Binding law — in force
No solely-automated significant decision without human-intervention safeguards (GDPR Art. 22)
Under GDPR Art. 22, a data subject has the right not to be subject to a decision based SOLELY on automated processing (including profiling) that produces legal effects or similarly significantly affects them (e.g. credit, lending, insurance, employment screening). Such decisions are permitted only on a lawful basis (contract necessity, Union/Member-State law, or explicit consent) AND with safeguards: at minimum the right to obtain human intervention, to express a view, and to contest the decision. Controllers must also disclose the existence of ADM and meaningful information about the logic. SCHUFA (C-634/21) confirms a token human rubber-stamp doesn't exit Art. 22. Detect a consequential decision path executed solely by an automated model with no human-intervention/contest affordance.
eu-gdpr-art22.solely-automated-decision-safeguards · GDPR Article 22(1) · official source · jurisdictions: EU