Amendment 360· Digital Omnibus proposal Recital 38

Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.

Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.