The word automated brings to mind robots, chat bots and all things non-human. Somewhere in the human mind a world where machines are in control of everything does bring to mind a certain element of fear. More so when a machine is in control of all our personal data and there is absolutely no human touch to the decisions being made.
To counter the above, GDPR has put in place Article 22 which gives a right to the data subject to not be part of a decision which is based only on automated processing including profiling.
To refresh our memories, profiling as per Article 4 of the GDPR means “any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;”
This automated processing must affect the legal rights of the individual. However, an exception to this would be that an individual cannot opt out of the automated processing if he/she has entered into a contract with the data controller; has consented to the processing and the data controller is authorised by the Union or Member State law provided that adequate safeguard measures are in place.
Article 22 is significant in an era when processes in an organisation are being streamlined by eliminating human contact and bringing in automation. So significant is the change that the European Union has already proposed an AI law. But till the law comes into force, we have GDPR that tries and brings in some semblance of normalcy in a world where it is possible that just by browsing the internet we are showcased with customised advertisements catered to the careless clicks we make. Some examples of automatic processing would be automatic refusal of an online credit application or e-recruiting practices.
References: