Your rights in relation to automated decision making, including profiling (Article 22 of the GDPR)

You have the right to not be subject to a decision based solely on automated processing. Processing is “automated” where it is carried out without human intervention and where it produces legal effects or significantly affects you.

Automated processing includes profiling.

In respect of personal data, when is automated processing permitted?

Automated processing is permitted only with your express consent, when necessary for the performance of a contract or when authorised by Union or Member State law. Where one of these exceptions applies, suitable measures must be in place to safeguard your rights, freedoms and legitimate interests. This may include the right to obtain human intervention on the controller’s part, the right to present your point of view, and the right to challenge the decision.

In respect of special category personal data (‘sensitive’), when is automated processing permitted?

Where automated processing relates to the special categories of personal data (outlined in the key definitions above), processing is only lawful where you have given your express consent to the processing, or where it is necessary for reasons of substantial public interest.