Solely Automated Decision

The defining characteristic is the complete exclusion of human judgment from the final decision loop. A human merely rubber-stamping an algorithmic output does not constitute meaningful intervention.

• Competence Requirement: The human reviewer must have the authority and competence to override the decision.
• Substantive Review: The intervention must be a genuine assessment of all relevant data, not just a procedural check.
• Contrast: A loan officer who actively reviews an AI's credit score recommendation and can adjust the rate is not a solely automated decision.

The decision must produce a binding consequence that significantly impacts the data subject's life. Trivial automations are not covered.

• Legal Effects: Decisions that affect a person's legal rights, such as contract termination or eligibility for social benefits.
• Similarly Significant Effects: Actions that have a comparable impact, including automatic denial of credit, e-recruiting without human review, or differential pricing that excludes individuals.
• Exclusion: Automated spam filtering or minor ad personalization typically does not meet this threshold.

The decision path from input data to final output must be entirely deterministic and unaided by human cognition at any stage of the final execution.

• End-to-End Automation: The system autonomously ingests personal data, applies a model, and outputs a binding decision.
• No Human Bottleneck: There is no step in the workflow where a human pauses the process to evaluate the logic before the effect is applied to the data subject.
• Profiling Link: This often involves profiling—automated processing to evaluate personal aspects like work performance, economic situation, or health.

For a solely automated decision to be lawful, it must fall under one of three narrow exceptions defined in GDPR Article 22(2).

• Explicit Consent: The data subject has given unambiguous, specific consent to the automated processing.
• Contractual Necessity: The decision is necessary for entering into or performing a contract between the data subject and the controller.
• Member State Law: The decision is authorized by Union or Member State law with suitable safeguards.
• Safeguard Overlay: Even when lawful, the controller must implement human intervention rights, data subject viewpoint expression, and contestability mechanisms.

The bar for lawful solely automated decision-making is raised significantly when sensitive personal data is involved.

• General Ban: GDPR Article 22(4) prohibits solely automated decisions based on special categories of personal data (e.g., health, ethnicity, political opinion).
• Narrow Derogations: The only exceptions are explicit consent or processing for substantial public interest, both requiring suitable measures to safeguard fundamental rights.
• Zero Tolerance: Unlike general data, contractual necessity is not a valid legal basis for automating decisions using sensitive data.

A procedural safeguard that must be architected into the system, not bolted on after the fact. It is the data subject's right to obtain human intervention on the part of the controller.

• Proactive Obligation: The controller must provide a simple, accessible mechanism for the user to express their point of view and contest the decision.
• Timeliness: The human review must occur within a reasonable timeframe to prevent the automated decision from causing irreversible harm.
• Technical Implementation: This requires a contestability mechanism in the user interface, not just a generic customer service email.

The critical safeguard that distinguishes a solely automated decision from a supported one. Under GDPR, this requires a review by a qualified person with the authority and competence to override the algorithmic outcome. The intervention must be more than a token gesture—the human must actively assess all relevant data, not merely rubber-stamp the machine's output. Without this, the decision falls under Article 22 and triggers opt-out rights.

A data subject's legal entitlement under GDPR Article 22(3) and Recital 71 to receive meaningful information about the logic involved in an automated decision. This goes beyond mere transparency—it requires disclosing:

• The reasoning process behind the specific decision
• The significance and envisaged consequences
• The key features that influenced the outcome This right is the procedural counterweight to the opacity of black-box algorithms.

A technical and procedural interface that allows end-users to formally challenge an AI-driven decision and seek human review or remedy. Effective contestability requires:

• A clear channel for lodging disputes
• Access to a human reviewer with override authority
• Timely resolution timelines
• The ability to submit additional evidence Without this mechanism, a solely automated decision system violates the principle of procedural fairness.

A mandatory GDPR Article 35 process for identifying and minimizing data protection risks before processing begins. For solely automated decision systems, the DPIA must specifically address:

• The logic of the algorithm and its accuracy
• The scope of automated decisions and their effects
• Safeguards for data subject rights
• Fallback procedures if the system fails Failure to conduct a DPIA for high-risk automated processing can result in fines up to €10 million or 2% of global turnover.

A structured evaluation framework that predates and complements the DPIA, focusing on the societal and ethical consequences of automated decision systems. Unlike the DPIA's privacy focus, the AIA examines:

• Disparate impact on vulnerable populations
• Fairness metrics across demographic groups
• Transparency of the decision logic
• Accountability chains for adverse outcomes This is increasingly mandated by regulations like Canada's Directive on Automated Decision-Making and the EU AI Act.

A chronological, immutable record of all inputs, transformations, and outputs in an automated decision pipeline. For solely automated decisions, the audit trail must capture:

• The exact input data at decision time
• The model version and configuration
• The inference path and intermediate states
• The final output and confidence scores This record is essential for demonstrating compliance during regulatory investigations and enabling the right to explanation.