Digital Omnibus proposal
Recital 38
Compare the available Commission, Council and Parliament texts and amendments affecting this recital.
Recital total: 1 part · 4 Council drafts · 18 Parliament amendments
Removed wording is struck through; added or replacement wording is highlighted.
Institutional text
European Commission proposal
The wording proposed by the Commission at the start of this legislative file.
No standalone Commission wording is mapped to this tracked part. A newly proposed provision may have no earlier text of its own.
Commission source wording and instructions
Recital 38
Commission proposal
Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Institutional text
Council Presidency texts
Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.
No Council wording is mapped to this tracked part.
Recital 38
May Presidency compromise
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Recital 38
June Presidency compromise · 10 June
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Recital 38
June Presidency compromise · 18 June
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Recital 38
September Presidency compromise
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Recital 38 4 Council drafts
Recital 38
21 May 2026 · May Presidency compromise
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Recital 38
10 June 2026 · June Presidency compromise · 10 June
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Recital 38
18 June 2026 · June Presidency compromise · 18 June
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Recital 38
3 September 2026 · September Presidency compromise
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Competing proposals
European Parliament amendments
These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.
More filters
Political group at the amendment date where available; otherwise the current Parliament affiliation.
Alternative wording Amendment 6 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)
(38) Article 22 of Regulation (EU) 2016/679 provides forthat data subjects have the right not to be subject to a decision based solely on automated processing, except where specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisionswhen assessing whether a decision based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. WhenHowever, when several equally effective automated processing solutions exist, the controller should use the less intrusive one. The data subject’s rights should not be negatively impacted by the implementation of automated individual decision-making. Human involvement with regard to automated decision-making should be meaningful, and a mere symbolic gesture by a human of viewing the decision made without having a real and factual influence on the decision-making should not be categorised as human involvement.
Remove proposed wording Amendment 128 · Arash Saeidi JURI
Alternative wording Amendment 129 · Emil Radev JURI
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge comparable to trade secret.
Alternative wording Amendment 173 · Sophia Kircher IMCO
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge.
Remove proposed wording Amendment 360 · Pernando Barrena Arza ITRE · LIBE
Remove proposed wording Amendment 361 · Birgit Sippel ITRE · LIBE
Alternative wording Amendment 362 · Pernando Barrena Arza ITRE · LIBE
(38) Article 22 of Regulation (EU) 2016/679 provides foran rulesimportant governingsafeguard theagainst processingautomated ofindividual personaldecision-making, dataincluding when the data controller makes decisionsprofiling, which haveproduces legal effects concerning a data subject or similarly significantsignificantly effectsaffects on the data subject, based solely on automated processingthem. In order to providepreserve greaterthe legaleffectiveness certaintyof that safeguard, itthe necessity ground in Article 22(2), point (a), should be clarifiedinterpreted that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679strictly. ItA decision should alsonot be clarified that when assessing whether a decision isconsidered necessary for entering into, or performance of, a contract betweenmerely because it is useful, efficient, economically advantageous, scalable, faster, more consistent, part of the controller’s business model, or capable of reducing costs. Commercial convenience, service optimisation, fraud prevention at scale, profiling, risk scoring, behavioural prediction or personalised pricing should not, in themselves, constitute necessity.
Where automated processing determines or materially determines the outcome of a decision, Article 22 should apply even where a human formally validates, confirms, implements or communicates the outcome. Human involvement should not be used to circumvent Article 22 where it does not include a genuine assessment of the individual case and the authority to change the outcome. Human intervention should be meaningful and carried out by a person with adequate competence, time, information, resources and authority to assess the individual case and modify, reverse or otherwise change the decision.
Data subjects should receive meaningful information about the main reasons for the decision, including the main categories of personal data relied upon, the use of profiling or inferred data, the key parameters, factors or criteria that materially influenced the decision, and, where relevant, their relative importance. Such information should be sufficiently specific to allow the data subject to understand why the decision was taken in their individual case and to exercise their rights effectively. Trade secrets, intellectual property or security considerations should not be used to refuse information that is necessary to understand the main reasons for the decision, without prejudice to proportionate measures to protect confidential information.
Where a datacontroller controller,relies ason setcontractual outnecessity inunder Article 22(2), point (a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should useassess whether the same specific contractual purpose can reasonably be achieved through less intrusive onemeans, including human-led, human-reviewed or non-automated alternatives. Where Article 35 applies, that assessment should form part of the data protection impact assessment. The existence of a data protection impact assessment should not, in itself, demonstrate that a decision is necessary within the meaning of Article 22(2), point (a).’
Alternative wording Amendment 363 · Alex Agius Saliba ITRE · LIBE
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowedprohibited unless when specific conditions are met, as set out in Regulation (EU) 2016/679. The change from a right of the data subject to a general prohibition with exemptions is needed to bring legal clarity. It shoulddoes alsonot alter the material positions of the parties. In particular, the prohibition laid down in this provision does not need to be clarifiedinvoked thatby whena data subject affected by a decision. When assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could theoretically also be taken by a human does not prevent the controller from taking the decision solely by solely automated processing. WhenHowever, when several equally effective automatedmeans for processing solutionsare existavailable to the controller, the controller shouldmust use the lessleast intrusive onemeans, automated or not. The position of a data subject should not be worsened due to the implementation of automated individual decision-making. Therefore, in case of automated decision-making with human involvement, such involvement must be meaningful in order to result in the inapplicability of Article 22 of Regulation (EU) 2016/679. Human involvement without real and factual influence on the decision-making would be insufficient. The same is true for the human involvement a data subject can request in accordance with Article 22(3) Regulation (EU) 2016/679. Similarly, in order to ensure a consistent and high level of protection of natural persons, legal and similarly significantly affects must be interpreted broadly, and include the decision if a certain payment method is offered to a data subject or which price is offered to customers.
Alternative wording Amendment 364 · Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller ITRE · LIBE
(38) Automated procedures can significantly benefit the digital economy by streamlining routine operations such as Know-Your-Customer (KYC) verifications or fraud preventions. However, when deployed for a higher risk evaluations producing legal or similarly significant effects, such as automated hiring, the termination of contracts or online accounts, profiling or creditworthiness decision, they entail heightened risks to individual rights. Article 22 of Regulation (EU) 2016/679 provides forthat the data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should therefore be clarified that decisions based solely on automated processing are allowedgenerally when specific conditions are metprohibited, as set out in Regulation (EU) 2016/679. It should also be clarifiedand that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, itautomated processing is permitted only if no other equally effective and less privacy-intrusive means are available to fulfil the core objective of the contractual service explicitly requested by the data subject. Moreover, to prevent a gap in legal protection, the concept of a decision should notextend be required that the decision could be taken only by solelyto automated processing. Thisor meansprofiling operations that thegenerate factan thatassessment theor decisionvalue couldupon also be taken bywhich a human does not prevent thesubsequent controller fromstrongly takingrelies theas decisiona bydetermining solelyfactor automatedin processingits decision-making. When several equally effective automated processing solutions exist, the controller should use the lessleast intrusive one, guaranteeing in all cases the data subject's right to obtain human intervention, express their point of view, and contest the automated outcome, while utilizing appropriate procedures to minimize error risks.
Alternative wording Amendment 365 · Dario Nardella ITRE · LIBE
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. For the purposes of illustration, decisions which produce legal effects concerning the data subject, or similarly significantly affecting the data subject, within the meaning of Article 22, include creditworthiness assessment systems applied to undertakings in the agricultural sector, algorithmic systems for determining premiums for agricultural insurance policies, including parametric insurance policies, automated systems for processing applications for payments under the common agricultural policy, and automated pricing decisions applied by platforms acting as intermediaries in, or selling, agricultural production inputs. In proceedings involving decisions of that nature, the data subject’s right to obtain human intervention pursuant to Article 22(3) shall include the right to obtain a comprehensible explanation of the factors determining the outcome and the right to have the decision reviewed by a person possessing technical expertise relevant to the agricultural sector.
Justification
La casistica applicativa dell'articolo 22 del regolamento (UE) 2016/679 e la prassi dello European Data Protection Board si sono concentrate prevalentemente su altri settori (bancario in senso stretto, sanitario, sicurezza pubblica), con conseguente rischio di marginalizzazione interpretativa del settore agricolo. L'emendamento introduce un ancoraggio settoriale nel considerando, senza modificare il dispositivo dell'articolo, ed è coerente con l'emendamento 53 del Draft Report ITRE-LIBE, che qualifica come «significativo» l'intervento umano richiesto ai sensi del paragrafo 3.
Alternative wording Amendment 366 · Francesco Torselli, Paolo Inselvini ITRE · LIBE
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. For the purposes of illustration, decisions which produce legal effects concerning the data subject, or similarly significantly affecting the data subject, within the meaning of Article 22, include creditworthiness assessment systems applied to undertakings in the agricultural sector, algorithmic systems for determining premiums for agricultural insurance policies, including parametric insurance policies, automated systems for processing applications for payments under the common agricultural policy, and automated pricing decisions applied by platforms acting as intermediaries in, or selling, agricultural production inputs. In proceedings involving decisions of that nature, the data subject’s right to obtain human intervention pursuant to Article 22(3) shall include the right to obtain a comprehensible explanation of the factors determining the outcome and the right to have the decision reviewed by a person possessing technical expertise relevant to the agricultural sector.
Alternative wording Amendment 367 · Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec ITRE · LIBE
(38) Article 22 of Regulation (EU) 2016/679 provides forthat data subjects have the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisionswhen assessing whether a decision based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. WhenHowever, when several equally effective automated processing solutions exist, the controller should use the less intrusive one. The data subject’s rights should not suffer due to the implementation of automated individual decision-making. Human involvement with regard to automated decision-making should be meaningful, and a mere symbolic gesture of viewing the decision made by a human without real and factual influence on the decision-making should not be categorised as human involvement. In order to ensure a consistent and high level of protection of natural persons, legal effects and similarly significant effects on the data subject should be interpreted broadly, and include decisions such as payment methods offered to a data subject and prices shown to a data subject when visiting an online retailer.
Alternative wording Amendment 368 · Markéta Gregorová on behalf of the Verts/ALE Group ITRE · LIBE
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. Legal effects and similarly significant effects on the data subject should be interpreted broadly, and include decisions such as payment methods offered to a data subject and prices shown to a data subject when visiting an online retailer. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed only when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) ofthis Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. In any case, such processing should be subject to suitable safeguards, which should include specific information to the data subject and the right to obtain meaningful human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision. Meaningful human intervention includes that the reviewer should be able to review the accuracy of the data and logic involved in the decision and the consequences of the decision, not merely the output. In other words, the reviewer should be able to review the facts, circumstances and reasons for such decisions. The human reviewer should be provided with appropriate training, have the relevant competence and skills and be empowered to revoke, amend and override the decision. The controller should provide an answer to the request to obtain a meaningful human intervention as fast as possible.
Alternative wording Amendment 369 · Aura Salla, Niels Flemming Hansen, Ana Miguel Pedro, Henrik Dahl, Andrea Wechsler, Oliver Schenk, Christian Ehler ITRE · LIBE
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge.
Alternative wording Amendment 370 · Sebastian Tynkkynen, Diego Solier ITRE · LIBE
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions considering the data intensiveness and risk associated with the processing are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one, when it does not result in a significant additional administrative burden for the controller.
Alternative wording Amendment 371 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay ITRE · LIBE
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. InArticle order22(1) confers on the data subject the right not to provide greater legal certainty, it should be clarifiedsubject thatto decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whethersuch a decision. That right is necessarya prohibition of principle, subject to the limited exceptions laid down in Article 22(2), and not an authorisation subject to conditions. Where the controller relies on the necessity of the decision for entering into, or the performance of, a contract, betweenthat necessity shall be interpreted strictly. A decision is not necessary within the data subject and a data controller, as set out in Article 22(2)(a)meaning of Regulationthat (EU)provision 2016/679,where itthe shouldpurpose notpursued can reasonably be requiredachieved by means involving human intervention. The availability of an equally effective non-automated alternative excludes reliance on that the decision could be taken only by solely automated processingexception. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The safeguards laid down in Article 22(3), and in particular the right to obtain human intervention, to express one's point of view and to contest the decision, apply in full.
Alternative wording Amendment 372 · Diana Iovanovici Şoşoacă ITRE · LIBE
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one and ensure that the data are protected in accordance with current legislation.
Alternative wording Amendment 373 · João Oliveira ITRE · LIBE
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, itIt should be clarified that decisions based solely on automated processing are not allowed whenunless specific conditions are met, as set out in Regulation (EU) 2016/679. A decision based solely on automated processing should only be deemed necessary if no equally effective and less intrusive means are available to the data controller. Data subjects should retain the fundamental right not to have to be subjected to decisions of this kind and to be able to request that those decisions be made on the basis of significant human intervention. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
No amendments match these filters.
Selected texts
Compare wording
Choose a tracked part and a named pair of texts. Comparisons are offered only where both sides cover the same legal unit.
Select a specific tracked part above to compare wording.
No same-scope comparison is available for this tracked part. Its source wording remains available in the article text sections.
Recital 38
European Commission proposal → Council Presidency text · ST 9547/26
Changes in context
Article 22 of Regulation (EU) 2016/679 provides forthat data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisionswhen assessing whether a decision based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that theThe fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
RemovedAdded
Both texts in full
European Commission proposal
Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Council Presidency text · ST 9547/26
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Recital 38
Council Presidency text · ST 9547/26 → Council Presidency text · ST 10426/26
Changes in context
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
RemovedAdded
Both texts in full
Council Presidency text · ST 9547/26
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Council Presidency text · ST 10426/26
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Recital 38
Council Presidency text · ST 10426/26 → Council Presidency text · ST 10677/26
Changes in context
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
RemovedAdded
Both texts in full
Council Presidency text · ST 10426/26
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Council Presidency text · ST 10677/26
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Recital 38
Council Presidency text · ST 10677/26 → Council Presidency text · ST 12535/26
Changes in context
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
RemovedAdded
Both texts in full
Council Presidency text · ST 10677/26
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Council Presidency text · ST 12535/26
Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Recital 38
Wording reproduced in the amendment → Amendment 360 · ITRE–LIBE amendments 251–400 to the draft report: removal
Changes in context
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 360 · ITRE–LIBE amendments 251–400 to the draft report: removal
This wording is removed.
Recital 38
Wording reproduced in the amendment → Amendment 361 · ITRE–LIBE amendments 251–400 to the draft report: removal
Changes in context
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 361 · ITRE–LIBE amendments 251–400 to the draft report: removal
This wording is removed.
Recital 38
Wording reproduced in the amendment → Amendment 362 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides foran rulesimportant governingsafeguard theagainst processingautomated ofindividual personaldecision-making, dataincluding when the data controller makes decisionsprofiling, which haveproduces legal effects concerning a data subject or similarly significantsignificantly effectsaffects on the data subject, based solely on automated processingthem. In order to providepreserve greaterthe legaleffectiveness certaintyof that safeguard, itthe necessity ground in Article 22(2), point (a), should be clarifiedinterpreted that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679strictly. ItA decision should alsonot be clarified that when assessing whether a decision isconsidered necessary for entering into, or performance of, a contract betweenmerely because it is useful, efficient, economically advantageous, scalable, faster, more consistent, part of the controller’s business model, or capable of reducing costs. Commercial convenience, service optimisation, fraud prevention at scale, profiling, risk scoring, behavioural prediction or personalised pricing should not, in themselves, constitute necessity.
Where automated processing determines or materially determines the outcome of a decision, Article 22 should apply even where a human formally validates, confirms, implements or communicates the outcome. Human involvement should not be used to circumvent Article 22 where it does not include a genuine assessment of the individual case and the authority to change the outcome. Human intervention should be meaningful and carried out by a person with adequate competence, time, information, resources and authority to assess the individual case and modify, reverse or otherwise change the decision.
Data subjects should receive meaningful information about the main reasons for the decision, including the main categories of personal data relied upon, the use of profiling or inferred data, the key parameters, factors or criteria that materially influenced the decision, and, where relevant, their relative importance. Such information should be sufficiently specific to allow the data subject to understand why the decision was taken in their individual case and to exercise their rights effectively. Trade secrets, intellectual property or security considerations should not be used to refuse information that is necessary to understand the main reasons for the decision, without prejudice to proportionate measures to protect confidential information.
Where a datacontroller controller,relies ason setcontractual outnecessity inunder Article 22(2), point (a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should useassess whether the same specific contractual purpose can reasonably be achieved through less intrusive onemeans, including human-led, human-reviewed or non-automated alternatives. Where Article 35 applies, that assessment should form part of the data protection impact assessment. The existence of a data protection impact assessment should not, in itself, demonstrate that a decision is necessary within the meaning of Article 22(2), point (a).’
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 362 · ITRE–LIBE amendments 251–400 to the draft report
(38) Article 22 of Regulation (EU) 2016/679 provides an important safeguard against automated individual decision-making, including profiling, which produces legal effects concerning a data subject or similarly significantly affects them. In order to preserve the effectiveness of that safeguard, the necessity ground in Article 22(2), point (a), should be interpreted strictly. A decision should not be considered necessary for entering into, or performance of, a contract merely because it is useful, efficient, economically advantageous, scalable, faster, more consistent, part of the controller’s business model, or capable of reducing costs. Commercial convenience, service optimisation, fraud prevention at scale, profiling, risk scoring, behavioural prediction or personalised pricing should not, in themselves, constitute necessity.
Where automated processing determines or materially determines the outcome of a decision, Article 22 should apply even where a human formally validates, confirms, implements or communicates the outcome. Human involvement should not be used to circumvent Article 22 where it does not include a genuine assessment of the individual case and the authority to change the outcome. Human intervention should be meaningful and carried out by a person with adequate competence, time, information, resources and authority to assess the individual case and modify, reverse or otherwise change the decision.
Data subjects should receive meaningful information about the main reasons for the decision, including the main categories of personal data relied upon, the use of profiling or inferred data, the key parameters, factors or criteria that materially influenced the decision, and, where relevant, their relative importance. Such information should be sufficiently specific to allow the data subject to understand why the decision was taken in their individual case and to exercise their rights effectively. Trade secrets, intellectual property or security considerations should not be used to refuse information that is necessary to understand the main reasons for the decision, without prejudice to proportionate measures to protect confidential information.
Where a controller relies on contractual necessity under Article 22(2), point (a), the controller should assess whether the same specific contractual purpose can reasonably be achieved through less intrusive means, including human-led, human-reviewed or non-automated alternatives. Where Article 35 applies, that assessment should form part of the data protection impact assessment. The existence of a data protection impact assessment should not, in itself, demonstrate that a decision is necessary within the meaning of Article 22(2), point (a).’
Recital 38
Wording reproduced in the amendment → Amendment 363 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowedprohibited unless when specific conditions are met, as set out in Regulation (EU) 2016/679. The change from a right of the data subject to a general prohibition with exemptions is needed to bring legal clarity. It shoulddoes alsonot alter the material positions of the parties. In particular, the prohibition laid down in this provision does not need to be clarifiedinvoked thatby whena data subject affected by a decision. When assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could theoretically also be taken by a human does not prevent the controller from taking the decision solely by solely automated processing. WhenHowever, when several equally effective automatedmeans for processing solutionsare existavailable to the controller, the controller shouldmust use the lessleast intrusive onemeans, automated or not. The position of a data subject should not be worsened due to the implementation of automated individual decision-making. Therefore, in case of automated decision-making with human involvement, such involvement must be meaningful in order to result in the inapplicability of Article 22 of Regulation (EU) 2016/679. Human involvement without real and factual influence on the decision-making would be insufficient. The same is true for the human involvement a data subject can request in accordance with Article 22(3) Regulation (EU) 2016/679. Similarly, in order to ensure a consistent and high level of protection of natural persons, legal and similarly significantly affects must be interpreted broadly, and include the decision if a certain payment method is offered to a data subject or which price is offered to customers.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 363 · ITRE–LIBE amendments 251–400 to the draft report
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are prohibited unless when specific conditions are met, as set out in Regulation (EU) 2016/679. The change from a right of the data subject to a general prohibition with exemptions is needed to bring legal clarity. It does not alter the material positions of the parties. In particular, the prohibition laid down in this provision does not need to be invoked by a data subject affected by a decision. When assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, the fact that the decision could theoretically also be taken by a human does not prevent the controller from taking the decision solely by automated processing. However, when several equally effective means for processing are available to the controller, the controller must use the least intrusive means, automated or not. The position of a data subject should not be worsened due to the implementation of automated individual decision-making. Therefore, in case of automated decision-making with human involvement, such involvement must be meaningful in order to result in the inapplicability of Article 22 of Regulation (EU) 2016/679. Human involvement without real and factual influence on the decision-making would be insufficient. The same is true for the human involvement a data subject can request in accordance with Article 22(3) Regulation (EU) 2016/679. Similarly, in order to ensure a consistent and high level of protection of natural persons, legal and similarly significantly affects must be interpreted broadly, and include the decision if a certain payment method is offered to a data subject or which price is offered to customers.
Recital 38
Wording reproduced in the amendment → Amendment 364 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Automated procedures can significantly benefit the digital economy by streamlining routine operations such as Know-Your-Customer (KYC) verifications or fraud preventions. However, when deployed for a higher risk evaluations producing legal or similarly significant effects, such as automated hiring, the termination of contracts or online accounts, profiling or creditworthiness decision, they entail heightened risks to individual rights. Article 22 of Regulation (EU) 2016/679 provides forthat the data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should therefore be clarified that decisions based solely on automated processing are allowedgenerally when specific conditions are metprohibited, as set out in Regulation (EU) 2016/679. It should also be clarifiedand that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, itautomated processing is permitted only if no other equally effective and less privacy-intrusive means are available to fulfil the core objective of the contractual service explicitly requested by the data subject. Moreover, to prevent a gap in legal protection, the concept of a decision should notextend be required that the decision could be taken only by solelyto automated processing. Thisor meansprofiling operations that thegenerate factan thatassessment theor decisionvalue couldupon also be taken bywhich a human does not prevent thesubsequent controller fromstrongly takingrelies theas decisiona bydetermining solelyfactor automatedin processingits decision-making. When several equally effective automated processing solutions exist, the controller should use the lessleast intrusive one, guaranteeing in all cases the data subject's right to obtain human intervention, express their point of view, and contest the automated outcome, while utilizing appropriate procedures to minimize error risks.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 364 · ITRE–LIBE amendments 251–400 to the draft report
(38) Automated procedures can significantly benefit the digital economy by streamlining routine operations such as Know-Your-Customer (KYC) verifications or fraud preventions. However, when deployed for a higher risk evaluations producing legal or similarly significant effects, such as automated hiring, the termination of contracts or online accounts, profiling or creditworthiness decision, they entail heightened risks to individual rights. Article 22 of Regulation (EU) 2016/679 provides that the data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should therefore be clarified that decisions based solely on automated processing are generally prohibited, and that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, automated processing is permitted only if no other equally effective and less privacy-intrusive means are available to fulfil the core objective of the contractual service explicitly requested by the data subject. Moreover, to prevent a gap in legal protection, the concept of a decision should extend to automated processing or profiling operations that generate an assessment or value upon which a subsequent controller strongly relies as a determining factor in its decision-making. When several equally effective automated processing solutions exist, the controller should use the least intrusive one, guaranteeing in all cases the data subject's right to obtain human intervention, express their point of view, and contest the automated outcome, while utilizing appropriate procedures to minimize error risks.
Recital 38
Wording reproduced in the amendment → Amendment 365 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. For the purposes of illustration, decisions which produce legal effects concerning the data subject, or similarly significantly affecting the data subject, within the meaning of Article 22, include creditworthiness assessment systems applied to undertakings in the agricultural sector, algorithmic systems for determining premiums for agricultural insurance policies, including parametric insurance policies, automated systems for processing applications for payments under the common agricultural policy, and automated pricing decisions applied by platforms acting as intermediaries in, or selling, agricultural production inputs. In proceedings involving decisions of that nature, the data subject’s right to obtain human intervention pursuant to Article 22(3) shall include the right to obtain a comprehensible explanation of the factors determining the outcome and the right to have the decision reviewed by a person possessing technical expertise relevant to the agricultural sector.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 365 · ITRE–LIBE amendments 251–400 to the draft report
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. For the purposes of illustration, decisions which produce legal effects concerning the data subject, or similarly significantly affecting the data subject, within the meaning of Article 22, include creditworthiness assessment systems applied to undertakings in the agricultural sector, algorithmic systems for determining premiums for agricultural insurance policies, including parametric insurance policies, automated systems for processing applications for payments under the common agricultural policy, and automated pricing decisions applied by platforms acting as intermediaries in, or selling, agricultural production inputs. In proceedings involving decisions of that nature, the data subject’s right to obtain human intervention pursuant to Article 22(3) shall include the right to obtain a comprehensible explanation of the factors determining the outcome and the right to have the decision reviewed by a person possessing technical expertise relevant to the agricultural sector.
Recital 38
Wording reproduced in the amendment → Amendment 366 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. For the purposes of illustration, decisions which produce legal effects concerning the data subject, or similarly significantly affecting the data subject, within the meaning of Article 22, include creditworthiness assessment systems applied to undertakings in the agricultural sector, algorithmic systems for determining premiums for agricultural insurance policies, including parametric insurance policies, automated systems for processing applications for payments under the common agricultural policy, and automated pricing decisions applied by platforms acting as intermediaries in, or selling, agricultural production inputs. In proceedings involving decisions of that nature, the data subject’s right to obtain human intervention pursuant to Article 22(3) shall include the right to obtain a comprehensible explanation of the factors determining the outcome and the right to have the decision reviewed by a person possessing technical expertise relevant to the agricultural sector.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 366 · ITRE–LIBE amendments 251–400 to the draft report
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. For the purposes of illustration, decisions which produce legal effects concerning the data subject, or similarly significantly affecting the data subject, within the meaning of Article 22, include creditworthiness assessment systems applied to undertakings in the agricultural sector, algorithmic systems for determining premiums for agricultural insurance policies, including parametric insurance policies, automated systems for processing applications for payments under the common agricultural policy, and automated pricing decisions applied by platforms acting as intermediaries in, or selling, agricultural production inputs. In proceedings involving decisions of that nature, the data subject’s right to obtain human intervention pursuant to Article 22(3) shall include the right to obtain a comprehensible explanation of the factors determining the outcome and the right to have the decision reviewed by a person possessing technical expertise relevant to the agricultural sector.
Recital 38
Wording reproduced in the amendment → Amendment 367 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides forthat data subjects have the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisionswhen assessing whether a decision based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. WhenHowever, when several equally effective automated processing solutions exist, the controller should use the less intrusive one. The data subject’s rights should not suffer due to the implementation of automated individual decision-making. Human involvement with regard to automated decision-making should be meaningful, and a mere symbolic gesture of viewing the decision made by a human without real and factual influence on the decision-making should not be categorised as human involvement. In order to ensure a consistent and high level of protection of natural persons, legal effects and similarly significant effects on the data subject should be interpreted broadly, and include decisions such as payment methods offered to a data subject and prices shown to a data subject when visiting an online retailer.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 367 · ITRE–LIBE amendments 251–400 to the draft report
(38) Article 22 of Regulation (EU) 2016/679 provides that data subjects have the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. However, when several equally effective processing solutions exist, the controller should use the less intrusive one. The data subject’s rights should not suffer due to the implementation of automated individual decision-making. Human involvement with regard to automated decision-making should be meaningful, and a mere symbolic gesture of viewing the decision made by a human without real and factual influence on the decision-making should not be categorised as human involvement. In order to ensure a consistent and high level of protection of natural persons, legal effects and similarly significant effects on the data subject should be interpreted broadly, and include decisions such as payment methods offered to a data subject and prices shown to a data subject when visiting an online retailer.
Recital 38
Wording reproduced in the amendment → Amendment 368 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. Legal effects and similarly significant effects on the data subject should be interpreted broadly, and include decisions such as payment methods offered to a data subject and prices shown to a data subject when visiting an online retailer. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed only when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) ofthis Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. In any case, such processing should be subject to suitable safeguards, which should include specific information to the data subject and the right to obtain meaningful human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision. Meaningful human intervention includes that the reviewer should be able to review the accuracy of the data and logic involved in the decision and the consequences of the decision, not merely the output. In other words, the reviewer should be able to review the facts, circumstances and reasons for such decisions. The human reviewer should be provided with appropriate training, have the relevant competence and skills and be empowered to revoke, amend and override the decision. The controller should provide an answer to the request to obtain a meaningful human intervention as fast as possible.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 368 · ITRE–LIBE amendments 251–400 to the draft report
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. Legal effects and similarly significant effects on the data subject should be interpreted broadly, and include decisions such as payment methods offered to a data subject and prices shown to a data subject when visiting an online retailer. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed only when specific conditions are met, as set out in Regulation (EU) 2016/679 and this Regulation. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. In any case, such processing should be subject to suitable safeguards, which should include specific information to the data subject and the right to obtain meaningful human intervention, to express his or her point of view, to obtain an explanation of the decision reached after such assessment and to challenge the decision. Meaningful human intervention includes that the reviewer should be able to review the accuracy of the data and logic involved in the decision and the consequences of the decision, not merely the output. In other words, the reviewer should be able to review the facts, circumstances and reasons for such decisions. The human reviewer should be provided with appropriate training, have the relevant competence and skills and be empowered to revoke, amend and override the decision. The controller should provide an answer to the request to obtain a meaningful human intervention as fast as possible.
Recital 38
Wording reproduced in the amendment → Amendment 369 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 369 · ITRE–LIBE amendments 251–400 to the draft report
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge.
Recital 38
Wording reproduced in the amendment → Amendment 370 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions considering the data intensiveness and risk associated with the processing are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one, when it does not result in a significant additional administrative burden for the controller.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 370 · ITRE–LIBE amendments 251–400 to the draft report
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions considering the data intensiveness and risk associated with the processing are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one, when it does not result in a significant additional administrative burden for the controller.
Recital 38
Wording reproduced in the amendment → Amendment 371 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. InArticle order22(1) confers on the data subject the right not to provide greater legal certainty, it should be clarifiedsubject thatto decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whethersuch a decision. That right is necessarya prohibition of principle, subject to the limited exceptions laid down in Article 22(2), and not an authorisation subject to conditions. Where the controller relies on the necessity of the decision for entering into, or the performance of, a contract, betweenthat necessity shall be interpreted strictly. A decision is not necessary within the data subject and a data controller, as set out in Article 22(2)(a)meaning of Regulationthat (EU)provision 2016/679,where itthe shouldpurpose notpursued can reasonably be requiredachieved by means involving human intervention. The availability of an equally effective non-automated alternative excludes reliance on that the decision could be taken only by solely automated processingexception. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The safeguards laid down in Article 22(3), and in particular the right to obtain human intervention, to express one's point of view and to contest the decision, apply in full.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 371 · ITRE–LIBE amendments 251–400 to the draft report
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. Article 22(1) confers on the data subject the right not to be subject to such a decision. That right is a prohibition of principle, subject to the limited exceptions laid down in Article 22(2), and not an authorisation subject to conditions. Where the controller relies on the necessity of the decision for entering into, or the performance of, a contract, that necessity shall be interpreted strictly. A decision is not necessary within the meaning of that provision where the purpose pursued can reasonably be achieved by means involving human intervention. The availability of an equally effective non-automated alternative excludes reliance on that exception. When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The safeguards laid down in Article 22(3), and in particular the right to obtain human intervention, to express one's point of view and to contest the decision, apply in full.
Recital 38
Wording reproduced in the amendment → Amendment 372 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one and ensure that the data are protected in accordance with current legislation.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 372 · ITRE–LIBE amendments 251–400 to the draft report
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one and ensure that the data are protected in accordance with current legislation.
Recital 38
Wording reproduced in the amendment → Amendment 373 · ITRE–LIBE amendments 251–400 to the draft report
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, itIt should be clarified that decisions based solely on automated processing are not allowed whenunless specific conditions are met, as set out in Regulation (EU) 2016/679. A decision based solely on automated processing should only be deemed necessary if no equally effective and less intrusive means are available to the data controller. Data subjects should retain the fundamental right not to have to be subjected to decisions of this kind and to be able to request that those decisions be made on the basis of significant human intervention. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 373 · ITRE–LIBE amendments 251–400 to the draft report
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. It should be clarified that decisions based solely on automated processing are not allowed unless specific conditions are met, as set out in Regulation (EU) 2016/679. A decision based solely on automated processing should only be deemed necessary if no equally effective and less intrusive means are available to the data controller. Data subjects should retain the fundamental right not to have to be subjected to decisions of this kind and to be able to request that those decisions be made on the basis of significant human intervention. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing.
Recital 38
Wording reproduced in the amendment → Amendment 6 · ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides forthat data subjects have the right not to be subject to a decision based solely on automated processing, except where specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisionswhen assessing whether a decision based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. WhenHowever, when several equally effective automated processing solutions exist, the controller should use the less intrusive one. The data subject’s rights should not be negatively impacted by the implementation of automated individual decision-making. Human involvement with regard to automated decision-making should be meaningful, and a mere symbolic gesture by a human of viewing the decision made without having a real and factual influence on the decision-making should not be categorised as human involvement.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 6 · ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)
(38) Article 22 of Regulation (EU) 2016/679 provides that data subjects have the right not to be subject to a decision based solely on automated processing, except where specific conditions are met and in accordance with rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. However, when several equally effective automated processing solutions exist, the controller should use the less intrusive one. The data subject’s rights should not be negatively impacted by the implementation of automated individual decision-making. Human involvement with regard to automated decision-making should be meaningful, and a mere symbolic gesture by a human of viewing the decision made without having a real and factual influence on the decision-making should not be categorised as human involvement.
Recital 38
Wording reproduced in the amendment → Amendment 173 · IMCO amendments 125–328 to the draft opinion
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 173 · IMCO amendments 125–328 to the draft opinion
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge.
Recital 38
Wording reproduced in the amendment → Amendment 128 · JURI amendments 69–296 to the draft opinion: removal
Changes in context
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 128 · JURI amendments 69–296 to the draft opinion: removal
This wording is removed.
Recital 38
Wording reproduced in the amendment → Amendment 129 · JURI amendments 69–296 to the draft opinion
Changes in context
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge comparable to trade secret.
RemovedAdded
Both texts in full
Wording reproduced in the amendment
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one.
Amendment 129 · JURI amendments 69–296 to the draft opinion
(38) Article 22 of Regulation (EU) 2016/679 provides for rules governing the processing of personal data when the data controller makes decisions which have legal effects or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that decisions based solely on automated processing are allowed when specific conditions are met, as set out in Regulation (EU) 2016/679. It should also be clarified that when assessing whether a decision is necessary for entering into, or performance of, a contract between the data subject and a data controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. This means that the fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing When several equally effective automated processing solutions exist, the controller should use the less intrusive one. The requirement to provide “meaningful information about the logic involved” does not oblige controllers to disclose internal algorithms, proprietary logic, or commercially sensitive business knowledge comparable to trade secret.