Meaningful Human Review and Decision-Making

Legal Framework

The right to meaningful human review is anchored in Article 22 GDPR, which prohibits decisions based solely on automated processing — including profiling — that produce legal or similarly significant effects for data subjects. Where exceptions apply under Article 22(2), the controller must implement protective measures. Article 22(3) specifies the minimum content of those measures:

"ten minste het recht op menselijke tussenkomst van de verwerkingsverantwoordelijke, het recht om zijn standpunt kenbaar te maken en het recht om het besluit aan te vechten"
— GDPR Art. 22(3)

The Dutch implementation act reinforces this through Article 40 UAVG, which provides that where automated decision-making is necessary to comply with a legal obligation or to perform a task in the public interest, the controller must safeguard the rights and freedoms of the data subject. For non-governmental controllers, the protective measures are deemed adequate only when three specific rights are guaranteed:

"het recht op menselijke tussenkomst, het recht voor betrokkene om zijn standpunt kenbaar te maken en het recht om het besluit aan te vechten, zijn geborgd"
— UAVG Art. 40(3)

Recital 71 GDPR illustrates the scope with concrete examples, referencing the automatic refusal of online credit applications or e-recruitment processing without human intervention. The AI Act Recital 12 further contextualises the technological backdrop, noting that AI systems possess inference capabilities that distinguish them from simpler rule-based software — meaning human oversight must account for systems that generate predictions and decisions through learned models rather than predetermined rules.

Key Developments

The EDPB has addressed human intervention in the context of AI training and virtual voice assistants, emphasising that human involvement is not merely a procedural formality but a substantive requirement during algorithm development:

"bij het leren en trainen van kunstmatige-intelligentiesystemen is menselijke tussenkomst noodzakelijk"
— EDPB Guidelines 02/2021 §23

This guidance signals that meaningful human review extends beyond the moment of decision-making to encompass the design and training phases of automated systems. The EDPB's guidance on international data transfers similarly requires that receiving public authorities must not take decisions solely based on automated processing without appropriate safeguards.

At the enforcement level, the Hamburg DPA imposed a €492,000 fine on a financial-sector company for insufficient safeguards in automated decision-making, demonstrating that supervisory authorities treat the absence of genuine human review as a serious infringement rather than a technicality.

Status of the Debate

This topic is actively litigated. Courts and supervisory authorities continue to rule on the boundaries of meaningful human intervention, but the doctrinal line has not settled. The core unresolved question is what constitutes meaningful human review as opposed to rubber-stamping. The GDPR and UAVG establish the right to human intervention but do not define the qualitative threshold — whether the human reviewer must have the authority and competence to override the automated decision, whether they must genuinely reassess the underlying data, and how much time and information suffices. A ruling from a national court or the CJEU that articulates a concrete standard for the depth and independence of human review would resolve the open question. Until then, controllers face uncertainty about whether their human-in-the-loop processes meet the threshold.

Practical Guidance

• Ensure the human reviewer has override authority. Article 22(3) GDPR and Article 40(3) UAVG require not just human involvement but the right to contest the decision — meaning the reviewer must possess genuine decision-making power, not merely advisory capacity.

• Provide the reviewer with substantive context. A human who approves an automated decision without understanding the input data, the model's logic, and the factors driving the output does not constitute meaningful intervention. Document what information is provided to reviewers.

• Guarantee the data subject's right to be heard. Both Article 22(3) GDPR and Article 40(3) UAVG explicitly require the right to express one's viewpoint. Build a mechanism that allows data subjects to submit input before a final automated decision is rendered.

• Distinguish between design-phase and decision-phase oversight. EDPB guidance confirms that human intervention is necessary during AI training and not only at the point of individual decisions. Maintain oversight documentation across both phases.

• Do not rely on consent alone. Where Article 22(2)(c) GDPR applies (explicit consent), the protective measures under Article 22(3) remain mandatory — consent does not displace the right to human intervention, to be heard, and to contest.