Automated Decision-Making Opt-Out

The right applies exclusively to decisions made without any meaningful human intervention. If a human reviewer merely rubber-stamps an algorithmic output without actual assessment, the processing is still considered solely automated. The decision must be executed by technological means—such as a machine-learning model or rule-based logic—with no human discretion in the final outcome. This includes AI-driven profiling that evaluates personal aspects like work performance, economic situation, or health.

The opt-out is triggered only when the automated decision produces a legal effect or similarly significant impact on the individual. Legal effects include actions that alter a person's legal rights or status, such as terminating a contract or denying a statutory benefit. Similarly significant effects encompass outcomes that, while not strictly legal, profoundly affect an individual's circumstances, access to opportunities, or financial standing. Examples include:

• Denial of an online credit application with no human review
• E-recruiting practices that automatically reject candidates
• Behavioral advertising that results in differential pricing

Organizations can lawfully perform automated decision-making only under specific Article 22(2) exceptions under GDPR. These include processing that is:

• Necessary for entering into or performing a contract between the data subject and the controller
• Authorized by Union or Member State law with appropriate safeguards
• Based on the data subject's explicit consent

Even when an exception applies, the controller must implement suitable measures to safeguard the data subject's rights, freedoms, and legitimate interests, including the right to obtain human intervention.

A core safeguard associated with the opt-out right is the ability to obtain human intervention on the part of the controller. This is not merely a symbolic review. The human must have the authority and competence to overturn the automated decision. The individual has the right to express their point of view and contest the decision. The reviewer must evaluate all relevant data, including any additional information provided by the data subject, before making a final determination.

Data subjects have the right to receive meaningful information about the logic involved in the automated decision-making process. This transparency requirement goes beyond a simple notification that profiling occurs. It mandates that controllers explain:

• The rationale and criteria relied upon to reach the decision
• The significance and envisaged consequences of the processing for the individual
• The specific categories of personal data used

This does not necessarily require the disclosure of the full algorithm or trade secrets but must provide sufficient insight to allow the individual to understand and potentially challenge the decision.

Automated decision-making based on special categories of personal data—such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data for unique identification—is subject to heightened restrictions. Processing of such data for solely automated decisions is prohibited unless:

• The data subject has given explicit consent for that specific purpose
• Processing is necessary for reasons of substantial public interest under Union or Member State law

Appropriate safeguards against discrimination and inaccuracies must be demonstrably in place.