Recital 38

Article 22 of Regulation (EU) 2016/679 provides that data subject has the right not to be subject to a decision based solely on automated processing, except when specific conditions are met and in accordance with rules governing the processing of personal data when the controller makes decisions which have legal effects concerning the data subject or similarly significant effects on the data subject, based solely on automated processing. In order to provide greater legal certainty, it should be clarified that when assessing whether a decision based solely on automated processing is necessary for entering into, or performance of, a contract between the data subject and a controller, as set out in Article 22(2)(a) of Regulation (EU) 2016/679, it should not be required that the decision could be taken only by solely automated processing. The fact that the decision could also be taken by a human does not prevent the controller from taking the decision by solely automated processing. When several equally effective automated processing solutions exist, the controller should use the less intrusive one.