Right not to be subject to solely automated decision-making

The right not to be subject to a decision based solely on automated processing is set out in Art. 22 GDPR: the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. The EDPB (Guidelines WP251) and the Court of Justice (SCHUFA, C-634/21) read the provision as a general prohibition rather than a right to be invoked, so controllers must comply proactively.

The prohibition does not apply where the decision is necessary for entering into or performing a contract, is authorised by Union or Member State law with suitable safeguards, or is based on the data subject's explicit consent (Art. 22(2)). In the first and third cases the controller must at least provide the right to obtain human intervention, to express one's point of view and to contest the decision (Art. 22(3)). Decisions based on special category data such as health data are permitted only with explicit consent or for substantial public interest, with suitable safeguards (Art. 22(4)). Meaningful information about the logic involved and the envisaged consequences must be given under Art. 13(2)(f), 14(2)(g) and 15(1)(h).

Health applications include automated triage or eligibility decisions, insurance underwriting on health data, algorithmic prioritisation of care and fully automated screening of trial candidates. Where a clinician reviews and can overturn the output, the decision is generally not "solely" automated, provided the review is meaningful rather than a rubber stamp. Many of these systems are also high-risk AI systems under the EU AI Act, whose Art. 14 human oversight and Art. 86 right to explanation of individual decisions complement Art. 22 GDPR.