| name | automated-decision-rights |
| title | Managing Automated Decision-Making and Profiling Rights |
| description | Manages GDPR Article 22 rights related to solely automated decision-making and profiling, including identification of automated decisions, meaningful human oversight implementation, logic explanation requirements, and contestation mechanisms. Activate for automated decision, profiling, Art. 22, algorithmic decision, AI decision queries. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/automated-decision-rights |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Managing Automated Decision-Making and Profiling Rights
Overview
GDPR Article 22 provides data subjects with the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning them or similarly significantly affect them. This skill covers the identification of automated decision-making, implementation of meaningful human intervention, explanation of logic, and contestation procedures.
Legal Foundation
GDPR Article 22 — Automated Individual Decision-Making, Including Profiling
-
Art. 22(1) — The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
-
Art. 22(2) — Exceptions: Art. 22(1) does not apply if the decision:
- (a) is necessary for entering into, or performance of, a contract between the data subject and the controller
- (b) is authorised by Union or Member State law which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests
- (c) is based on the data subject's explicit consent
-
Art. 22(3) — Where exceptions (a) or (c) apply, the controller must implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to:
- Obtain human intervention on the part of the controller
- Express their point of view
- Contest the decision
-
Art. 22(4) — Decisions under Art. 22(2) shall not be based on special categories of data under Art. 9(1) unless Art. 9(2)(a) or (g) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.
Definition of Profiling (Art. 4(4))
"Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.
EDPB Guidelines on Automated Decision-Making and Profiling (WP251 rev.01)
The Article 29 Working Party (now EDPB) Guidelines adopted on 6 February 2018 provide authoritative interpretation, distinguishing:
- Simple profiling: Automated processing to classify individuals (e.g., marketing segmentation) — may not trigger Art. 22 if no legal/significant effect.
