What safeguards does Article 22 require for solely automated decisions?

Answered

You may only take a solely automated decision with legal or similarly significant effects if it is necessary for a contract, authorised by law, or based on explicit consent. Then you must tell people about the processing, give them simple ways to request human intervention or challenge the decision, and run regular checks that the system works as intended. Meaningful human review usually happens after the automated decision and must relate to the actual outcome. If the tool is in ATRS scope, complete the Article 22 field on the record.

From the guidance

Primary (how) ICO: Article 22 of the UK GDPR and fairness

You therefore have to identify if your processing falls under Article 22 and, where it does, make sure that you: give individuals information about the processing; introduce simple ways for them to request human intervention or challenge a decision; and carry out regular checks to make sure your systems are working as intended.

Section: What is the purpose of Article 22?

Read this in ICO: Article 22 of the UK GDPR and fairness (opens in new tab)

Secondary (normative) ICO: Article 22 of the UK GDPR and fairness

You can only carry out this type of decision-making where the decision is: necessary for the entry into or performance of a contract; authorised by law that applies to you; or based on the individual’s explicit consent.

Section: What is the purpose of Article 22?

Read this in ICO: Article 22 of the UK GDPR and fairness (opens in new tab)

Secondary (normative) ICO: Article 22 of the UK GDPR and fairness

In most cases, for human review to be meaningful, human involvement should come after the automated decision has taken place and it must relate to the actual outcome.

Section: When does the human-determined decision take place?

Read this in ICO: Article 22 of the UK GDPR and fairness (opens in new tab)

Secondary (normative) ATRS: Guidance for public sector bodies

You should also be aware of Article 22 UK GDPR which states that ‘The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her’. If your algorithmic tool falls within the scope of these provisions, you must complete this field.

Section: Deployment Context (Tier 2)

Read this in ATRS: Guidance for public sector bodies (opens in new tab)

Related questions