Right not to be subject to a decision based solely on automated processing

The right not to be subject to a decision based solely on automated processing (including profiling), enshrined in Article 22 of the GDPR, guarantees individuals the ability to avoid decisions that have a significant impact on their lives when such decisions are made exclusively by automated systems without any human intervention. This right is particularly relevant in the context of significant decisions about individuals’ rights and freedoms, such as credit risk assessments, employment, loan approvals, and other evaluations based on algorithms.

However, there are some exceptions to this rule: automated processing is permitted if:

1. Necessary for the conclusion or performance of a contract
   Automated processing is necessary to enter into or perform a contract between the data subject and the data controller.
2. Authorized by law
   The processing is authorized by Union or Member State law to which the data controller is subject and includes appropriate measures to protect the rights, freedoms, and legitimate interests of the data subject.
3. Explicit consent of the data subject
   The data subject has given explicit consent to the automated processing.

In all cases, the GDPR requires that appropriate measures be taken to protect the rights, freedoms, and interests of the data subjects. These measures include the right for the individual to obtain human intervention, express their point of view, and contest the decision.

Practical examples of automated decision-making

• Loan denial: An automated system evaluates a customer’s loan application and decides to deny it without any human intervention.
• Algorithm-Based Hiring: An algorithm selects candidates for a job based on predefined criteria, without any human involvement in the decision-making process.

Trust Guardian’s approach to the right not to be subject to a decision based solely on automated processing
Through Trust Guardian myPrivacy platform, individuals can exercise their privacy rights, including requesting information about automated decisions affecting them, seeking human intervention, or contesting a decision.