Amendment 362· Digital Omnibus proposal Recital 38

Wordingagainst the Commission’s

(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing.Article 22 of Regulation (EU) 2016/679 provides an important safeguard against automated individual decision-making, including profiling, which produces legal effects concerning a data subject or similarly significantly affects them. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679.In order to preserve the effectiveness of that safeguard, the necessity ground in Article 22(2), point (a), should be interpreted strictly. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.A decision should not be considered necessary for entering into, or performance of, a contract merely because it is useful, efficient, economically advantageous, scalable, faster, more consistent, part of the controller’s business model, or capable of reducing costs. Commercial convenience, service optimisation, fraud prevention at scale, profiling, risk scoring, behavioural prediction or personalised pricing should not, in themselves, constitute necessity. Where automated processing determines or materially determines the outcome of a decision, Article 22 should apply even where a human formally validates, confirms, implements or communicates the outcome. Human involvement should not be used to circumvent Article 22 where it does not include a genuine assessment of the individual case and the authority to change the outcome. Human intervention should be meaningful and carried out by a person with adequate competence, time, information, resources and authority to assess the individual case and modify, reverse or otherwise change the decision. Data subjects should receive meaningful information about the main reasons for the decision, including the main categories of personal data relied upon, the use of profiling or inferred data, the key parameters, factors or criteria that materially influenced the decision, and, where relevant, their relative importance. Such information should be sufficiently specific to allow the data subject to understand why the decision was taken in their individual case and to exercise their rights effectively. Trade secrets, intellectual property or security considerations should not be used to refuse information that is necessary to understand the main reasons for the decision, without prejudice to proportionate measures to protect confidential information. Where a controller relies on contractual necessity under Article 22(2), point (a), the controller should assess whether the same specific contractual purpose can reasonably be achieved through less intrusive means, including human-led, human-reviewed or non-automated alternatives. Where Article 35 applies, that assessment should form part of the data protection impact assessment. The existence of a data protection impact assessment should not, in itself, demonstrate that a decision is necessary within the meaning of Article 22(2), point (a).’

Struck CommissionHighlighted amendment