decision-Making General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?

Related across sources

C-203/22 CK v Magistrat der Stadt Wien In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien… CJEU ·First Chamber Feb 27, 2025 Profiling Automated Decision-Making Marketing
W256 2227693-1 Austrian FAC: DPA rightly found loyalty program consent for profiling invalid under GDPR On 05.09.2019, the Austrian DPA (DSB) notified the controller of a customer loyalty program that they were initiating an ex officio investigation. The controller responded by… Federal Administrative Court Sep 28, 2023 Marketing Profiling Automated Decision-Making
C-634/21 OQ v Land Hessen In Case C-634/21, the CJEU addressed a preliminary ruling from the Verwaltungsgericht Wiesbaden concerning OQ's challenge against Land Hessen's refusal to order SCHUFA Holding AG… CJEU ·First Chamber Dec 7, 2023 Profiling Automated Decision-Making Marketing
HvJ EU 9 januari 2025, C‑394/23 (Mousse) Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20… HvJ EU 9 januari 2025, C‑394/23 (Mousse). ·CJEU Jan 9, 2025 IP Address Retention Period Identification
W254 2253353-1 On 7 April 2021, the data subject requested access to their data under Article 15 GDPR The controller replied on 12 April 2021 and provided further information on 27 May 2021 after the data subject made a further enquiry. As the controller's privacy policy listed… BVwG - W254 2253353-1 ·Federal Administrative Court Nov 17, 2025 Profiling Automated Decision-Making Marketing
C-422/24 Case C-422/24 - AB Storstockholms Lokaltrafik. A new page has been created with the following information: "" CJEU Jan 7, 2026 Personal Data Fairness & Transparency Controllers