Automated decision (article 22 of the GDPR)

A fully automated decision is a decision taken without effective human involvement. Article 22 of the GDPR governs it: a person has the right not to be subject to such a decision producing legal effects concerning them or significantly affecting them, unless it is necessary for a contract, authorised by law, or based on their explicit consent. In those cases, safeguards apply: obtaining human intervention, expressing one's point of view and contesting the decision. A credit refusal is the textbook example. The point often misunderstood is that human review only counts if it is real: a person who signs off on a score without the authority or the expertise to question it does not take the decision outside the scope of article 22.