Automated individual decision-making
Automated individual decision-making refers to a decision based solely on automated processing, including profiling, which produces legal effects concerning a natural person or similarly significantly affects them. Under Art. 22 GDPR, data subjects have the right not to be subject to such a decision, unless it is necessary for a contract, authorised by Union or Member State law, or based on explicit consent.
Where an exception applies, the controller must implement suitable safeguards, at minimum the right to obtain human intervention, to express one's point of view and to contest the decision. Decisions based on special category data such as health data are only allowed with explicit consent or for reasons of substantial public interest, with suitable safeguards. The Court of Justice (SCHUFA, C-634/21) has confirmed that producing a score that a third party relies on decisively is itself a "decision".
In healthcare and clinical research, examples include algorithmic triage, automated eligibility screening for trials or fully automated insurance and reimbursement decisions. Clinical decision support systems where a clinician makes the final call are generally not "solely" automated, but they may still be high-risk AI systems under the EU AI Act, which adds transparency and human oversight requirements.
