Research

Digital Omnibus tracker

GDPR · Regulation (EU) 2016/679

Article 22

Compare the available Commission, Council and Parliament texts and amendments affecting this article.

Article total: 11 parts · 4 Council drafts · 31 Parliament amendments

Source notes (1)
  • The source instruction replaces paragraphs 1 and 2 with one printed paragraph 1. The printed paragraph 1 is complete; existing paragraph 2 is removed as part of that replacement.

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

All Commission’s changes to GDPR

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 4 May 2016, with all 2 Commission proposal changes affecting this article applied.

Removed by the proposal: Article 22(2).

Article 22

Automated individual decision-making, including profiling

  1. 1.

    TheA decision which produces legal effects for a data subject shallor havesimilarly thesignificantly rightaffects nothim toor her may be subject to a decision based solely on automated processing, including profiling, whichonly produceswhere legalthat effects concerning him or her or similarly significantly affects him or her.decision:

    1. (a)

      is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;

    2. (b)

      is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

    3. (c)

      is based on the data subject's explicit consent.

  2. 2.

    Paragraph 1 shall not apply if the decision:

    1. (a)

      is necessary for entering into, or performance of, a contract between the data subject and a data controller;

    2. (b)

      is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

    3. (c)

      is based on the data subject's explicit consent.

  3. 3.

    In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

  4. 4.

    Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.

Commission source wording and instructions

Article 22(1)

Commission proposal

1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means; (b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent.

Article 22(2)

Commission proposal

7. In Article 22, paragraphs 1 and 2 are replaced by the following: ‘1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means; (b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent.’

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

View full Council comparison →

Article 22(1)

May Presidency compromise

Council wording reconstructed for this provision from the official operation

1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless such processing:

(a)

is necessary for entering into, or performance of, a contract between the data subject and a data controller ;

(b)

is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

(c)

is based on the data subject's explicit consent.

Article 22(2)

May Presidency compromise

The Council draft deletes this provision and supplies no replacement wording. Open the official source to read the instruction in context.

Official source passage and amending instruction

7. Article 22 is replaced by the following: ‘1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless such processing:

(a)

is necessary for entering into, or performance of, a contract between the data subject and a data controller ;

(b)

is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

(c)

is based on the data subject's explicit consent.

2.

In the cases referred to in points (a) and (c) of paragraph 1, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

3.

Decisions referred to in paragraph 1 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.’

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

More filters

Political group at the amendment date where available; otherwise the current Parliament affiliation.

Alternative wording Amendment 51 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)
1. A decision which produces legal effects for aThe data subject orshall similarlyhave significantlythe affectsright himnot or her mayto be subject to a decision based solely on automated processing, including profiling, onlywhich whereproduces legal effects concerning them or that decisionsimilarly significantly affects them, unless such processing:
Preview
against:
Alternative wording Amendment 52 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)
(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
Preview
against:
Alternative wording Amendment 53 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)
7a. In Article 22, paragraph 3 is replaced by the following:
3. In the cases referred to in points (a) and (c) of paragraph 21, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain meaningful human intervention on the part of the controller, to express his or her point of view and to contestchallenge the decision taken in respect of them. Meaningful human intervention on the part of the controller requires that the human reviewer has the authority, knowledge, and competence to modify the contested decision, and that they actively analyse all relevant data, not merely the output of the system.
Preview
against:
Alternative wording Amendment 249 · Tobiasz Bocheński, Kosma Złotowski JURI

The source names this article, but its precise target scope has not been resolved. Related tracker provisions are not asserted as direct targets.

Article 22

1. A decision which produces legal effects for a data subject, in particular determine a person's legal status or contractual rights, or similarly significantly affects him or her, may be based solely on automated processing, including profiling, only where that decision:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22

Additional proposed wording Amendment 381 · Arba Kokalari IMCO
(ca)

is taken by an AI system which can be reviewed and overseen by a natural person before or after it takes effect, and where appropriate safeguards are in place;

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1

Additional proposed wording Amendment 382 · Virginie Joron IMCO
1a.

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1

Additional proposed wording Amendment 383 · Virginie Joron IMCO
1b.

If a decision referred to in paragraph 1 is based on the outputs of a high-risk AI system within the meaning of Regulation (EU) 2024/1689, the measures referred to in point (b) of paragraph 1, as well as the safeguards accompanying a decision taken in application of points (a) and (c) thereof, shall be without prejudice to the human oversight requirements imposed in Article 14 of this Regulation. In particular, the natural persons entrusted with human oversight must be able to understand properly the system’s capabilities and limitations, to interpret correctly its outputs, to remain aware of the risk of over-reliance on these outputs, and to decide not to use the system or to override, ignore or reverse its outputs. Automated processing shall not deprive the data subject of the right to seek human intervention, express personal views and contest the decision.

Preview
against:
Official source ↗
Source identification

The official header prints Article 22(2), but the sole enacted unit is labelled 1b and expressly supplements paragraph 1. The legal-effect target is therefore the new Article 22(1b); the conflicting printed paragraph 2 locator remains preserved as source evidence.

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 2

Remove proposed wording Amendment 436 · Sabine Verheyen IMCO
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 15 / REGULATION (EU) 2016/679 / Article 22

Deletion marker printed in the source: deleted

Remove proposed wording Amendment 1141 · Birgit Sippel ITRE · LIBE
1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means; (b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent.
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1

Deletion marker printed in the source: deleted

Alternative wording Amendment 1142 · Pernando Barrena Arza ITRE · LIBE

The source names this article, but its precise target scope has not been resolved. Related tracker provisions are not asserted as direct targets.

Article 22

1. AArticle decision22 whichshall producesbe legalreplaced effectsby forthe afollowing:
The data subject orshall similarlyhave significantlythe affectsright himnot or her mayto be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. A decision shall be considered to be based solely on automated processing where automated processing materially determines the outcome and any human involvement is merely formal, symbolic, limited to validation, or does not include a genuine assessment of the individual case. 2. Paragraph 1 shall not apply only where thatthe decision: (a) is strictly necessary for entering into, or performance of, a contract between the data subject and the controller, and no less intrusive means reasonably available to the controller can achieve the same specific contractual purpose; (b) is authorised by Union or Member State law to which the controller is subject, which respects the essence of the rights and freedoms of the data subject, is necessary and proportionate in a democratic society, and lays down suitable and specific measures to safeguard the data subject’s rights and freedoms and legitimate interests; or (c) is based on the data subject’s explicit consent. For the purposes of point (a), a decision shall not be considered strictly necessary merely because it is useful, efficient, economically advantageous, scalable, faster, more consistent, part of the controller’s business model, or capable of reducing costs. Commercial convenience, service optimisation, fraud prevention at scale, profiling, risk scoring, behavioural prediction or personalised pricing shall not, in themselves, constitute necessity. 3. In the cases referred to in paragraph 2, points (a) and (c), the controller shall implement suitable and specific measures to safeguard the data subject’s rights and freedoms and legitimate interests, including at least: (a) the right to obtain meaningful human intervention on the part of the controller; (b) the right to express their point of view before, or where this is not possible, without undue delay after, the decision is taken; (c) the right to receive meaningful information about the main reasons for the decision, including the main categories of personal data relied upon, the use of profiling or inferred data, the key parameters, factors or criteria that materially influenced the decision, and, where relevant, their relative importance, as well as the steps available to correct inaccurate data, express their point of view and contest the decision; (d) the right to contest the decision and obtain a fresh assessment by a human reviewer. Human intervention shall be carried out by a person with the competence, information, time, resources and authority necessary to assess the individual case and to modify, reverse or otherwise change the decision. The human reviewer shall actively assess the relevant facts and shall not merely rely on, confirm or reproduce the output of the automated system. Information provided pursuant to point (c) shall be sufficiently specific to allow the data subject to understand why the decision was taken in their individual case and to exercise their rights effectively. Controllers shall not rely on trade secrets, intellectual property or security considerations to refuse information that is necessary to understand the main reasons for the decision, without prejudice to proportionate measures to protect confidential information. 4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless Article 9(2), point (a) or point (g), applies and suitable and specific measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place. 5. The controller shall document the assessment referred to in paragraph 2, point (a), the less intrusive means considered, including human-led or human-reviewed alternatives, and the measures implemented pursuant to paragraph 3. That documentation shall include the reasons why the decision is strictly necessary, the less intrusive alternatives considered, the organisation of human review, the competence and authority of reviewers, the information made available to them, and the number and proportion of decisions modified, reversed or otherwise changed following human intervention. Where the processing is subject to a data protection impact assessment pursuant to Article 35, that assessment shall include an assessment of whether the same specific purpose can reasonably be achieved through less intrusive means, including human-led, human-reviewed or non-automated alternatives, and an assessment of the risks created by automation, profiling, inferred data and the organisation of human review. The documentation shall be made available to the supervisory authority upon request. Where necessary to verify compliance with this Article, the supervisory authority may require access to relevant testing documentation, evaluation results and controlled testing environments, subject to appropriate confidentiality safeguards.
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22

Alternative wording Amendment 1143 · João Oliveira ITRE · LIBE
1. A decision which produces legal effects for aThe data subject orshall similarlyhave significantlythe affectsright himnot or her mayto be subject to any decision based solely on automated processing, including profiling, onlythat whereproduces legal effects concerning them or that similarly significantly affects them, unless that decision:
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1

Alternative wording Amendment 1144 · Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller ITRE · LIBE
1. A decision which produces legal effects for aThe data subject orshall similarlyhave significantlythe affectsright himnot or her mayto be subject to a decision based solely on automated processing, including profiling, onlywhich whereproduces thatlegal decisioneffect concerning them or similarly significantly affects them, unless such processing:
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1

Alternative wording Amendment 1145 · Alex Agius Saliba ITRE · LIBE
1. A decision which produces legal effects for a data subject or similarly significantly affects himthem orshall her maynot be based solely on automated processing, including profiling, only whereunless that decision:
Justification

Changes in line with EDPB-EDPS opinion, para. 66, in line with CJEU case law.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1

Alternative wording Amendment 1146 · Sebastian Tynkkynen, Diego Solier ITRE · LIBE
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means, when several equally effective automated processing solutions exist, the controller should use the less intrusive one when it does not result in a significant additional administrative burden for the controller;
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1 – point a

Alternative wording Amendment 1147 · Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller ITRE · LIBE
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;
Preview
against:
Official source ↗
Source identification

The official amendment header prints Article 22(2)(a), but both source columns reproduce point (a) of the Commission's single consolidated replacement paragraph 1. The amendment removes the final clause from that exact Commission wording, so the legal-effect target is Article 22(1)(a); the printed paragraph 2 locator remains preserved as source evidence.

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 2 – point a

Alternative wording Amendment 1148 · João Oliveira ITRE · LIBE
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1 – point a

Alternative wording Amendment 1149 · Alex Agius Saliba ITRE · LIBE
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;
Justification

Moved to recital 38 as per EDPB-EDPS opinion, para. 72.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulations (EU) 2016/679 / Article 22 – paragraph 1 – point a

Alternative wording Amendment 1150 · Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec ITRE · LIBE
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1 – point a

Alternative wording Amendment 1151 · Markéta Gregorová on behalf of the Verts/ALE Group ITRE · LIBE
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1 – point a

Alternative wording Amendment 1152 · Michael McNamara, Irena Joveva, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová ITRE · LIBE
(c) is based on the data subject's explicit consent, provided that the data subject is not a child.
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1 – point c

Additional proposed wording Amendment 1153 · Alex Agius Saliba ITRE · LIBE
2.

The data subject shall have the right not to be subject to a decision under Article 22(1) unless one of the conditions mentioned in letters (a) to (c) of that provision is met.

3.

In the cases referred to in points (a) and (c) of paragraph 1, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision. Any human intervention on the part of the controller must be meaningful and the human must have the necessary knowledge and competences to comprehend and have the possibility to modify the contested decision.

4.

Before a controller makes any decision under Article 22(1), it must ensure that the affected data subject is informed about the decision in accordance with Articles 13 or 14, and that, at the time of the decision, it has implemented suitable measures in accordance with Article 22(3).

5.

Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulations (EU) 2016/679 / Article 22 – paragraphs 2, 3, 4

Additional proposed wording Amendment 1154 · Tomas Tobé, Arba Kokalari, Jörgen Warborn ITRE · LIBE
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1 – point ca (new)

Additional proposed wording Amendment 1155 · Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller ITRE · LIBE

1a. In Article 22, the following paragraph is inserted:

In the cases referred to in points (a), (b) and (c) of paragraph 1, the data controller shall implement suitable technical and organisational measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain genuine human intervention of the part of the controller, to express his or her point of view and to contest the decision taken, as referred to in paragraph 1. The human reviewer designated to perform such intervention shall possess the necessary competence, knowledge to understand all relevant underlining data, and shall be empowered to modify or override the decision without delay.'

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1a (new)

Additional proposed wording Amendment 1156 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE

1a. In Article 22, the following paragraph is inserted:

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.'

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – Paragraph 1a (new)

Additional proposed wording Amendment 1157 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE

1b. In Article 22, the following paragraph is inserted:

Where a decision referred to in paragraph 1 is based on the output of a high-risk AI system within the meaning of Regulation (EU) 2024/1689, the measures referred to in point (b) of paragraph 1, and the safeguards accompanying a decision taken pursuant to points (a) and (c) thereof, shall be without prejudice to the human oversight requirements laid down in Article 14 of that Regulation. In particular, natural persons to whom human oversight is assigned shall be enabled to properly understand the capacities and limitations of the system, to correctly interpret its output, to remain aware of the risk of over-reliance on that output, and to decide not to use the system or to disregard, override or reverse its output. Automated processing shall not deprive the data subject of the right to obtain human intervention, to express his or her point of view and to contest the decision.'

Justification

Decisions based solely on automated processing that produce legal effects or similarly significantly affect a data subject raise particular risks where they rely on the output of a high-risk AI system. This amendment clarifies that, in such cases, the safeguards under Article 22 are without prejudice to the human oversight requirements laid down in Article 14 of Regulation (EU) 2024/1689: the natural persons to whom oversight is assigned must be able to understand the system's capacities and limitations, to interpret its output correctly, to remain aware of the risk of over-reliance, and to disregard, override or reverse that output. It further recalls that automated processing may not deprive the data subject of the right to obtain human intervention, to express his or her point of view and to contest the decision. This ensures the coherence of the Union acquis by articulating the structural obligation of human oversight under the Artificial Intelligence Act with the individual right to human intervention under the General Data Protection Regulation.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 1b (new)

Additional proposed wording Amendment 1158 · Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller ITRE · LIBE
4.

Decisions referred to in paragraph 1 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable technical and organisational measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 / Regulation (EU) 2016/679 / Article 22 – paragraph 4

Additional proposed wording Amendment 1161 · Markéta Gregorová on behalf of the Verts/ALE Group ITRE · LIBE

7a. In Article 22, paragraph 3 is replaced by the following:

In the cases referred to in points (a) and (c) of paragraph 1, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain meaningful human intervention on the part of the controller, to express his or her point of view and to challenge the decision taken in their regard.

Meaningful human intervention, on the part of the controller, requires that the human reviewer reviews the accuracy of the data, the logic involved in the decision and the consequences of the decision, not merely the output of the system.

The human reviewer shall have the competence, training and authority necessary to exercise that function, including for overriding automated decisions. The human reviewer shall enjoy protection from dismissal or its equivalent, disciplinary measures and other adverse treatment where they exercise their functions.

Justification

Sub-paragraph 3 based on Article 10(2) of the Platform Workers Directive (EU) 2024/2831.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 a (new) / Regulation (EU) 2016/679 / Article 22 – paragraph 3

Additional proposed wording Amendment 1162 · Dario Nardella ITRE · LIBE
3.

In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall apply suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain meaningful human intervention on the part of the controller, to express his or her point of view and to contest the decision. Human intervention is meaningful when the person in charge of the review has the requisite authority, knowledge and expertise to amend the contested decision and actively analyses the set of relevant data, going beyond the outcome produced by the system. In proceedings concerning access to agricultural credit, the setting of premiums for agricultural insurance policies and the disbursement of payments under the common agricultural policy, the person responsible for the review shall also possess the technical and agronomic expertise relevant to the proceedings in question.

Justification

L'emendamento contribuisce alla riarticolazione dell'articolo 22, paragrafo 3, del regolamento (UE) 2016/679, che la proposta della Commissione non modifica, in coerenza con l'emendamento 53 del Draft Report, ma ne specifica le particolarità degli impatti sugli imprenditori agricoli europei. Alla qualificazione dell'intervento umano come significativo aggiunge il requisito della competenza tecnica e agronomica del revisore nei procedimenti che coinvolgono imprese agricole. La revisione umana di una decisione automatizzata sull'erogazione di un pagamento nell'ambito della politica agricola comune, sul merito creditizio agrario o sul premio di una polizza parametrica richiede, per essere effettiva, la conoscenza dei meccanismi di condizionalità, dei parametri agronomici e dei sistemi integrati di controllo. Il presente emendamento può essere depositato come emendamento autonomo al testo della proposta oppure come sub-emendamento all'emendamento 53 del Draft Report.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 a (new) / Regulation (EU) 2016/679 / Article 22 – paragraph 3

Additional proposed wording Amendment 1163 · Francesco Torselli, Paolo Inselvini ITRE · LIBE
7a.

In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall apply suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain meaningful human intervention on the part of the controller, to express his or her point of view and to contest the decision. Human intervention is meaningful when the person in charge of the review has the requisite authority, knowledge and expertise to amend the contested decision and actively analyses the set of relevant data, going beyond the outcome produced by the system. In proceedings concerning access to agricultural credit, the setting of premiums for agricultural insurance policies and the disbursement of payments under the common agricultural policy, the person responsible for the review shall also possess the technical and agronomic expertise relevant to the proceedings in question.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 a (new) / Regulation (EU) 2016/679 / Article 22 – paragraph 3

Additional proposed wording Amendment 1166 · Pernando Barrena Arza ITRE · LIBE

7a. In Article 22, the following paragraph 4a is added:

Without any prejudice to Article 35, any automated decision making under Article 22(1) of this Regulation that is likely to affect more than 100 data subjects per year shall be subject to a data protection impact assessment performed by the controller.'

Justification

Automated individual decision-making under Article 22 GDPR will regularly trigger the obligation to perform a data protection impact assessment under Article 35 GDPR. However, this provision should introduce relatively hard factors triggering this obligation in cases of large-scale processing and processing of sensitive data in order to avoid situations in which a controller considers the requirements under Article 35 not to be met.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 a (new) / Regulation (EU) 2016/679 / Article 22 – paragraph 4a (new)

Additional proposed wording Amendment 1172 · Pernando Barrena Arza ITRE · LIBE

7b. In Article 22, the following paragraph 4a is added:

For any processing operation that is likely to entail automated individual decision making affecting and the profiling of more than 1000 data subjects per year, the controller must be able to demonstrate that the methodology used for the profiling and decision making are based on scientifically recognised mathematical and statistical methods and do not cause any unlawful discrimination. Information demonstrating these facts must be made publicly available by the controller.'

Justification

In order to ensure that the automated individual decision-making affecting vast amounts of data subjects is compatible with the principle of fairness, controllers should be obliged to demonstrate that the methodologies used are based on scientifically recognised mathematical and statistical methods and non-discriminatory.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 3 – paragraph 1 – point 7 b (new) / Regulation (EU) 2016/679 / Article 22 – paragraph 4a (new)