Amendment 368· Digital Omnibus proposal Recital 38

Wordingagainst the Commission’s

(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing.Legal effects and similarly significant effects on the data subject should be interpreted broadly, and include decisions such as payment methods offered to a data subject and prices shown to a data subject when visiting an online retailer. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed only when specific conditions are met, as set out in Regulation (EU) 2016/679 and this Regulation. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. In any case, such processing should be subject to suitable safeguards, which should include specific information to the data subject and the right to obtain meaningful human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision. Meaningful human intervention includes that the reviewer should be able to review the accuracy of the data and logic involved in the decision and the consequences of the decision, not merely the output. In other words, the reviewer should be able to review the facts, circumstances and reasons for such decisions. The human reviewer should be provided with appropriate training, have the relevant competence and skills and be empowered to revoke, amend and override the decision. The controller should provide an answer to the request to obtain a meaningful human intervention as fast as possible.

Struck CommissionHighlighted amendment