Is that your final decision? Multi-stage profiling, selective effects, and Article 22 of the GDPR

Abstract

Data protection law provides a set of rights and obligations in relation to the processing of personal data. Amongst its substantive principles, such as lawfulness, fairness, transparency, and various procedural elements and risk-based measures that apply to personal data processing, it also addresses the use of automated decision-making systems. Provisions around automated decisions are not new, having been part of the data protection toolbox for several decades. 1 The Data Protection Directive 1995 regulated automated decision-making; 2 however in practice this was largely theoretical and the rights and obligations therein were rarely invoked. However, this previously dormant corner of data protection has begun to awaken in recent years, partly as a result of the rise of automation in the private and public sector, and partly due to new interest, novel concepts, and safeguards in the General Data Protection Regulation (GDPR). 3 Article 22 of the GDPR contains provisions which restrict the use of automated decision making systems where they are 'solely automated' and have 'legal or similarly significant effects'. The exact remedies the provision provides 4 as well as their utility 5 are subject to a debate that this paper does not seek to engage in. Instead, we focus solely on the scope of Article 22. A similarly worded provision exists