Table of Contents
Article 22 of GDPR: Automated decision-making
Article 22 of GDPR establishes the right to individuals and prohibition to companies not to process personal data strictly on the basis of automated processes that may include profiling.
The objective of this article is to provide some guarantees to individuals and data subjects that companies will consider their personal aspects before making decisions that may affect their legal rights.
Right not to be subject to automated decision-making (Article 22(1) GDPR)
The first paragraph of Article 22 makes it clear: individuals have the right not to be subject to automated decision-making processes in such a way that their legal rights can be significantly affected or produce legal effects against the person.
This decision making specifically includes any commercial or business activity that consists of creating a profile on a person, or profiling.
Exception to the right (Article 22(2) GDPR)
There are three cases where GDPR makes an exception to the right not to be subjected to automated decision-making:
- When the automated process is necessary to enter into a contract or perform the obligations of a contract with a person (Article 22(2)(a) GDPR)
- When it is specifically authorized by an EU member country and where suitable protections are in place (Article 22(2)(b) GDPR)
- When a person has explicitly agreed and consented to such processing (Article 22(2)(c) GDPR
Right to obtain human intervention (Article 22(3) GDPR)
When personal data is processed based on automated decision-making processes in accordance with Article 22(2), companies must:
- Implement proper measures to protect the person’s information
- Give the right to individuals to obtain human intervention to share their point of view or contest an automatic decision that was made
Processing of a special category of personal data (Article 22(4) GDPR)
Companies are not authorized to automatically process personal data that falls under the special category of personal data under Article 9(1) of GDPR, such as:
- Racial data
- Ethnic origin
- Political opinions
- Religious beliefs
- Philosophical beliefs
- Trade union membership
- Genetic data
- Biometric data for identifying a person
- Health data
- Data on a person’s sex life
- Data on a person’s sexual orientation
The only exception is when any of the following conditions apply and the company has implemented security measures to protect the personal data:
- The data subject has given explicit consent
- When it’s necessary for the public interest
Recitals applicable to Article 22 of GDPR
Relevant Recitals: 71, 72, 92
GDPR Regulation article-by-article overview
Read our comprehensive overview of the GDPR Regulation, article by article, where we summarize each of the 99 articles contained in GDPR to give you a complete understanding of its content.
Cited Legislation in Article 22 or relevant recitals
None
GDPR Text: Article 22 of GDPR and Relevant Recitals
GDPR Text Source: EUR-Lex
Official GDPR Text: General Data Protection Regulation
Official GDPR Title: REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), corrected by Corrigendum, OJL 127, 23.5.2018, p. 2 ((EU) 2016/679)
