GDPR· Article 22

Article 88b

1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision:The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or that similarly significantly affects them, unless such processing:

(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

Tracker noteThe amendment names this article, but which paragraph or point it changes has not been automatically established, so it is not yet linked to a specific point.

1. A decision which produces legal effects for a data subject, in particular determine a person’s legal status or contractual rights, or similarly significantly affects him or her, may be based solely on automated processing, including profiling, only where that decision:

1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means; (b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or (c) is based on the data subject’s explicit consent.

Tracker noteThe amendment names this article, but which paragraph or point it changes has not been automatically established, so it is not yet linked to a specific point.

1. A decision which produces legal effects for aArticle 22 shall be replaced by the following:

data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision:The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. A decision shall be considered to be based solely on automated processing where automated processing materially determines the outcome and any human involvement is merely formal, symbolic, limited to validation, or does not include a genuine assessment of the individual case. 2. Paragraph 1 shall not apply only where the decision: (a) is strictly necessary for entering into, or performance of, a contract between the data subject and the controller, and no less intrusive means reasonably available to the controller can achieve the same specific contractual purpose; (b) is authorised by Union or Member State law to which the controller is subject, which respects the essence of the rights and freedoms of the data subject, is necessary and proportionate in a democratic society, and lays down suitable and specific measures to safeguard the data subject’s rights and freedoms and legitimate interests; or (c) is based on the data subject’s explicit consent. For the purposes of point (a), a decision shall not be considered strictly necessary merely because it is useful, efficient, economically advantageous, scalable, faster, more consistent, part of the controller’s business model, or capable of reducing costs. Commercial convenience, service optimisation, fraud prevention at scale, profiling, risk scoring, behavioural prediction or personalised pricing shall not, in themselves, constitute necessity. 3. In the cases referred to in paragraph 2, points (a) and (c), the controller shall implement suitable and specific measures to safeguard the data subject’s rights and freedoms and legitimate interests, including at least: (a) the right to obtain meaningful human intervention on the part of the controller; (b) the right to express their point of view before, or where this is not possible, without undue delay after, the decision is taken; (c) the right to receive meaningful information about the main reasons for the decision, including the main categories of personal data relied upon, the use of profiling or inferred data, the key parameters, factors or criteria that materially influenced the decision, and, where relevant, their relative importance, as well as the steps available to correct inaccurate data, express their point of view and contest the decision; (d) the right to contest the decision and obtain a fresh assessment by a human reviewer. Human intervention shall be carried out by a person with the competence, information, time, resources and authority necessary to assess the individual case and to modify, reverse or otherwise change the decision. The human reviewer shall actively assess the relevant facts and shall not merely rely on, confirm or reproduce the output of the automated system. Information provided pursuant to point (c) shall be sufficiently specific to allow the data subject to understand why the decision was taken in their individual case and to exercise their rights effectively. Controllers shall not rely on trade secrets, intellectual property or security considerations to refuse information that is necessary to understand the main reasons for the decision, without prejudice to proportionate measures to protect confidential information. 4. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless Article 9(2), point (a) or point (g), applies and suitable and specific measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place. 5. The controller shall document the assessment referred to in paragraph 2, point (a), the less intrusive means considered, including human-led or human-reviewed alternatives, and the measures implemented pursuant to paragraph 3. That documentation shall include the reasons why the decision is strictly necessary, the less intrusive alternatives considered, the organisation of human review, the competence and authority of reviewers, the information made available to them, and the number and proportion of decisions modified, reversed or otherwise changed following human intervention. Where the processing is subject to a data protection impact assessment pursuant to Article 35, that assessment shall include an assessment of whether the same specific purpose can reasonably be achieved through less intrusive means, including human-led, human-reviewed or non-automated alternatives, and an assessment of the risks created by automation, profiling, inferred data and the organisation of human review. The documentation shall be made available to the supervisory authority upon request. Where necessary to verify compliance with this Article, the supervisory authority may require access to relevant testing documentation, evaluation results and controlled testing environments, subject to appropriate confidentiality safeguards.

1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision:The data subject shall have the right not to be subject to any decision based solely on automated processing, including profiling, that produces legal effects concerning them or that similarly significantly affects them, unless that decision:

1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision:The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effect concerning them or similarly significantly affects them, unless such processing:

1. A decision which produces legal effects for a data subject or similarly significantly affects himthem orshall her maynot be based solely on automated processing, including profiling, only whereunless that decision:

Justification

Changes in line with EDPB-EDPS opinion, para. 66, in line with CJEU case law.

7a. In Article 22, paragraph 3 is replaced by the following:

3. In the cases referred to in points (a) and (c) of paragraph 21, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain meaningful human intervention on the part of the controller, to express his or her point of view and to contestchallenge the decision taken in respect of them. Meaningful human intervention on the part of the controller requires that the human reviewer has the authority, knowledge, and competence to modify the contested decision, and that they actively analyse all relevant data, not merely the output of the system.

7a. In Article 22, paragraph 3 is replaced by the following:

Justification

Sub-paragraph 3 based on Article 10(2) of the Platform Workers Directive (EU) 2024/2831.

Justification

L’emendamento contribuisce alla riarticolazione dell’articolo 22, paragrafo 3, del regolamento (UE) 2016/679, che la proposta della Commissione non modifica, in coerenza con l’emendamento 53 del Draft Report, ma ne specifica le particolarità degli impatti sugli imprenditori agricoli europei. Alla qualificazione dell’intervento umano come significativo aggiunge il requisito della competenza tecnica e agronomica del revisore nei procedimenti che coinvolgono imprese agricole. La revisione umana di una decisione automatizzata sull’erogazione di un pagamento nell’ambito della politica agricola comune, sul merito creditizio agrario o sul premio di una polizza parametrica richiede, per essere effettiva, la conoscenza dei meccanismi di condizionalità, dei parametri agronomici e dei sistemi integrati di controllo. Il presente emendamento può essere depositato come emendamento autonomo al testo della proposta oppure come sub-emendamento all’emendamento 53 del Draft Report.