Article 22: the automated-decision rule

Lesson 3 of 6 in Privacy and Data Protection Law for AI: GDPR from Scratch.

One article of the GDPR was written almost as if its drafters saw the AI decade coming. Article 22 is the closest thing European law had to an AI statute before the AI Act — and unlike the AI Act’s high-risk regime, it has been enforceable since 2018.

Every phrase has been litigated, so take them one at a time.

"Based solely on automated processing" — no meaningful human involvement. A human who genuinely weighs the recommendation and can overrule it takes the decision outside Article 22; a human who clicks approve on everything does not. Regulators look at authority, competence, and actual behaviour — the same rubber-stamp test you met in Foundations. The Amsterdam courts applied exactly this lens to Uber’s "robo-firing" of drivers, holding that fraud-triggered deactivations reviewed by employees who could not realistically deviate were solely automated.

"Legal effects or similarly significant" — contract termination, benefit denial, credit refusal, e-recruiting rejection without human review. Trivial personalisation is out; decisions shaping livelihoods are in.

The structure: Article 22(1) is read as a prohibition, not a mere opt-out right. Solely automated significant decisions are barred unless one of three exceptions in Article 22(2) applies — the decision is necessary for a contract, authorised by Union or Member State law, or based on explicit consent. Even inside an exception, Article 22(3) demands safeguards: at minimum the right to obtain human intervention, to express one’s point of view, and to contest the decision. And if the decision leans on special-category data, Article 22(4) narrows the options further.

Alongside the safeguards ride the transparency rights: Articles 13–15 require controllers to disclose the existence of automated decision-making and provide meaningful information about the logic involved and the significance and envisaged consequences. This is the textual root of the European right to explanation debate — and in 2025 the CJEU gave it teeth in Dun & Bradstreet Austria (C-203/22): a controller must explain the procedure and principles actually applied in a concise, intelligible way, and cannot wave "trade secret" as a blanket refusal — contested secrets go to the court or authority for balancing, not into a black hole.

Key terms: GDPR Article 22, profiling, right to explanation (Art 86), human-in-the-loop, automation bias

Interactive checkpoint quiz (1 questions) — open this page in a browser to take it.