Amendment 363· Digital Omnibus proposal Recital 38

Wordingagainst the Commission’s

(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowedprohibited unless when specific conditions are met, as set out in Regulation (EU) 2016/679. The change from a right of the data subject to a general prohibition with exemptions is needed to bring legal clarity. It shoulddoes alsonot alter the material positions of the parties. In particular, the prohibition laid down in this provision does not need to be clarifiedinvoked thatby whena data subject affected by a decision. When assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could theoretically also be taken by a human does not prevent the controller from taking the decision solely by solely automated processing. WhenHowever, when several equally effective automatedmeans for processing solutionsare existavailable to the controller, the controller shouldmust use the lessleast intrusive onemeans, automated or not. The position of a data subject should not be worsened due to the implementation of automated individual decision-making. Therefore, in case of automated decision-making with human involvement, such involvement must be meaningful in order to result in the inapplicability of Article 22 of Regulation (EU) 2016/679. Human involvement without real and factual influence on the decision-making would be insufficient. The same is true for the human involvement a data subject can request in accordance with Article 22(3) Regulation (EU) 2016/679. Similarly, in order to ensure a consistent and high level of protection of natural persons, legal and similarly significantly affects must be interpreted broadly, and include the decision if a certain payment method is offered to a data subject or which price is offered to customers.

Struck CommissionHighlighted amendment