Article 22

2.The data subject shall have the right not to be subject to a decision under Article 22(1) unless one of the conditions mentioned in letters (a) to (c) of that provision is met.

3.In the cases referred to in points (a) and (c) of paragraph 1, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision. Any human intervention on the part of the controller must be meaningful and the human must have the necessary knowledge and competences to comprehend and have the possibility to modify the contested decision.

4.Before a controller makes any decision under Article 22(1), it must ensure that the affected data subject is informed about the decision in accordance with Articles 13 or 14, and that, at the time of the decision, it has implemented suitable measures in accordance with Article 22(3).

5.Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.

(ca)is taken by an AI system which can be reviewed and overseen by a natural person before or after it takes effect, and where appropriate safeguards are in place;

In the cases referred to in points (a), (b) and (c) of paragraph 1, the data controller shall implement suitable technical and organisational measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain genuine human intervention of the part of the controller, to express his or her point of view and to contest the decision taken, as referred to in paragraph 1. The human reviewer designated to perform such intervention shall possess the necessary competence, knowledge to understand all relevant underlining data, and shall be empowered to modify or override the decision without delay.'

The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.'

Where a decision referred to in paragraph 1 is based on the output of a high-risk AI system within the meaning of Regulation (EU) 2024/1689, the measures referred to in point (b) of paragraph 1, and the safeguards accompanying a decision taken pursuant to points (a) and (c) thereof, shall be without prejudice to the human oversight requirements laid down in Article 14 of that Regulation. In particular, natural persons to whom human oversight is assigned shall be enabled to properly understand the capacities and limitations of the system, to correctly interpret its output, to remain aware of the risk of over-reliance on that output, and to decide not to use the system or to disregard, override or reverse its output. Automated processing shall not deprive the data subject of the right to obtain human intervention, to express his or her point of view and to contest the decision.'

4.Decisions referred to in paragraph 1 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable technical and organisational measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place.

In the cases referred to in points (a) and (c) of paragraph 1, the data controller shall implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain meaningful human intervention on the part of the controller, to express his or her point of view and to challenge the decision taken in their regard.

Meaningful human intervention, on the part of the controller, requires that the human reviewer reviews the accuracy of the data, the logic involved in the decision and the consequences of the decision, not merely the output of the system.

The human reviewer shall have the competence, training and authority necessary to exercise that function, including for overriding automated decisions. The human reviewer shall enjoy protection from dismissal or its equivalent, disciplinary measures and other adverse treatment where they exercise their functions.

3.In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall apply suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain meaningful human intervention on the part of the controller, to express his or her point of view and to contest the decision. Human intervention is meaningful when the person in charge of the review has the requisite authority, knowledge and expertise to amend the contested decision and actively analyses the set of relevant data, going beyond the outcome produced by the system. In proceedings concerning access to agricultural credit, the setting of premiums for agricultural insurance policies and the disbursement of payments under the common agricultural policy, the person responsible for the review shall also possess the technical and agronomic expertise relevant to the proceedings in question.

7a.In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall apply suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain meaningful human intervention on the part of the controller, to express his or her point of view and to contest the decision. Human intervention is meaningful when the person in charge of the review has the requisite authority, knowledge and expertise to amend the contested decision and actively analyses the set of relevant data, going beyond the outcome produced by the system. In proceedings concerning access to agricultural credit, the setting of premiums for agricultural insurance policies and the disbursement of payments under the common agricultural policy, the person responsible for the review shall also possess the technical and agronomic expertise relevant to the proceedings in question.

Without any prejudice to Article 35, any automated decision making under Article 22(1) of this Regulation that is likely to affect more than 100 data subjects per year shall be subject to a data protection impact assessment performed by the controller.'

For any processing operation that is likely to entail automated individual decision making affecting and the profiling of more than 1000 data subjects per year, the controller must be able to demonstrate that the methodology used for the profiling and decision making are based on scientifically recognised mathematical and statistical methods and do not cause any unlawful discrimination. Information demonstrating these facts must be made publicly available by the controller.'