# Automated Decision-Making — legal context bundle > Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/automated-decision-making > Sources are cited per item. Verify against the official texts before relying on them. Processing involving automated decisions without human involvement ## Overview ## Legal Framework The primary provision governing automated decision-making is [Article 22 GDPR](/laws/gdpr/art-22), which grants data subjects the right not to be subject to decisions based solely on automated processing — including profiling — that produce legal effects or similarly significant effects. The provision functions as a prohibition with exceptions: solely automated decisions are impermissible unless one of three lawful bases applies (contract necessity, authorisation by Union or Member State law with safeguards, or explicit consent). Where the contract or consent exception is invoked, Article 22(3) mandates at minimum the right to obtain human intervention, to express one's point of view, and to contest the decision. Transparency obligations reinforce this framework. [Article 13(2)(f)](/laws/gdpr/art-13#par-2-pnt-f) and [Article 14(2)(g)](/laws/gdpr/art-14#par-2-pnt-g) require controllers to inform data subjects about the existence of automated decision-making and provide meaningful information about the logic involved. [Article 15(1)(h)](/laws/gdpr/art-15#par-1-pnt-h) mirrors this as an access right. > "The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." > — [GDPR Art. 22(1)](/laws/gdpr/art-22#par-1) ## Key Developments The CJEU in *OQ v Land Hessen* confirmed that Article 22 imposes enhanced requirements on the lawfulness of automated decisions, reflecting the specific risks automated processing poses to individual rights: > "the purpose pursued by Article 22 of the GDPR, consisting of protecting individuals against the particular risks to their rights and freedoms represented by the automated processing of personal data, including profiling." > — [OQ v Land Hessen ¶57](/posts/132279#seg-57) In *CK v Magistrat der Stadt Wien*, the CJEU addressed the scope of the access right under Article 15(1)(h). The court held that data subjects may demand that controllers explain the procedure and principles actually applied in automated processing — but not necessarily an exhaustive disclosure of the algorithm. The controller must provide: > "to explain, by means of relevant information and in a concise, transparent, intelligible and easily accessible form, the procedure and principles actually applied" > — [CK v Magistrat der Stadt Wien ¶66](/posts/132146#seg-66) Enforcement actions confirm that profiling for marketing without a valid Article 22 basis triggers sanctions. The Spanish DPA fined Caixabank for relying on legitimate interests (Article 6(1)(f)) where profiling required explicit consent under Article 22(2)(c). The Italian DPA fined BBVA Italy €5.5 million for ignoring in-app objection mechanisms, violating Articles 5, 12, and 21. ## Status of the Debate This topic is actively contested in court. The central doctrinal question is whether Article 22(1) establishes a general prohibition on solely automated decisions (with narrow exceptions) or merely a right for data subjects to object. The EDPB and EDPS have advocated the prohibition reading. The CJEU in *OQ v Land Hessen* appeared to endorse the prohibition interpretation, but the General Court in *Philippe Latombe* treated Article 22 as a right without resolving the structural question. No definitive court split is on record, but the interpretive tension remains unresolved. A future CJEU reference directly asking whether Article 22 is a prohibition or a right would settle the debate. ## Practical Guidance - **Map each automated decision** against the Article 22(1) threshold: confirm whether it is solely automated and whether it produces legal or similarly significant effects. If both elements are met, identify which paragraph 2 exception applies. - **Where relying on contract necessity or explicit consent**, implement the Article 22(3) safeguards operationally — a documented human review channel, a mechanism for the data subject to express a view, and a contestation procedure with defined turnaround times. - **Fulfil transparency obligations at collection** under Articles 13(2)(f) and 14(2)(g): describe the existence of automated decision-making, the logic involved in meaningful terms, and the envisaged consequences. - **Respond to access requests** by providing the procedure and principles actually applied, as required by Article 15(1)(h) and clarified by *CK v Magistrat der Stadt Wien* — concise, intelligible explanations suffice; exhaustive algorithmic disclosure is not mandated. - **Do not use special categories of data** under Article 9(1) as input to automated decisions unless an Article 9(2)(a) or (g) exemption applies and suitable safeguards are in place, per Article 22(4). ## Legislation (full text of key provisions) ### Automated individual decision-making, including profiling *Source: GDPR, gdpr-art-22-en, 2016-04-27 — https://overview.legal/posts/90485* ### Recommender systems *Source: DSA, dsa-art-38-en, 2022-10-19 — https://overview.legal/posts/94670* In addition to the requirements set out in Article 27, providers of very large online platforms and of very large online search engines that use recommender systems shall provide at least one option for each of their recommender systems which is not based on profiling as defined in Article 4, point (4), of Regulation (EU) 2016/679. ### Recital 71 — automated decision making and profiling rights *Source: GDPR, gdpr-rec-71-en, 2016-04-27 — https://overview.legal/posts/91657* The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her, such as automatic refusal of an online credit application or e-recruiting practices without any human intervention. Such processing includes ‘profiling’ that consists of any form of automated processing of personal data evaluating the personal aspects relating to a natural person, in particular to analyse or predict aspects concerning the data subject's performance at work, economic situation, health, personal preferences or interests, reliability or behaviour, location or movements, where it produces legal effects concerning him or her or similarly significantly affects him or her. However, decision-making based on such processing, including profiling, should be allowed where expressly authorised by Union or Member State law to which the controller is subject, including for fraud and tax-evasion monitoring and prevention purposes conducted in accordance with the regulations, standards and recommendations of Union institutions or national oversight bodies and to ensure the security and reliability of a service provided by the controller, or necessary for the entering or performance of a contract between the data subject and a controller, or when the data subject has given his or her explicit consent. In any case, such processing should be subject to suitable safeguards, which should include specific information to the data subject and the right to obtain human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision. Such measure should not concern a child. In order to ensure fair and transparent processing in respect of the data subject, taking into account the specific circumstances and context in which the personal data are processed, the controller should use appropriate mathematical or statistical procedures for the profiling, implement technical and organisational measures appropriate to ensure, in particular, that factors which result in inaccuracies in personal data are corrected and the risk of errors is minimised, secure personal data in a manner that takes account of the potential risks involved for the interests and rights of the data subject and that prevents, inter alia, discriminatory effects on natural persons on the basis of racial or ethnic origin, political opinion, religion or beliefs, trade union membership, genetic or health status or sexual orientation, or that result in measures having such an effect. Automated decision-making and profiling based on special categories of personal data should be allowed only under specific conditions. ### Recital 72 — profiling subject to regulation rules *Source: GDPR, gdpr-rec-72-en, 2016-04-27 — https://overview.legal/posts/91659* Profiling is subject to the rules of this Regulation governing the processing of personal data, such as the legal grounds for processing or data protection principles. The European Data Protection Board established by this Regulation (the ‘Board’) should be able to issue guidance in that context. ### Recital 30 — online identifiers enabling personal profiling *Source: GDPR, gdpr-rec-30-en, 2016-04-27 — https://overview.legal/posts/91575* Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. ### Recital 91 — high risk processing requiring impact assessment *Source: GDPR, gdpr-rec-91-en, 2016-04-27 — https://overview.legal/posts/91697* This should in particular apply to large-scale processing operations which aim to process a considerable amount of personal data at regional, national or supranational level and which could affect a large number of data subjects and which are likely to result in a high risk, for example, on account of their sensitivity, where in accordance with the achieved state of technological knowledge a new technology is used on a large scale as well as to other processing operations which result in a high risk to the rights and freedoms of data subjects, in particular where those operations render it more difficult for data subjects to exercise their rights. A data protection impact assessment should also be made where personal data are processed for taking decisions regarding specific natural persons following any systematic and extensive evaluation of personal aspects relating to natural persons based on profiling those data or following the processing of special categories of personal data, biometric data, or data on criminal convictions and offences or related security measures. A data protection impact assessment is equally required for monitoring publicly accessible areas on a large scale, especially when using optic-electronic devices or for any other operations where the competent supervisory authority considers that the processing is likely to result in a high risk to the rights and freedoms of data subjects, in particular because they prevent data subjects from exercising a right or using a service or a contract, or because they are carried out systematically on a large scale. The processing of personal data should not be considered to be on a large scale if the processing concerns personal data from patients or clients by an individual physician, other health care professional or lawyer. In such cases, a data protection impact assessment should not be mandatory. ### Recital 60 — fair transparent processing information to data subjects *Source: GDPR, gdpr-rec-60-en, 2016-04-27 — https://overview.legal/posts/91635* The principles of fair and transparent processing require that the data subject be informed of the existence of the processing operation and its purposes. The controller should provide the data subject with any further information necessary to ensure fair and transparent processing taking into account the specific circumstances and context in which the personal data are processed. Furthermore, the data subject should be informed of the existence of profiling and the consequences of such profiling. Where the personal data are collected from the data subject, the data subject should also be informed whether he or she is obliged to provide the personal data and of the consequences, where he or she does not provide such data. That information may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner, a meaningful overview of the intended processing. Where the icons are presented electronically, they should be machine-readable. ### Recital 42 — prohibition of AI-predicted criminal behaviour risk assessment *Source: AI Act, aiact-rec-42-en, 2024-06-12 — https://overview.legal/posts/93766* In line with the presumption of innocence, natural persons in the Union should always be judged on their actual behaviour. Natural persons should never be judged on AI-predicted behaviour based solely on their profiling, personality traits or characteristics, such as nationality, place of birth, place of residence, number of children, level of debt or type of car, without a reasonable suspicion of that person being involved in a criminal activity based on objective verifiable facts and without human assessment thereof. Therefore, risk assessments carried out with regard to natural persons in order to assess the likelihood of their offending or to predict the occurrence of an actual or potential criminal offence based solely on profiling them or on assessing their personality traits and characteristics should be prohibited. In any case, that prohibition does not refer to or touch upon risk analytics that are not based on the profiling of individuals or on the personality traits and characteristics of individuals, such as AI systems using risk analytics to assess the likelihood of financial fraud by undertakings on the basis of suspicious transactions or risk analytic tools to predict the likelihood of the localisation of narcotics or illicit goods by customs authorities, for example on the basis of known trafficking routes. ### Recital 24 — extraterritorial processing behaviour monitoring *Source: GDPR, gdpr-rec-24-en, 2016-04-27 — https://overview.legal/posts/91563* The processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union should also be subject to this Regulation when it is related to the monitoring of the behaviour of such data subjects in so far as their behaviour takes place within the Union. In order to determine whether a processing activity can be considered to monitor the behaviour of data subjects, it should be ascertained whether natural persons are tracked on the internet including potential subsequent use of personal data processing techniques which consist of profiling a natural person, particularly in order to take decisions concerning her or him or for analysing or predicting her or his personal preferences, behaviours and attitudes. ### Recital 10 — personal data protection safeguarding *Source: AI Act, aiact-rec-10-en, 2024-06-12 — https://overview.legal/posts/93702* The fundamental right to the protection of personal data is safeguarded in particular by Regulations (EU) 2016/679 (11) and (EU) 2018/1725 (12) of the European Parliament and of the Council and Directive (EU) 2016/680 of the European Parliament and of the Council (13). Directive 2002/58/EC of the European Parliament and of the Council (14) additionally protects private life and the confidentiality of communications, including by way of providing conditions for any storing of personal and non-personal data in, and access from, terminal equipment. Those Union legal acts provide the basis for sustainable and responsible data processing, including where data sets include a mix of personal and non-personal data. This Regulation does not seek to affect the application of existing Union law governing the processing of personal data, including the tasks and powers of the independent supervisory authorities competent to monitor compliance with those instruments. It also does not affect the obligations of providers and deployers of AI systems in their role as data controllers or processors stemming from Union or national law on the protection of personal data in so far as the design, the development or the use of AI systems involves the processing of personal data. It is also appropriate to clarify that data subjects continue to enjoy all the rights and guarantees awarded to them by such Union law, including the rights related to solely automated individual decision-making, including profiling. Harmonised rules for the placing on the market, the putting into service and the use of AI systems established under this Regulation should facilitate the effective implementation and enable the exercise of the data subjects’ rights and other remedies guaranteed under Union law on the protection of personal data and of other fundamental rights. ## Case law ### Austrian FAC: DPA rightly found loyalty program consent for profiling invalid under GDPR *Source: Federal Administrative Court, 2023-09-28 — https://overview.legal/posts/125664 — original: https://gdprhub.eu/index.php?title=BVwG_-_W256_2227693-1* Facts — On 05.09.2019, the Austrian DPA (DSB) notified the controller of a customer loyalty program that they were initiating an ex officio investigation. The controller responded by answering the provided questionnaire and submitting further documents. On 23.10.2019, the DPA ruled that the investigation was justified and that the declaration of consent for profiling using certain registration methods (website, app, partner company store, flyer) did not comply with the requirements of Article 4(11) GDPR and Article 7 GDPR, nor were they provided in an intelligible way. If a contract covers several aspects, the declaration of consent must be clearly distinguishable. Regarding the website and flyer, the following was found: The website says 'Enjoy your personal benefits' without providing clear information that 'personal benefits' involves profiling. In an embedded box, the relevant points were merely referred to. Information regarding profiling was only accessible by scrolling down further. Concerning the flyer, the following information was provided under the signature field: 'This signature only applies to the declaration of consent and is voluntary. Your registration [...] is also valid without a signature.' Thus, it conveyed the impression that a signature was required to confirm the registration. Consequently, the controller was required to amend the declaration and to cease using any obtained consents for the purpose of profiling prior to 01.05.2020. The controller lodged a complaint. In addition to other information, the controller stated that the data processing was in accordance with Article 6(1)(a) GDPR, and that they had a legitimate interest under Article 6(1)(f) GDPR. The DPA ruled a preliminary decision on the complaint, thereby changing the ruling that the website and flyer did not meet the requirements under Article 6(1)(a) GDPR, and thus, the processing of personal data, collected in that cases, was forbidden. The other methods ensured that the consent was clearly separated from the rest of the registration process. The controller then filed a request for referral to the court, arguing that the DPA had exceeded their corrective powers by prohibiting the processing of the data. Furthermore, the data processing for profiling would be used to manage customer memberships under Article 6(1)(b) GDPR. Following their view, processing under Article 6(4) GDPR was applicable. Additionally, the controller denied the DPA's view that a violation of the principle of good faith would foreclose a weighing of interests under Article 6(1)(f) GDPR. The court quashed the preliminary decision as the DPA had not examined the other grounds of justification for data processing under Article 6(1) GDPR in their initial decision. The DPA then lodged an appeal to the Austrian Supreme Administrative Court (Verwaltungsgerichtshof), which overturned the court's ruling (VwGH 08.02.2022, Ro 2021/04/0033). It was the court's responsibility to examine the potential legal bases, rather than overturning the DPA's decision. Therefore, the case was returned to the court. In the meantime, the controller complied with the preliminary decision by deleting the affected personal data in 2021 and changing their registration process in 2020. Holding — First, the court found that they had to formally rule on whether the DPA's decision was lawful at the time it was ruled. It is not to be considered that the controller complied with the administrative decision and fulfilled the required steps (VwGH 28.04.2022, Ra 2022/06/0056). Second, the court held that the controller did not comply with the transparency requirements regarding the layout of their declaration of consent under Article 7(2) GDPR in both cases (website, flyer). Third, the court ruled that they could not agree with DPA's view, that an invalid declaration of consent always constitutes unlawful data processing and that a review of other grounds of justification would not be necessary (CLEU in 'Meta Platforms and Others' (C-252/21) ECLI:EU:C:2023:537). Further on, the Supreme Administrative Court ruled that both, the DPA and the court are required to examine the presence of other grounds (VwGH 08.02.2022, Ro 2021/04/0033). Fourth, the court held that the controller could not base their appeal on Article 6(4) GDPR as the data processing did not satisfy the grounds of justification, nor were other grounds apparent. Inter alia, following the CLEU's preliminary ruling in 'Meta Platforms and Others' (C-252/21) ECLI:EU:C:2023:537, three cumulative requirements must be met for data processing under Article 6(1)(f) GDPR: (1) The controller or a third party must have a legitimate interest, (2) which requires the processing of that personal data, (3) and 'the fundamental rights and freedoms of the data subject' must not outweigh those interests. There were no doubts about the controller's legitimate interest in processing the personal data in question for targeted marketing purposes, as this was both necessary and reasonable. However, the data subject should have been notified about profiling. The wording 'only if the member consents' did not constitute such a notification, and therefore the data subjects were not to be expected that their personal data was used for profiling purposes. Furthermore, the controller explicitly excluded it in their general terms and conditions. Hence, the data subject's right to secrecy overrode the controller's legitimate interest. In summary, the court dismissed the controller's complaint. Last, the court held that an appeal to the Supreme Administrative Court was admissible under Article 133(4) B-VG, as no prevailing case law concerning the implementation of a declaration of consent existed. Hence, the decision relied on a legal question of fundamental importance. ### BVwG - W254 2253353-1 *Source: Federal Administrative Court, 2025-11-17 — https://overview.legal/posts/144038 — original: https://gdprhub.eu/index.php?title=BVwG_-_W254_2253353-1* Facts — On 7 April 2021, the data subject requested access to their data under Article 15 GDPR. The controller replied on 12 April 2021 and provided further information on 27 May 2021 after the data subject made a further enquiry. As the controller's privacy policy listed significantly more data being collected, the data subject lodged a complaint with the Austrian DPA (DSB) on 13 July 2021. They argued that the data provided and its sources were incomplete. On 03 January 2022, the DPA partly upheld the complaint and ruled that the controller violated the right of access by not providing information pursuant to Article 15(1)(h) GDPR, as the calculation of the creditworthiness constitutes profiling under Article 4(4) GDPR. On 09 February 2022, the controller appealed, stating that its calculations were not based on automated processing and that providing further information would reveal trade secrets. The proceedings were stayed until the CJEU's preliminary ruling in 'Dun & Bradstreet Austria' (C‑203/22). By letter of 15 May 2025, the court resumed the case. During the entire proceedings, the controller gradually provided further information on the personal data being processed and the calculation of the credit score. Hence, the following data is used to calculate the credit score: Name, age, gender, address, macroeconomic statistical parameters, payment history. The calculation itself is performed automatically using an algorithm and the same formula unless the controller's customers order a different score model. Holding — First the court ruled that the controller had an obligation to provide information under Article 15(1)(h) GDPR, as all three cumulative requirements pursuant to Article 22 GDPR were stated to be met: A credit score was calculated ('decision'), which predicts various aspects of the data subject, including their economic situation, for example. This constitutes profiling within the meaning of Article 4(4) GDPR ('based solely on automated processing, including profiling'), impacting the decision-making of third parties regarding contractual relationships with the data subject ('produces legal effects [...] or [...] similarly significantly affects' concerning the data subject) . Second, the court held that the controller failed to provide meaningful information under Article 15(1)(h) GDPR to sufficiently explain why the data subject had been assigned a particular credit score, including the logic and weighting of the data categories in question, and its corresponding effects on the data subject. Third, the court ruled that the controller asserted the presence of trade secrets in very general terms without providing the allegedly protected information to the DPA or the court. Fourth, the court held that no appeal to the Austrian Supreme Administrative Court (Verwaltungsgerichtshof) was admissible pursuant to Article 133(4) B-VG, as no (further) indications of legal questions of fundamental importance were raised. The court based their ruling, among others, in accordance with the following CJEU's judgments: In 'SCHUFA' (C‑634/21), the court ruled that the concept of 'automated individual decision-making' under Article 22(1) GDPR encompasses the provision of a probability value regarding a data subject's 'ability to meet payment commitments', on which a third party heavily relies to decide whether 'to establish, implement or terminate' a contract with that data subject. In 'Dun & Bradstreet Austria' (C-203/22), the court stated that the wording of Article 15(1)(h) GDPR must be understood as meaning that the controller must provide clear, transparent and understandable information about the methods and principles used to produce the data subject's credit score. If the controller claims that sharing this information would disclose trade secrets or data of third parties, the competent DPA or court must balance the competing rights and interests to determine the extent of the disclosure. ### CK v Magistrat der Stadt Wien *Source: Court of Justice of the European Union, C-203/22, 2025-02-27 — https://overview.legal/posts/132146 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0203* In Case C-203/22, the Court of Justice of the European Union interpreted Article 15(1)(h) of the GDPR in response to a preliminary ruling from the Verwaltungsgericht Wien concerning an individual's request for meaningful information about the logic of creditworthiness scoring conducted by Dun & Bradstreet Austria GmbH. The Court held that data subjects must receive sufficiently detailed explanations of the logic involved in automated profiling to understand how the decision was reached, while controllers may withhold information protected by trade secrets under Directive (EU) 2016/943 only insofar as such withholding does not render the information provided meaningless. The Court further clarified that data subjects may not use access rights to obtain personal data of third parties or to verify the absolute accuracy of the underlying information processed. ### OQ v Land Hessen *Source: Court of Justice of the European Union, C-634/21, 2023-12-07 — https://overview.legal/posts/132279 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0634* In Case C-634/21, the CJEU addressed a preliminary ruling from the Verwaltungsgericht Wiesbaden concerning OQ's challenge against Land Hessen's refusal to order SCHUFA Holding AG to grant access to and erase personal data, including a credit score. The core issue was whether the automated calculation of a probability value ("scoring") by a credit information agency regarding a person's future ability to meet payment commitments constitutes an automated individual decision-making under Article 22(1) of the GDPR when third parties use that score for their own decisions. The Court held that such scoring does not itself amount to a decision producing legal effects under Article 22(1), as it is the third party, not the credit agency, that makes the decision based on the score. ### HvJ EU 9 januari 2025, C‑394/23 (Mousse). *Source: CJEU, 2025-01-09 — https://overview.legal/posts/50377 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0394* HvJ EU 9 januari 2025, C‑394/23 (Mousse). Artikelen: 5(1)(c), 6(1), en 21 AVG Onderwerp : Beginsel van minimale gegevensverwerking Gek genoeg verwijst het HvJ EU zelf niet naar HvJ EU 1 augustus 2022, C‑184/20 (Vyriausioji tarnybinės etikos komisija), maar dat had hier ook heel logisch geweest. ### French Conseil d'État strikes down GendNotes police app decree for excessive special data *Source: CE, 2021-04-13 — https://overview.legal/posts/125663 — original: https://gdprhub.eu/index.php?title=CE_-_439360* Facts — In February 2020 the French minister of the interior enacted the Decree No. 2020-151 of 20 February 2020 authorising the automated processing of personal data known as "mobile note-taking application" (Décret n° 2020-151 du 20 février 2020 portant autorisation d'un traitement automatisé de données à caractère personnel dénommé «application mobile de prise de notes» (GendNotes)). The app should be used on the occasion of preventive actions, investigations or interventions necessary for the exercise of judicial or administrative police missions. Among the data that can be collected is information relating to alleged racial or ethnic origin, political, philosophical or religious opinions, trade union membership, health or sexual activities or orientation. A group of human rights organisations filed a complaint with the French Constitutional Court. Dispute — Is the "GendNotes" App of the French national police force (Gendarmerie nationale) unlawfully processing special category personal data? Holding — The French Highest Administrative Court held that the decree infringed Article 4 of the Law of 6 January 1978, implementing GDPR in France, the Council of Europe Convention No. 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data and Article 8 CFR, as it excessively infringed upon the right to respect for private life and the correlative right to protection of personal data, without providing appropriate safeguards for their protection in terms of the purpose of the processing and the nature of the data collected, as well as excessive data retention period, data sharing and data security. The Court discussed whether the decree violated Article 4 (a) GDPR, Article 4 (b) GDPR, Article 4 (c) GDPR, and Article 4 (e) GDPR and Article 9 GDPR. According to the Court, the processing of data did not comply with the principle of purpose limitation, as data is collected for future investigations or proceedings. However, the Court did not find a violation on the collect of special category data, given the fact that the decree establishes that this data can only be processed in case of "absolute necessity". Additionally, the Court noted that, even if the decree provides a limitation for the storage of the data, in practice this can be ignored, as the data may be used in different or further investigations, that would impede its erasure. However, they found that the decree was lawful in this regard, given that it clearly stated a retention period of 3 months to 1 year. Taken the above-mentioned into account, the French Highest Administrative Court decided that the data processed by the French national police force can no longer be used "in other data processing, in particular by means of a pre-information system". Therefore, the Court held: In Article 1° of the decree, the words "in other data processing, in particular by means of a pre-information system," are cancelled out. The State will pay €3,000 to every claimant. The rest of the application is rejected. The allowance to collect special category data is not overruled, as the Court argues that the decree only allows it when it is "absolutely necessary". This decision will be notified to the claimants: the Ligue des droits de l'homme, the associations Homosexualités et socialismes and Internet Society France, the associations Mousse, Stop Homophobie, Adheos and Familles A, the association AIDES, the Syndicat de la magistrature, the Syndicat des avocats de France, the Conseil national des barreaux, the Quadrature du Net and the International League against Racism and Anti-Semitism, the Prime Minister and the Minister of the Interior. ### Court of Justice of the European Union - Case C-422/24 - AB Storstockholms Lokaltrafik. *Source: CJEU, 2026-01-07 — https://overview.legal/posts/51955* A new page has been created with the following information: "" ### Ligue des droits humains ASBL v Conseil des ministres *Source: Court of Justice of the European Union, C-817/19, 2022-06-21 — https://overview.legal/posts/132311 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0817* In a preliminary ruling referred by the Belgian Constitutional Court in Ligue des droits humains v. Conseil des ministres (Case C-817/19), the CJEU Grand Chamber assessed the validity of the PNR Directive (EU) 2016/681 and its interplay with the GDPR and the API Directive in light of Articles 7, 8, and 52(1) of the EU Charter of Fundamental Rights. The Court upheld the PNR Directive's validity, finding that the collection, retention, and automated processing of passenger name record data for combating terrorist offences and serious crime constitutes a justified and proportionate limitation on fundamental rights to privacy and data protection, provided the directive's safeguards are strictly observed. No fine was imposed, as the ruling solely provides interpretive guidance on EU law validity and scope for the referring national court. ### Council of State: Tax Authority adequately fulfilled GDPR access request on FSV *Source: Council of State, 2026-08-05 — https://overview.legal/posts/187482 — original: https://gdprhub.eu/index.php?title=RVS_-_202307578/1/A3* Facts — The personal data of an individual was stored in the Fraud Detection System (FSV), an application used by the Dutch Tax Authority between 2012 and 2020 to record potential indicators of tax fraud. The Minister of Finance was the controller. The data subject submitted an access request under Article 15 GDPR. In particular, she requested information about the personal data processed, the purposes of the processing, the recipients of the data, its source and retention period, and any automated decision-making concerning her. The controller provided an overview of the personal data stored in the FSV and answered the data subject’s questions. The data subject objected to the decision, claiming that the controller had not disclosed all information relating to her registration. The controller rejected the objection. It explained that the data subject had been selected for a manual review of her tax return under Project 1043, an anti-fraud initiative launched by the Dutch Tax, and was consequently registered in the FSV. It also stated that the data was accessible only to employees of the Tax Authority and had not been disclosed to other organisations. The District Court of Amsterdam dismissed the data subject’s appeal. It held that the proceedings concerned compliance with the GDPR access request and not the lawfulness of her inclusion in the FSV or any alleged resulting damage. The data subject appealed this judgment before the Council of State. Holding — The Council of State dismissed the appeal and upheld the judgment of the District Court. The Court held that there was no evidence that the controller had incorrectly applied Article 15 GDPR. The controller had provided an overview of all personal data concerning the data subject processed in the FSV, explained the purposes of the processing and clarified the circumstances of her registration under Project 1043. Although the data subject suspected that the controller held additional information, she did not provide concrete evidence supporting this claim. The Court also found no indication that she had been classified as a fraudster or that her personal data had been disclosed to other organisations. The Court further clarified that the lawfulness of the data subject’s registration in the FSV, the deletion of her data and any claim for compensation fell outside the scope of the access proceedings. Consequently, the Court confirmed the contested judgment and did not award litigation costs. ### BVwG - W254 2253351-1 *Source: Federal Administrative Court, 2025-11-14 — https://overview.legal/posts/353783 — original: https://gdprhub.eu/index.php?title=BVwG_-_W254_2253351-1* Facts — The data subject requested access under Article 15 GDPR from the controller (a credit information agency). The controller provided the personal data it held, including the data subject's name, date of birth, address and business role, as well as information about the sources of those data. The data subject considered the response incomplete and requested further information. The controller provided additional information, including the companies that had queried the data subject's creditworthiness between 2014 and 2021 and the credit scores disclosed to them. The data subject then lodged a complaint with the DPA. The data subject argued that the controller processed more personal data than it had disclosed, pointing in particular to the broader categories listed in the controller’s privacy notice and the absence of information about certain data sources. During the DPA proceedings, the controller provided another response, saying that the credit score could change based on statistical criteria linked to economic developments, which it considered non-personal. The data subject appealed the DPA's decision. During the court proceedings, the controller provided further information. It explained that the credit score was calculated using, among other things, payment history data, name, age, sex, address, and the first and last confirmation of the address. However, the controller still did not disclose the specific data covered by the statistical parameters linked to general economic developments that it had used when calculating the data subject’s credit score. Holding — First, the court rejected the argument that the controller must have processed additional personal data merely because its privacy notice listed broader categories of data. The privacy notice described data that the controller could theoretically process, but this did not establish that the controller actually processed those data in relation to the data subject. Second, the court examined whether the statistical parameters used in calculating the credit score constituted personal data under Article 4(1) GDPR. It relied on the broad definition of personal data and the principle that information becomes information “about” a person when its content, purpose or effect links it to that person. The court also referred to existing case law recognising that statistical probability statements can constitute personal data when they provide an assessment relating to an identified or identifiable person. It applied that reasoning to the credit-scoring process. Although the statistical parameters relating to general economic developments did not themselves relate to the data subject, the controller fed them into the algorithm used to calculate that particular person's credit score. By doing so, the controller linked the parameters to the data subject and used them to make an assessment of that person's creditworthiness. The parameters therefore became personal data within the meaning of Article 4(1) GDPR. As a result, Article 15(1) GDPR also covered those statistical parameters. Finally, the court partly upheld the appeal and held that the controller had violated the data subject’s right of access under Article 15(1) GDPR by failing to disclose the statistical data relating to the data subject that it had used to calculate the credit score. It otherwise upheld the DPA's assessment that the controller had provided complete information about the other personal data it processed and their sources and rejected the remainder of the appeal. ### Philippe Latombe v European Commission *Source: General Court, T-553/23, 2025-09-03 — https://overview.legal/posts/132137 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023TJ0553* In Case T-553/23, French citizen Philippe Latombe sought annulment of the European Commission's Implementing Decision (EU) 2023/1795, which found that the United States ensures an adequate level of personal data protection under the EU-US Data Privacy Framework. Latombe challenged the adequacy decision on grounds including infringement of Articles 7 and 8 of the EU Charter, the right to an effective remedy, protections against solely automated decisions, and data security, arguing the framework failed to provide essentially equivalent protection to EU law. The General Court dismissed the action as unfounded, upholding the Commission's adequacy decision. ### European Data Protection Supervisor v Single Resolution Board *Source: Court of Justice of the European Union, C-413/23, 2025-09-04 — https://overview.legal/posts/132136 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0413* The European Data Protection Supervisor (EDPS) appealed a General Court judgment that annulled its decision finding the Single Resolution Board (SRB) had failed to fulfil its obligations under Regulation (EU) 2018/1725 regarding the processing of personal data in a banking resolution compensation procedure. The core legal issues concerned whether pseudonymised data transmitted to a third party constitutes "personal data" under Article 3(1), the proper interpretation of "pseudonymisation" under Article 3(6), and the scope of the controller's obligation to inform data subjects under Article 15(1)(d). The Court of Justice (First Chamber) ruled on these interpretive questions in deciding whether to set aside the General Court's judgment. ## Guidance ### Automated decision-making and profiling *Source: EDPB, automated-decision-making-and-profiling-en, 2018-05-25 — https://overview.legal/posts/126332 — original: https://www.edpb.europa.eu/documents/guideline/automated-decision-making-and-profiling_en* ### Guidelines 3/2025 on the interplay between the DSA and the GDPR *Source: EDPB, edpb-guidelines-202503-interplay-dsa-gdpr-v1-en, 2026-09-17 — https://overview.legal/posts/51175 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-32025-on-the-interplay-between-the-dsa-and-the-gdpr_en* G uidelines 3/2025 on the interplay between the DSA and the GDPR Version 2.0 Adopted on 17 September 2026 1 | Adopted Version history Version Date Adoption information Version 2.0 17 September 2026 Adoption of the Guidelines after public consultation Version 1.1 12 September 2025 Minor corrections in the executive summary Version 1.0 11 September 2025 Adoption of the Guidelines for public consultation 3 | Adopted of special categories of data to present advertisements based on profiling.… ### EDPB-EDPS Joint Opinion 5/2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) *Source: EDPB, edpb-edps-joint-opinion-52021-on-the-proposal-for-a-regulation-of-the-en, 2021-06-18 — https://overview.legal/posts/126016 — original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-52021-on-the-proposal-for-a-regulation-of-the_en* 1 Adopted EDPB - EDPS Joint Opinion 5 /2021 on the proposal for a Regulation of the European Parliament and of the Council laying down harmo nised rules on artificial i ntelligence (Artificial Intelligence Act) 18 June 2021 2 Adopted Executive Summary On 2 1 April 2021, the European Commission presented its Proposal for a Regulation of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (hereinafter “the Proposal”) . The EDPB and the EDPS welcome… ### Opinion 01/2019 on the draft list of the competent supervisory authority of the Principality of Liechtenstein regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) *Source: EDPB, opinion-012019-on-the-draft-list-of-the-competent-supervisory-en, 2019-01-23 — https://overview.legal/posts/126254 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-012019-on-the-draft-list-of-the-competent-supervisory_en* Adopted 1 EDPB Plenary Meeting, 22 - 23 January 2019 Opinion 01 /201 9 on the draft list of the competent supervisory authority of the Principality of Liechtenstein regarding the processing operations subject to the requirement of a data protection impact assessment (Article 35.4 GDPR) Adopted on 23 January 201 9 Adopted 2 Table of c ontents 1 Summary of the Facts ................................ ................................ ................................ ..................... 4 2… ### Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models *Source: EDPB, opinion-282024-on-certain-data-protection-aspects-related-to-en, 2024-12-18 — https://overview.legal/posts/125697 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-282024-on-certain-data-protection-aspects-related-to_en* Adopted 1 Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models Adopted on 17 December 2024 Adopted 2 Executive summary AI technologies create many opportunities and benefits across a wide range of sectors and social activities. By protecting the fundamental right to data protection, GDPR supports these opportunities and promotes other EU fundamental rights, including the right to freedom of thought, expression and information,… ### Guidelines 8/2020 on the targeting of social media users *Source: EDPB, edpb-guidelines-on-the-targeting-of-social-media-users, 2021-04-13 — https://overview.legal/posts/38073 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-82020-on-the-targeting-of-social-media-users_en* The EDPB adopted Guidelines 8/2020 on the targeting of social media users to clarify the roles, responsibilities, and legal obligations of the various actors involved in social media targeting, including social media providers, targeters, and users. The guidelines analyze different targeting mechanisms—based on provided, observed, and inferred data—and address controller determinations, legal bases, transparency requirements, DPIAs, and the processing of special categories of data. No fines are imposed, as this is interpretive guidance intended to assist stakeholders in achieving GDPR compliance. ### Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects *Source: EDPB, guidelines-22019-on-the-processing-of-personal-data-under-article-61b-gdpr-in-en, 2019-10-16 — https://overview.legal/posts/126202 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-22019-on-the-processing-of-personal-data-under-article-61b-gdpr-in_en* 1 Adopted Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects Version 2.0 8 October 2019 2 Adopted Version history Version 2.0 8 October 2019 Adoption of the Guidelines after public consultation Version 1.0 9 April 2019 Adoption of the Guidelines for publication consultation 3 Adopted 1 Part 1 – Introduction ................................ ................................… ### Opinion 13/2019 on the draft list of the competent supervisory authority of France regarding the processing operations exempt from the requirement of a data protection impact assessment (Article 35(5) GDPR) *Source: EDPB, opinion-132019-on-the-draft-list-of-the-competent-supervisory-en, 2019-07-12 — https://overview.legal/posts/126218 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-132019-on-the-draft-list-of-the-competent-supervisory_en* Adopted 1 Opinion 13 /2019 on the draft list of the com petent supervisory authority of France regarding the processing operations exempt from the requirement of a data protection impact assessment (Article 35( 5 ) GDPR) Adopted on 10 July 2019 Adopted 2 Adopted 3 The European Data Protection Board Having r egard to Article 63, Article 64 (2)and Article 35( 1), (5), (6) of the Regulation 2016/679/E U of the European Parliament and of the Council of 27 April 2016 on the protection of natural… ## Enforcement decisions ### AP (The Netherlands) - Uber B.V and Uber Technologies Inc. *Source: AP (The Netherlands), 2026-08-21 — https://overview.legal/posts/291444 — original: https://gdprhub.eu/index.php?title=AP_(The_Netherlands)_-_Uber_B.V_and_Uber_Technologies_Inc.* Facts — Uber B.V. and Uber Technologies Inc., the controllers, used software between 2018 and 2022 to monitor drivers’ behaviour and customer ratings. Where the system detected suspected fraud or low customer ratings, drivers’ accounts could be automatically temporarily or permanently deactivated without human assessment. During the deactivation, affected drivers could no longer generate income through Uber. The proceedings followed complaints by 171 French drivers represented by the Ligue des droits de l’Homme. Since the controllers’ main European establishment was in the Netherlands, the Dutch DPA investigated the matter as lead supervisory authority in cooperation with the French DPA and other concerned authorities. Holding — The DPA held that the controllers violated Article 22 GDPR by subjecting drivers to decisions based solely on automated processing which significantly affected them. The account deactivations were made automatically, without meaningful human involvement, and prevented affected drivers from working through Uber and earning income via the platform. The DPA also found that the controllers had not sufficiently informed drivers about the automated decision-making. The press release does not specify the exact GDPR transparency provision infringed. The DPA imposed a fine of €824,99 m. The infringing practices had already ended by the time of the decision. The controller announced that it would challenge the fine. ### Garante per la protezione dei dati personali (Italy) - 484/2026 *Source: Garante per la protezione dei dati personali (Italy), 2026-07-03 — https://overview.legal/posts/184565 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_484/2026* Facts — EstEnergy S.p.A. (hereinafter, the controller) is an Italian energy company supplying natural gas, electricity and related services. Before entering into contracts, the controller assessed the creditworthiness of potential customers through an internal and an external credit check. The internal assessment involved verifying whether potential customers had outstanding debts not only with the controller but also with Hera Comm S.p.A (hereinafter, the corporate group). The assessment was conducted on behalf of the controller by Hera S.p.A. (hereinafter, the processor), which returned an “OK” or “KO” result. Where the internal assessment returned an “OK”, the controller conducted an external assessment using credit information supplied by Experian Italia S.p.A. and commercial information provided by Cerved Group S.p.A. This information was combined using the “CGS-X” software provided by Major 1 S.r.l. (hereinafter, the software provider and processor). The software generated an integrated creditworthiness score and several underlying sub-scores. On the basis of the result, the controller could refuse to enter into an energy supply contract. The DPA received several complaints from data subjects whose requests for energy supply had been rejected on the basis of their risk profiles. However, when the data subjects contacted the credit and commercial information providers, they were informed that the relevant databases did not contain negative information or adverse events concerning them. The data subjects also submitted access requests under Article 15 GDPR. Although the controller responded within the applicable time limits, it did not provide the CGS-X score, the underlying sub-scores or meaningful information about the logic and criteria used to calculate the profiles. Instead, the controller referred the data subjects to the credit and commercial information providers. Following the complaints, the DPA consolidated the proceedings and initiated an ex officio investigation. It conducted inspections at the premises of the processor, the software provider and processor, and the credit and commercial information providers. The investigation also established that the controller retained the information obtained through the credit checks. Through the processor, the controller subsequently analysed this information to potentially refine the corporate group’s customer rating system. Between 2022 and March 2024, this processing concerned more than one million data subjects. Holding — The DPA held that the controller’s creditworthiness assessment infringed Articles 5(1)(a), (b), (d) and (e), 12, 13, 14, 15 and 28 GDPR. First, the controller failed to provide transparent information about the internal assessment of customers’ previous debts and the sharing of such information within the corporate group. The instructions given to the processor also did not adequately cover these processing operations. The DPA therefore found violations of Articles 5(1)(a), 13, 14 and 28 GDPR. Second, the controller provided incomplete responses to access requests. It did not disclose the CGS-X score, the underlying sub-scores or meaningful information on the logic and criteria used to generate the creditworthiness profile. Referring the data subjects to the credit and commercial information providers did not discharge the controller’s obligations under Articles 12 and 15 GDPR. Third, the controller had not established a justified retention period for the data collected during the external assessment. Applying a general ten-year retention period for accounting records was not shown to be necessary for the creditworthiness assessment, in violation of Article 5(1)(e) GDPR. The DPA also found that reusing credit and commercial information to refine the corporate group’s rating system was incompatible with the original purpose for which the data had been collected. Since the retained information could become outdated, this processing also violated the purpose limitation and accuracy principles under Articles 5(1)(b) and (d) GDPR. The DPA ordered the controller to adopt a compliant access-response template, provide the relevant information to the data subjects involved and establish procedures enabling rectification, human intervention and the possibility to challenge decisions. The controller had six months to demonstrate compliance. Finally, the DPA imposed a €1,400,000 fine, taking into account the seriousness and scale of the infringements, the impact on approximately one million data subjects and the risk of refusal of essential energy services. It also considered the controller’s cooperation, lack of previous relevant infringements and remedial measures as mitigating factors. ### Uber Technologies Inc.: Non-compliance with general data processing principles *Source: Dutch Supervisory Authority for Data Protection (AP), 2026-08-21 — https://overview.legal/posts/353983 — original: https://www.enforcementtracker.com/ETid-3232* The Dutch Supervisory Authority for Data Protection (AP) fined Uber Technologies Inc. €824,990,000 for non-compliance with general data processing principles, specifically addressing violations of Articles 22, 13, and 14 GDPR. The enforcement action concerned Uber's automated decision-making practices involving the blocking of drivers, where the company failed to provide adequate transparency and information to affected data subjects regarding the automated processing of their personal data. The case arose within the transportation sector and represents one of the largest GDPR fines imposed to date. ### HDPA (Greece) - 12/2026 *Source: HDPA (Greece), 2026-05-13 — https://overview.legal/posts/144044 — original: https://gdprhub.eu/index.php?title=HDPA_(Greece)_-_12/2026* Facts — The complainant, a foreign national, submitted a complaint to the Hellenic DPA through his authorized attorney, seeking his deletion from the Hellenic the National Registry of Undesirable Aliens. In response to the Authority's request for clarifications, the competent Directorate of the Ministry of Citizen Protection informed the DPA that: • By a decision dated 27-07-2017, an entry ban and registration in the National Registry of Undesirable Aliens were imposed on the complainant for reasons of national security. • Following temporary 48-hour lifts of the measure for humanitarian reasons in 2019, the entry ban was re-imposed. • Subsequent decisions in 2020, 2023, and 2025 maintained the entry ban and renewed his registration in the National Registry of Undesirable Aliens for successive three-year periods, as the grounds for registration remained active. • The explicit grounds and documentation behind the registration were not disclosed to the complainant because the competent Directorate classified the file as restricted/classified service material. The complainant and his attorney attended a DPA hearing on 22-04-2026, arguing that the registration lacked specific, adequate, or definitive justification regarding any threat to public order or national security. They noted that the complainant has no criminal convictions, poses no threat, and possesses strong ties, residency, and business operations in the region of Northern Epirus and Greece, meaning the entry ban severely disrupts his professional and family life. Holding — According to the provisions of Article 82(1) of Law 3386/2005, foreign nationals whose presence in Greek territory constitutes a threat to national security, public safety, or public order can be registered in the National Registry of Undesirable Aliens, with registrations subject to an ex officio review every three years. Furthermore, pursuant to the provisions of Article 54(2) and Article 55(4) of Law 4624/2019 (the Greek law implementing the GDPR), the data controller is legally empowered to restrict or omit the provision of information and to deny a data subject access to their personal data when dictated by reasons of national security or public order. These national provisions are explicitly anchored in Article 23 GDPR (specifically Article 23(1)(a)GDPR and Article 23(1)(c) GDPR), which permits Member State law to restrict the scope of the obligations and data subject rights (such as the right to be informed under Article 13 GDPR - Article 14 GDPR and the right of access under Article 15 GDPR) to safeguard national security and public security. In the present case, the evidence demonstrated that the complainant's initial registration and subsequent renewals in the National Registry of Undesirable Aliens were executed lawfully for reasons of national security. The Ministry of Citizen Protection, acting as the data controller, exercised its legal discretion under these frameworks to weigh these interests and correctly determined that the underlying operational decision constitutes classified material that cannot be disclosed to the data subject. Consequently, the fundamental principles of data protection law were not breached, and the Hellenic DPA rejected the complaint as unfounded. ### Italian DPA finds Cerved Group failed to disclose creditworthiness scores in Art. 15 *Source: Garante per la protezione dei dati personali (Italy), 2026-03-07 — https://overview.legal/posts/353642 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_485/2026* Facts — The DPA received several complaints from data subjects concerning Cerved Group S.p.A. (the controller) an Italian credit rating agency. The controller was processing the personal data of data subjects for the purpose of verifying the creditworthiness of potential customers of two energy suppliers. As a result of the risk profiles attributed to them, data subjects were declined the supply of energy. When data subjects requested access to their data from the controller under Article 15 GDPR, they were informed that their databases did not contain negative information or adverse events justifying the denial of energy supply. The DPA conducted an investigation, and found that the controller provided different responses to different data subjects depending on whether their personal data had been recorded in their system. For data subjects where there was no negative information on them the controller claimed that no personal data processing had been conducted for commercial information purposes. Nevertheless, a score based on their residential address, age and place of birth was generated. For those data subjects where information was present on their databases the controller provided them with the personal data which was present. The DPA further found that the controller did not provide reference to the scores and sub-scores assigned by the controller to the data subjects. Holding — The DPA held that in light of the controller inadequately responding to data subjects requests, which prevented them from accessing all the information processed for the purpose of calculating their risk profile, and to understand how the score was used in the decisions of the energy suppliers, data subjects were effectively prevented from exercising their rights. Particularly, the DPA held that the controller did not provide data subjects with all the necessary information, such as certain scores, and the logic and criteria used to calculate the scores, which prevented them from determining the lawfulness, fairness and accuracy of the data. This undermined their ability to exercise their right to rectification pursuant to Article 16 GDPR, and right to obtain human intervention, express their opinion and challenge the decision made, pursuant to Article 22(3) GDPR. In connection with sensitive nature of the information processed by the controller (residential address, age and place of birth) which relates to a data subjects creditworthiness with potentially prejudicial consequences, the controller was found in violation of Article 5(1)(a) GDPR, Article 12 GDPR and Article 15 GDPR. The DPA imposed a €400,000 fine on the controller pursuant to Article 83 GDPR taking into account, inter alia, the fact that this affected 2.094 data subjects. The DPA further ordered the controller to establish a procedure allowing data subjects to exercise their right to rectification pursuant to Article 16 GDPR. ### Garante fines Lusha Systems Inc. over unauthorized B2B contact database *Source: Garante per la protezione dei dati personali (Italy), 2026-07-14 — https://overview.legal/posts/184678 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_542/2026* Facts — Lusha Systems Inc. (the controller) operated a subscription-based platform that provided professional contact information through a business-to-business (B2B) database. It was a US company wholly owned by Lusha Systems Ltd. In April 2025, the Italian DPA (Garante) initiated an investigation after media reports revealed that telephone numbers of senior Italian officials were available on the platform. The DPA later received one complaint and one report from data subjects who had received unsolicited advertising communications. The data subjects further stated that after requesting information about the source of their contact details, they discovered that their data were available on the controller’s platform without their consent. The controller explained that, for a subscription fee, it provided its Clients with a Business Contact Card for each Contact. The controller further distinguished between “Clients”, namely customers who used the platform and accessed its B2B database, and “Contacts”, namely the individuals whose personal data were included in that database, regardless of whether they used or were aware of the platform. Clients received Contact Cards containing information such as names, professional email addresses, telephone numbers, job titles, roles and locations, which could be used for sales, marketing, recruitment, business intelligence and fraud prevention. The DPA limited its investigation to the processing of Contacts’ personal data. The controller stated that it collected and combined data from publicly available sources, specialised providers, affiliated companies and commercial partners. It also inferred missing professional email addresses through algorithms that identified standard company email patterns. Through its Community Program and integrations with email, calendar and CRM services, it could also obtain information from Clients’ professional networks and communications. The data were cross-referenced, enriched and regularly updated to reflect changes in Contacts’ professional circumstances. The controller argued that the GDPR did not apply because it was established outside the EU and provided services only to businesses. It additionally claimed that the weekly updating of Contact Cards ensured accuracy rather than constituting monitoring or profiling. The controller maintained that the collection and disclosure of the data were necessary for its own economic interest in providing accurate professional contact information and for its Clients’ interests, including fraud prevention. According to the controller, it processed only a limited range of information concerning the Contacts’ professional lives. It further claimed that individuals who made professional information publicly available, particularly through services such as LinkedIn, could reasonably expect that the information might be reused and that they could be contacted regarding professional opportunities. Regarding transparency, the controller stated that its Personal Information Notice was sent to each Contact before their information became available in the database. It explained that it notified Contacts that they had a seven-day period during which they could opt out before their information became available to Clients. The controller also maintained that excluding public officials and public figures from the database was not a requirement under the GDPR. It attributed the presence of certain public officials to technical limitations in its filtering system. It also argued that public figures had a lower expectation of privacy. After the proceedings began, the controller removed profiles connected with Italian public bodies and officials, strengthened its filters and customer-verification measures, discontinued the Community Program in Italy and extended the opt-out period to fourteen days. Holding — Regarding the territorial scope of the GDPR, the DPA acknowledged that Article 3(2)(a) GDPR could apply to the processing of Clients’ data, but not to Contacts, since they were not recipients of the service. However, it held that Article 3(2)(b) GDPR applied because the controller systematically combined, enriched and updated Contacts’ professional information in order to assess their circumstances and determine whether and how they would appear in the database. Referring to Recital 24 and Recital 30, the DPA held that monitoring did not require profiling. It noted that the systematic observation of online traces and changes in a person’s professional situation was sufficient. The fact that the processing also served data accuracy did not alter that conclusion. It emphasised that the fact that the controller also updated the information to ensure its accuracy did not prevent the processing from constituting monitoring. Regarding transparency, the DPA found that the information concerning the collection of the Contacts’ data, the purposes of the processing and the legal basis relied upon was scattered across several documents. Also, the relevant information was not easily accessible from the controller’s homepage, while the Personal Information Notice could not be located directly through the website without prior knowledge of its existence. It further pointed out that the documents were provided in English rather than in the language of the affected data subjects. The DPA held that presenting the information in this manner did not satisfy the requirement that information be concise, transparent, intelligible and easily accessible. It therefore found an infringement of Article 5(1)(a) GDPR and Article 12 GDPR. Moreover, the DPA assessed whether Article 6(1)(f) GDPR provided a valid legal basis for the processing. It examined the controller’s Legitimate Interest Assessment and considered it essentially non-existent, as it contained only generic statements on necessity and proportionality and no genuine balancing assessment. The DPA then applied the three-part test under Article 6(1)(f) GDPR. It held that making the Contacts’ data available to Clients for their own marketing and sales activities could not constitute a legitimate interest, since the disclosure of contact information to third parties for their independent advertising purposes required prior consent under the applicable national and ePrivacy framework . However, it acknowledged that the controller’s interest in fraud prevention could be considered legitimate. The DPA nevertheless found that the processing was not necessary for the purposes pursued. It held that the controller collected information extending beyond ordinary professional contact details, including third-party data contained in CRM databases, email headers and subject lines, information about calendar meetings, and browsing data collected through browser extensions or other software integrations used by Clients. It pointed out that much of this information was not publicly available but was extracted from private interpersonal communications, disclosed by Clients, obtained through integrations with information systems or acquired from third-party providers. The DPA held that the collection and combination of such extensive information was neither strictly necessary nor proportionate for creating professional Contact Cards. Furthermore, it stressed that fraud prevention could also have been achieved through less intrusive means. The DPA therefore concluded that the necessity requirement and the principle of data minimisation were not met. Regarding the balancing test, the DPA emphasised that there was no prior relationship between the controller and the Contacts. Creating a professional profile on LinkedIn or another professional platform did not create a reasonable expectation that unpublished contact details would be collected from multiple sources, continuously updated and disclosed to an unspecified number of paying customers. It further noted that the processing could expose Contacts to communications from unknown third parties for purposes they could not reasonably anticipate. The DPA concluded that the Contacts’ interests, rights and freedoms prevailed over the controller’s economic interests and that the safeguards adopted by the controller could not change this outcome. Therefore, the DPA held that Article 6(1)(f) GDPR did not provide an appropriate legal basis and found that the controller infringed Article 5(1)(a) GDPR, Article 5(1)(c) GDPR, and Article 6 GDPR. Regarding public officials, the DPA held that their status did not reduce their entitlement to data protection and that no public interest justified disclosing their direct contact details for commercial purposes. The DPA further found that the controller had been aware of the risk that public officials could be included in its database but had failed to implement sufficiently effective technical and organisational measures. Its filters recognised general titles such as “President” but failed to exclude more specific titles such as “President of the Italian Republic” and “Vice Prime Minister”. The DPA therefore found an infringement of the principle of data minimisation under Article 5(1)(c) GDPR and the obligation of data protection by design and by default under Article 25 GDPR. The DPA imposed a fine of €2,000,000. Furthermore, it prohibited any further processing of personal data of data subjects located in Italy that had been collected without an adequate legal basis and ordered their deletion. ### DSB (Austria) - DSB-D124.2437/25 *Source: DSB (Austria), 2026-01-09 — https://overview.legal/posts/291441 — original: https://gdprhub.eu/index.php?title=DSB_(Austria)_-_DSB-D124.2437/25* Facts — The controller, an Austrian registered association, operates a therapy centre for psychosomatic illnesses. The data subject was a patient of the controller. On 28 July 2025, the data subject sent an access request by email under Article 15 GDPR, asking for full information on all personal data processed about him including specific categories of data, processing purposes, recipients, storage periods, data origin, any automated decision-making, a copy of his data in electronic format and what data had been processed by two named individuals (a doctor and a body therapist working for the controller) and whether either had disclosed his data to third parties. The controller's chairperson replied by email on 12 August 2025, attaching a PDF of the data collected from the data subject and a list of medications, noting the data originated from a named doctor and that there was no planned retention period. The reply stated that data recorded by the body therapist existed only in handwritten form and had not been electronically processed and offered to send the data subject a copy by post or email. The reply did not include information on the purposes of processing, categories of data, recipients or categories of recipients, or the criteria used to determine retention periods. The data subject filed a complaint with the Austrian DPA, alleging that the access provided was incomplete. Despite being invited to comment twice by the DPA, the controller did not respond at any point during the proceedings, although a delivery receipt confirmed it had received the correspondence. Holding — First, addressing the controller's failure to participate in the proceedings, the DPA held that although it is required to investigate matters on its own initiative, a party's persistent failure to cooperate despite repeated invitations may properly be taken into account in the DPA's free assessment of evidence, rather than obliging the DPA to conduct further investigations of its own accord. On this basis, the DPA treated the data subject's account of events, including that no further information had been provided beyond the 12 August 2025 email, as established. Second, on the scope of the complaint, the DPA reiterated that in a complaint-based procedure, the content of the complaint itself defines and limits the subject matter of the proceedings. The DPA can only rule on what was actually raised. The data subject's complaint was based on the incompleteness of the access provided, specifically regarding the handwritten notes and the missing meta-information. Third, on the handwritten notes, the DPA held that the GDPR's material scope extends not only to automated processing but also to non-automated processing where the data form part of a "filing system" under Article 4(6) GDPR defined broadly by the CJEU case-law C-740/22 as any structured collection of personal data accessible according to specific criteria that make data easily retrievable. The DPA held that although the controller had not specified how the therapist's handwritten notes were organised, it could reasonably be assumed that such clinical notes on patients are typically structured by criteria such as name or treatment period to ensure future retrievability, consistent with professional standards of care in the therapeutic field. On this basis, the DPA held that the notes fell within the GDPR's material scope and that the data subject was entitled to access the personal data they contained, so the complaint was well-founded on this point. Fourth, on the missing meta-information, the DPA held that Article 15(1) GDPR entitles a data subject not only to the specific personal data processed but also to the accompanying information listed in Article 15(1)(a)-(h) GDPR, including processing purposes, categories of data, recipients or categories of recipients and criteria for determining storage periods. Since the controller's response of 12 August 2025 included none of this information, the complaint was also well-founded on this point. The DPA accordingly upheld the complaint and found a violation of the right of access. Citing CJEU case-law C-46/23 on the DPA's obligation to adopt appropriate corrective measures once a violation is established, the DPA ordered the controller, under Article 58(2)(c) GDPR, to fully comply with the data subject's access request including disclosure of the handwritten notes and the outstanding meta-information within four weeks. ### Garante per la protezione dei dati personali (Italy) - 483/2026 *Source: Garante per la protezione dei dati personali (Italy), 2026-07-03 — https://overview.legal/posts/184557 — original: https://gdprhub.eu/index.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_483/2026* Facts — Several data subjects lodged complaints with the Italian DPA (Garante) after Hera Comm S.p.A., an energy supplier (the controller), declined to conclude electricity or gas contracts with them because its checks had resulted in a negative risk assessment. The controller had used a credit-check procedure to assess the creditworthiness of prospective customers before entering into such contracts. The credit-check procedure consisted of an internal and an external assessment. During the internal assessment, Hera S.p.A. (processor A) checked whether the prospective customer had outstanding debts towards the controller or EstEnergy S.p.A., another energy supplier within the same corporate group. The assessment returned an OK or KO result. The controller’s privacy notice stated that customer data could be disclosed to other companies within the Hera Group and to third parties contractually linked to the Group. Where the internal assessment returned an OK result, an external assessment was carried out using software called “CGS-X”, provided by Major 1 S.r.l. (processor B). Through the software, databases operated by Experian Italia S.p.A. (the credit-information provider) and Cerved Group S.p.A. (the commercial-information provider) were consulted. The software combined the scores supplied by the two external data providers to generate an integrated creditworthiness score, which was transmitted to systems operated by processor A. Those systems applied the criteria established under the controller’s group credit policy and returned a final OK or KO result. The data subjects alleged that the refusal of their applications resulted from the external creditworthiness assessment. When they subsequently contacted the two external data providers, the providers stated that their systems did not contain negative information or adverse events concerning them. The data subjects then submitted access requests to the controller. The controller replied that their risk profiles were based on automated scoring using information obtained from external databases and directed them to the two external data providers for further details. The replies did not identify the CGS-X score and did not explain the logic or criteria used in the assessment. At the time of the inspection, the controller had not set a specific retention period for the external-assessment data and instead applied a general ten-year period used for accounting documentation. It also reused credit-check data, including information from external providers and previous debts, for analyses aimed at refining its group’s rating system. Between 2022 and March 2024, this processing concerned 1,003,657 individuals. During the proceedings, the controller and the other energy supplier entered into a joint-controller arrangement under Article 26 GDPR concerning the internal assessment and updated the relevant privacy information. Under that arrangement, the two joint controllers also undertook to appoint processor A for the processing carried out as part of the internal assessment. The controller subsequently adopted a five-year retention period for creditworthiness data and discontinued the analyses concerning the refinement of the rating system. Holding — The DPA considered that the information provided by the controller did not describe the intra-group sharing and use of data concerning previous debts with sufficient specificity. It found that the general references to disclosures within the corporate group did not provide information about the processing operations connected with the internal assessment. The DPA also found that the instructions provided to processor A did not cover the processing of information concerning debts owed by customers to the other energy supplier. It therefore found infringements of Article 5(1)(a) GDPR, Article 13 GDPR, Article 14 GDPR and Article 28 GDPR. The DPA noted that, under the joint-controller arrangement, the internal assessment was carried out jointly by the two energy suppliers on the basis of Article 6(1)(f) GDPR. However, it found that the processing carried out before the conclusion of that arrangement was unlawful. The DPA also found that the responses to the access requests did not meet the requirements of Article 12 GDPR and Article 15 GDPR. It noted that the access requests had been submitted to the controller which was required to provide all personal data and information relating to the processing. It pointed out additionally that the information to be provided should include the integrated score, the contributing scores, and meaningful information about the logic and criteria applied. Moreover, referring to the CJEU’s judgment in Case C-203/22 (Dun & Bradstreet Austria), the DPA stated that the requirement to provide meaningful information about the logic involved could not be satisfied merely by disclosing a complex mathematical formula or by providing a detailed description of every stage of the automated process. It emphasized that the controller was required to describe the procedure and principles actually applied in a concise and understandable manner, enabling the data subject to understand which personal data were used and how they contributed to the result. The DPA considered that the information provided did not enable the data subjects fully to assess the lawfulness of the processing or the accuracy of the data used. It also limited their ability to request rectification, obtain human intervention, express their views and contest the decision. The DPA further found that the application of a general ten-year retention period to the credit-check data had not been sufficiently justified in relation to the purpose of assessing a specific contractual application. The controller had not demonstrated the necessity of retaining the scores and related reports for that period. The DPA concluded that the controller violated Article 5(1)(e) GDPR. Furthermore, the DPA considered that the use of data obtained from the credit-information provider and the commercial-information provider for analyses concerning the refinement of the controller’s group rating model pursued a further purpose incompatible with the original purpose for which those data had been collected. It also found that retaining and subsequently reusing data obtained from the two external providers created a risk that the information would no longer be up to date. It therefore found infringements of Article 5(1)(b) GDPR and Article 5(1)(d) GDPR. The DPA imposed a fine of €5,800,000. It also ordered the controller to define a new response template for access requests, including the relevant scores and meaningful information about the logic and criteria applied, and to provide the revised response to the complainants. The controller was further required to establish a procedure enabling data subjects to request the rectification of inaccurate or incomplete data, obtain human intervention, express their views and contest the decision. ## Recent developments ### Dutch DPA fines Uber EUR 824 990 000 for unlawful automated decision-making and insufficient information on profiling *Source: European Data Protection Board, 2026-10-08 — https://overview.legal/posts/593253 — original: https://www.edpb.europa.eu/news/dutch-dpa-fines-uber-eur-824-990-000-for-unlawful-automated-decision-making-and-insufficient_en* Background informationCross-border caseController: Uber B.VLegal Reference(s): Article 22 (Automated individual decision making, including profiling) and Article 13 (Information to be provided where personal data are collected from the data subject)Decision: Administrative fineKey words: Automated decision making, profiling and online tracking, finesSummary of the DecisionThe Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, imposes a fine of EUR 824 990 000 on Uber. The rea ### EFF Statement on California Governor's Executive Order on AI *Source: Electronic Frontier Foundation, 2026-09-18 — https://overview.legal/posts/354129 — original: https://www.eff.org/deeplinks/2026/09/eff-statement-california-governors-executive-order-ai* California Gov. Gavin Newsom's executive order is an opportunity for a needed, thoughtful conversation about artificial intelligence and its potential harms. Everyday Californians are feeling real anxiety about the risks of artificial intelligence, and as an organization that works to ensure technology empowers people, EFF welcomes this order as a way for the state of California to lead a much-needed dialogue that addresses these concerns. DONATE TO EFF ensure ai serves people, not power Nonethe ### Court of Amsterdam on GDPR request on information about the existence of automated decision-making at Uber *Source: Dutch Courts, 2023-04-04 — https://overview.legal/posts/6218 — original: https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:GHAMS:2023:793&pk_campaign=rss&pk_medium=rss&pk_keyword=uitspraken#entry-4301* Request from Uber drivers to Uber for information under Article 15(1)(h) AVG (information about the existence of automated decision-making within the meaning of Article 22 AVG) after their accounts were deactivated by Uber; scope of information right under Article 15(1)(h) AVG. Are the deactivation decisions based solely on automated ver... ### Drivers' Request for Personal Data Access and Automated Decision-Making Information from Ola Netherlands BV: Balancing Personal Data Protection with the Needs of Drivers *Source: Dutch Courts, 2023-04-04 — https://overview.legal/posts/6216 — original: https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:GHAMS:2023:804&pk_campaign=rss&pk_medium=rss&pk_keyword=uitspraken#entry-4299* Request by drivers to Ola Netherlands BV for access as referred to in Article 15 (1) AVG to certain personal data concerning them (including "ratings" given by passengers) and for information as referred to in Article 15 (1) (h) AVG (information on the existence of automated decision-making within the meaning of Article 22 AVG). Protection of passengers' personal data. Is... ### Uber Drivers Request Access to Personal Data and Disclosure of Automated Decision-Making: Balancing Privacy with Passenger Safety *Source: Dutch Courts, 2023-04-04 — https://overview.legal/posts/6217 — original: https://deeplink.rechtspraak.nl/uitspraak?id=ECLI:NL:GHAMS:2023:796&pk_campaign=rss&pk_medium=rss&pk_keyword=uitspraken#entry-4300* Request from Uber drivers to Uber for access as referred to in Article 15 (1) AVG to certain personal data concerning them (including "ratings" given by passengers) and for information as referred to in Article 15 (1) (h) AVG (information on the existence of automated decision-making within the meaning of Article 22 AVG). Protection of passengers' personal data. Is adapti... ## Literature ### Data is power: Towards additional guidance on profiling and automated decision-making in the GDPR *Source: Journal of Information Rights, Policy and Practice, 2018-03-14 — https://overview.legal/posts/132598 — original: https://doi.org/10.21039/irpandp.v2i2.45* In contrast to automated decision-making, profiling is a relatively novel concept in European data protection law. It is now explicitly defined in Article 4(4) of the EU General Data Protection Regulation (GDPR), and refers to the automated processing of data (personal and not) to derive, infer, predict or evaluate information about an individual (or group), in particular to analyse or predict an individual’s identity, their attributes, interests or behaviour.Through profiling, highly sensitive details can be inferred or predicted from seemingly uninteresting data, leading to detailed and comprehensive profiles that may or may not be accurate or fair. Increasingly, profiles are being used to make or inform consequential decisions, from credit scoring, to hiring, policing and national security.Ever since the approval of the regulation in 2016, debates have focussed on the GDPR’s potential to limit or offer protection against increasingly sophisticated means of processing data, in particular with regard to profiling and automated decision-making. While the GDPR offers new rights and protection, their scope and limits are open to debate, partly due to the clumsy syntax of the relevant articles and the lack of authoritative guidance concerning their interpretation.The European Data Protection Board that will replace the Working Party on the Protection of Individuals with regard to the Processing of Personal Data is specifically tasked with publishing ‘guidelines, recommendations and best practices’ on the GDPR. In October 2017, the Working Party 29 has published draft guidance on profiling and automated decisionmaking.In this article we propose our suggestions to contribute to the development of guidelines which provide the strongest protections for data subjects. ### HOW GDPR TREATS AUTOMATED DECISION-MAKING *Source: Journal Scientific and Applied Research, 2025-11-14 — https://overview.legal/posts/132599 — original: https://doi.org/10.46687/jsar.v28i1.435* This article examines how the General Data Protection Regulation (GDPR) regulates automated decision-making, including profiling, in the context of personal data processing. It analyzes the main provisions of Article 22 of the Regulation, as well as the conditions under which fully automated decisions that produce legal effects or significantly affect data subjects are permitted. The article highlights the rights of data subjects – the right to human intervention, the right to express their poin ### Do algorithms rule the world? Algorithmic decision-making and data protection in the framework of the GDPR and beyond *Source: International Journal of Law and Information Technology, 2019-01-01 — https://overview.legal/posts/132624 — original: https://doi.org/10.1093/ijlit/eay017* The purpose of this article is to analyse the rules of the General Data Protection Regulation (GDPR) and the Directive on Data Protection in Criminal Matters on automated decision-making and to explore how to ensure transparency of such decisions, in particular those taken with the help of algorithms. Both legal acts impose limitations on automated individual decision-making, including profiling. While these limitations of automated decisions might come across as a forceful fortress strongly protecting individuals and potentially even hampering the future development of Artificial Intelligence in decision-making, the relevant provisions nevertheless contain numerous exceptions allowing for such decisions. While the Directive on Data Protection in Criminal Matters worryingly does not seem to give the data subject the possibility to familiarize herself with the reasons for such a decision, the GDPR obliges the controller to provide the data subject with ‘meaningful information about the logic involved’ (Articles 13(2)(f), 14(2)(g) and 15(1)(h)), thus raising the much-debated question whether the data subject should be granted a ‘right to explanation’ of the automated decision. This article seeks to go beyond the semantic question of whether this right should be designated as the ‘right to explanation’ and argues that the GDPR obliges the controller to inform the data subject of the reasons why an automated decision was taken. While such a right would in principle fit well within the broader framework of the GDPR’s quest for a high level of transparency, it also raises several queries: What exactly needs to be revealed to the data subject? How can an algorithm-based decision be explained? The article aims to explore these questions and to identify challenges for further research regarding explainability of automated decisions. ### CJEU: The Rating of a Natural Person’s Creditworthiness by a Credit Rating Agency Constitutes Profiling and Can Be an Automated Decision under Article 22 GDPR *Source: European Data Protection Law Review, 2024-01-01 — https://overview.legal/posts/132601 — original: https://doi.org/10.21552/edpl/2024/1/17* Case C-634/21 OQ v Land Hessen (Scoring), Judgment of the Court of Justice of the European Union (First Chamber) of 7 December 2023 Article 22 (1) of Regulation (EU) 2016/679 (General Data Protection Regulation) must be interpreted as meaning that the automated establishment, by a credit information agency, of a probability value based on personal data relating to a person and concerning his or her ability to meet payment commitments in the future constitutes 'automated individual decision-making' within the meaning of that provision, where a third party, to which that probability value is transmitted, draws strongly on that probability value to establish, implement or terminate a contractual relationship with that person. ### Rethinking Decisions Under Article 22 of the GDPR: Implications for Semi-Automated Legal Decision-Making *Source: SSRN Electronic Journal, 2023-01-01 — https://overview.legal/posts/132607 — original: https://doi.org/10.2139/ssrn.4478107* ## Related topics - **Profiling** — https://overview.legal/topics/profiling Automated processing to evaluate personal aspects - **Personal Data** — https://overview.legal/topics/personal-data Information relating to identified or identifiable natural persons - **Marketing** — https://overview.legal/topics/marketing Use of personal data for marketing and advertising purposes - **Processing** — https://overview.legal/topics/processing Any operation performed on personal data - **Controllers** — https://overview.legal/topics/controllers Entities that determine purposes and means of processing - **Consent** — https://overview.legal/topics/consent Freely given, specific, informed indication of data subject wishes --- Generated by overview.legal · https://overview.legal/topics/automated-decision-making · 2026-10-13