Automated Decision-Making

Legal Framework

The primary provision governing automated decision-making is Article 22 GDPR, which grants data subjects the right not to be subject to decisions based solely on automated processing — including profiling — that produce legal effects or similarly significant effects. The provision functions as a prohibition with exceptions: solely automated decisions are impermissible unless one of three lawful bases applies (contract necessity, authorisation by Union or Member State law with safeguards, or explicit consent). Where the contract or consent exception is invoked, Article 22(3) mandates at minimum the right to obtain human intervention, to express one's point of view, and to contest the decision.

Transparency obligations reinforce this framework. Article 13(2)(f) and Article 14(2)(g) require controllers to inform data subjects about the existence of automated decision-making and provide meaningful information about the logic involved. Article 15(1)(h) mirrors this as an access right.

"The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her."
— GDPR Art. 22(1)

Key Developments

The CJEU in OQ v Land Hessen confirmed that Article 22 imposes enhanced requirements on the lawfulness of automated decisions, reflecting the specific risks automated processing poses to individual rights:

"the purpose pursued by Article 22 of the GDPR, consisting of protecting individuals against the particular risks to their rights and freedoms represented by the automated processing of personal data, including profiling."
— OQ v Land Hessen ¶57

In CK v Magistrat der Stadt Wien, the CJEU addressed the scope of the access right under Article 15(1)(h). The court held that data subjects may demand that controllers explain the procedure and principles actually applied in automated processing — but not necessarily an exhaustive disclosure of the algorithm. The controller must provide:

"to explain, by means of relevant information and in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied"
— CK v Magistrat der Stadt Wien ¶66

Enforcement actions confirm that profiling for marketing without a valid Article 22 basis triggers sanctions. The Spanish DPA fined Caixabank for relying on legitimate interests (Article 6(1)(f)) where profiling required explicit consent under Article 22(2)(c). The Italian DPA fined BBVA Italy €5.5 million for ignoring in-app objection mechanisms, violating Articles 5, 12, and 21.

Status of the Debate

This topic is actively contested in court. The central doctrinal question is whether Article 22(1) establishes a general prohibition on solely automated decisions (with narrow exceptions) or merely a right for data subjects to object. The EDPB and EDPS have advocated the prohibition reading.

The CJEU in OQ v Land Hessen appeared to endorse the prohibition interpretation, but the General Court in Philippe Latombe treated Article 22 as a right without resolving the structural question. No definitive court split is on record, but the interpretive tension remains unresolved. A future CJEU reference directly asking whether Article 22 is a prohibition or a right would settle the debate.

Practical Guidance

• Map each automated decision against the Article 22(1) threshold: confirm whether it is solely automated and whether it produces legal or similarly significant effects. If both elements are met, identify which paragraph 2 exception applies.
• Where relying on contract necessity or explicit consent, implement the Article 22(3) safeguards operationally — a documented human review channel, a mechanism for the data subject to express a view, and a contestation procedure with defined turnaround times.
• Fulfil transparency obligations at collection under Articles 13(2)(f) and 14(2)(g): describe the existence of automated decision-making, the logic involved in meaningful terms, and the envisaged consequences.
• Respond to access requests by providing the procedure and principles actually applied, as required by Article 15(1)(h) and clarified by CK v Magistrat der Stadt Wien — concise, intelligible explanations suffice; exhaustive algorithmic disclosure is not mandated.
• Do not use special categories of data under Article 9(1) as input to automated decisions unless an Article 9(2)(a) or (g) exemption applies and suitable safeguards are in place, per Article 22(4).