Research

Digital Omnibus tracker

EU institutions data protection regulation · Regulation (EU) 2018/1725

Article 24

Compare the available Commission, Council and Parliament texts and amendments affecting this article.

Article total: 4 parts · 3 Council drafts · 11 Parliament amendments

Source notes (1)
  • The source instruction replaces paragraphs 1 and 2 with one printed paragraph 1. The printed paragraph 1 is complete; existing paragraph 2 is removed as part of that replacement.

Removed wording is struck through; added or replacement wording is highlighted.

Institutional text

European Commission proposal

All Commission’s changes to EU institutions data protection regulation

The wording proposed by the Commission at the start of this legislative file.

Full article with Commission changes

Article with proposed changes

Official consolidated text dated 23 October 2018, with all 2 Commission proposal changes affecting this article applied.

Removed by the proposal: Article 24(2).

Article 24

Automated individual decision-making, including profiling

  1. 1.

    TheA decision which produces legal effects for a data subject shallor havesimilarly thesignificantly rightaffects nothim toor her may be subject to a decision based solely on automated processing, including profiling, whichonly produceswhere legalthat effects concerning him or her or similarly significantly affects him or her.decision:

    1. (a)

      is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;

    2. (b)

      is authorised by Union law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

    3. (c)

      is based on the data subject's explicit consent.

  2. 2.

    Paragraph 1 shall not apply if the decision:

    1. (a)

      is necessary for entering into, or performance of, a contract between the data subject and the controller;

    2. (b)

      is authorised by Union law, which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or

    3. (c)

      is based on the data subject’s explicit consent.

  3. 3.

    In the cases referred to in points (a) and (c) of paragraph 2, the controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.

  4. 4.

    Decisions referred to in paragraph 2 of this Article shall not be based on special categories of personal data referred to in Article 10(1), unless point (a) or (g) of Article 10(2) applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.

Commission source wording and instructions

Article 24(1)

Commission proposal

1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means; (b) is authorised by Union law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent.

Article 24(2)

Commission proposal

6. in Article 24 paragraphs 1 and 2 are replaced by the following: ‘1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means; (b) is authorised by Union law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent.’

Institutional text

Council Presidency texts

Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.

View full Council comparison →

Article 24(1)

June Presidency compromise · 10 June

Council wording reconstructed for this provision from the official operation

1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless such processing:

(a)

is necessary for entering into, or performance of, a contract between the data subject and a data controller ;

(b)

is authorised by Union law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent.

Article 24(2)

June Presidency compromise · 10 June

Exact provision wording unavailable within a wider Council operation

This provision forms part of a wider Council operation. Its wording is not available separately here; open the official source for the full passage.

Official source passage and amending instruction
6.

in Article 24 paragraphs 1 and 2 are replaced by the following: ‘1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless such processing:

(a)

is necessary for entering into, or performance of, a contract between the data subject and a data controller ;

(b)

is authorised by Union law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

(c)

is based on the data subject's explicit consent.’

Competing proposals

European Parliament amendments

These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.

More filters

Political group at the amendment date where available; otherwise the current Parliament affiliation.

Alternative wording Amendment 72 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)
1. A decision which produces legal effects for aThe data subject orshall similarlyhave significantlythe affectsright himnot or her mayto be subject to a decision based solely on automated processing, including profiling, onlywhich whereproduces legal effects concerning them or that decisionsimilarly significantly affects them, unless such processing:
Preview
against:
Alternative wording Amendment 73 ITRE–LIBE draft report · Aura Salla and Marina Kaljurand (rapporteurs)
(b) is authorised by Union law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or
Preview
against:
Additional proposed wording Amendment 492 · Virginie Joron IMCO
1a.

If a decision referred to in paragraph 1 is based on the outputs of a high-risk AI system within the meaning of Regulation (EU) 2024/1689, the safeguards accompanying this decision shall not affect the human oversight requirements imposed in Article 14 of this Regulation. In particular, the natural persons responsible for human oversight must be able to understand properly the system’s capabilities and limitations, to interpret correctly its outputs, to remain aware of the risk of over-reliance on these outputs, and to decide not to use the system or not to take its outputs into consideration, to override them or to invalidate them. Automated processing shall not deprive the data subject of the right to seek human intervention, express personal views and contest the decision.

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/1725 / Article 24 – paragraph 1

Remove proposed wording Amendment 1661 · Pernando Barrena Arza, João Oliveira ITRE · LIBE
6. in Article 24 paragraphs 1 and 2 are replaced by the following: 1. A decision which produces legal effects for a data subject or similarly significantly affects him or her may be based solely on automated processing, including profiling, only where that decision: (a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means; (b) is authorised by Union law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or (c) is based on the data subject's explicit consent.’
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/1725 / Article 24 – paragraph 1

Deletion marker printed in the source: deleted

Alternative wording Amendment 1663 · Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller ITRE · LIBE
1. A decision which produces legal effects for aThe data subject orshall similarlyhave significantlythe affectsright himnot or her mayto be subject to a decision based solely on automated processing, including profiling, onlywhich whereproduces thatlegal decisionaffect concerning them or similarly significantly affects them, unless such processing:
Preview
against:
Official source ↗
Source identification

The literal header reads Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/725 / Article 24 – paragraph 1. Its typo is preserved; the proposal parent and matching target evidence independently support Regulation (EU) 2018/1725 Article 24(1).

Header printed in the source: Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/725 / Article 24 – paragraph 1

Alternative wording Amendment 1664 · Sebastian Tynkkynen, Diego Solier ITRE · LIBE
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means, when several equally effective automated processing solutions exist, the controller should use the less intrusive one when it does not result in a significant additional administrative burden for the controller;
Preview
against:
Official source ↗
Source identification

The literal header reads Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/1275 / Article 24 – paragraph 1 – point a. Its typo is preserved; the proposal parent and matching target evidence independently support Regulation (EU) 2018/1725 Article 24(1).

Header printed in the source: Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/1275 / Article 24 – paragraph 1 – point a

Alternative wording Amendment 1665 · Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller ITRE · LIBE
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;
Preview
against:
Official source ↗
Source identification

The literal header reads Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/1275 / Article 24 – paragraph 1 – point a. Its typo is preserved; the proposal parent and matching target evidence independently support Regulation (EU) 2018/1725 Article 24(1).

Header printed in the source: Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/1275 / Article 24 – paragraph 1 – point a

Alternative wording Amendment 1666 · Marina Kaljurand, Elena Sancho Murillo, Brando Benifei, Birgit Sippel, Alex Agius Saliba, Francisco Assis, Elisabeth Grossmann, Kristian Vigenin, Matjaž Nemec ITRE · LIBE
(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller regardless of whether the decision could be taken otherwise than by solely automated means;
Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/1725 / Article 24 – paragraph 1 – point a

Additional proposed wording Amendment 1668 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, Christophe Bay ITRE · LIBE

1a. In Article 24, the following paragraph is inserted:

Where a decision referred to in paragraph 1 is based on the output of a high-risk AI system within the meaning of Regulation (EU) 2024/1689, the safeguards accompanying that decision shall be without prejudice to the human oversight requirements laid down in Article 14 of that Regulation. In particular, natural persons to whom human oversight is assigned shall be enabled to properly understand the capacities and limitations of the system, to correctly interpret its output, to remain aware of the risk of over-reliance on that output, and to decide not to use the system or to disregard, override or reverse its output. Automated processing shall not deprive the data subject of the right to obtain human intervention, to express his or her point of view and to contest the decision.'

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/1725 / Article 24 – Paragraph 1a (new)

Additional proposed wording Amendment 1669 · Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller ITRE · LIBE

1a. In Article 24, the following paragraph is inserted:

In the cases referred to in points (a), (b) and (c) of paragraph 1, the data controller shall implement suitable technical and organisational measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain genuine human intervention of the part of the controller, to express his or her point of view and to contest the decision. The human reveiwer designated to perform such intervention shall possess the necessary competance, knowledge to understand all revelant underlining data, and shall be empowered to modify or overide the decision without delay.'

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/1725 / Article 24 – paragraph 1a (new)

Additional proposed wording Amendment 1670 · Irena Joveva, Michael McNamara, Raquel García Hermida-Van Der Walle, Oihane Agirregoitia Martínez, Veronika Cifrová Ostrihoňová, Fabienne Keller ITRE · LIBE

1c. In Article 24, the following paragraph is inserted:

Decisions referred to in paragraph 1 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable technical and organisational measures to safeguard the data subject's rights and freedoms and legitimate interests are in place.'

Preview
against:
Official source ↗
Source identification

Header printed in the source: Article 4 – paragraph 1 – point 6 / Regulation (EU) 2018/1725 / Article 24 – paragraph 1c (new)