DAT-025 Automated Decision-Making and Profiling Rights
Description
A register lists each decision taken solely by automated processing, including profiling, that produces a legal effect or a similarly significant effect for an individual. For each one it records the condition that permits it: the individual's explicit consent, necessity for a contract or authorisation in law. The privacy notice and the response to an access request state that the decision exists, the logic involved and its significance and envisaged consequences for the individual. A route exists for the individual to obtain human intervention, to express a point of view and to contest the decision. Each request is recorded with its outcome and the time taken. Special category data is not used in such a decision unless the entry records explicit consent or a substantial public interest condition.
Rationale
An automated decision an individual cannot see and cannot argue with is the harm Article 22 addresses. A register turns that right from an abstraction into something an assessor can sample. Recording the permitting condition next to the decision keeps the product team honest about which decisions are really contract-necessary. AIG-022 holds the oversight the operator exercises, AIG-017 what the model can explain, AIG-016 the disclosure that an AI system is in use and DAT-011 the general rights workflow this route feeds into. Issued in S4 from G-DAT-2 in docs/review-canonical-quality.md section 7.3.
Applicability (9 profiles)
The deployer taking a decision on the system's output is the controller for Art.22.
The deployer taking a decision on the system's output is the controller for Art.22.
Framework Mappings (3)
| GDPR-Art.13.2 | Privacy Notice — Data Collected Directly (Supplementary Information) | informative |
| GDPR-Art.15 | Right of Access | informative |
| GDPR-Art.22 | Automated Decision-Making and Profiling | full |
Evidence (3)
Register of decisions taken solely by automated processing with a legal or similarly significant effect, each with the permitting condition, the affected population and the special category position.
Example: Automated decision register v2, dated 2026-07-24, listing four decisions including automated credit-limit assignment and automated account suspension, each with its permitting condition and the date the condition was last reviewed
Test: Read the register. Verify: (1) each listed decision is genuinely taken without meaningful human involvement, (2) each names explicit consent, contract necessity or legal authorisation as its condition, (3) each records whether special category data is used and, where it is, the explicit consent or substantial public interest condition, (4) product features that make such decisions and are absent from the register are identified by walking the current feature list against it.
Export of requests for human intervention, expression of a point of view and contest of an automated decision, with the outcome and the elapsed time for each.
Example: Rights request queue export for the six months to 2026-08-31, filtered to automated decision requests, showing request type, receipt date, reviewer, outcome and elapsed days
Test: Export the automated decision requests for the last reporting period. Verify: (1) intervention, point of view and contest are distinguishable request types rather than a single free-text category, (2) each closed request records an outcome and the reviewer who reached it, (3) elapsed time is within the response period the rights process commits to, (4) at least one request resulted in the original decision being changed or in a recorded reason why it stood.
Walkthrough of the product surface where an automated decision is delivered to an individual, following the notice and the route to intervention and contest as an affected person would.
Example: Witnessed walkthrough of the account suspension flow in the staging environment, 2026-08-07, capturing the decision notice, the explanation panel and the contest form
Test: Follow one registered decision through the product as an affected individual. Verify: (1) the individual is told the decision was made solely by automated processing, (2) the logic involved and the significance and envisaged consequences are stated in plain language at that point or in a linked notice, (3) the route to human intervention and contest is reachable from the decision itself, (4) a request submitted through that route arrives in the rights request queue.
Questions (3)
Is there a register of decisions taken solely by automated processing that produce a legal or similarly significant effect on an individual?
Solely automated means no meaningful human involvement in the decision itself; a person who rubber-stamps an output does not change the answer. Answer no if such decisions are made but are not listed anywhere.
Which of the following are available to an individual subject to such a decision?
Available means reachable by the individual from the decision, not obtainable by writing to a privacy mailbox and waiting. The explanation is of the logic and its consequences, not of the model architecture.
How is the condition that permits each automated decision recorded?
Options run from strongest to weakest. The condition is explicit consent, necessity for a contract or authorisation in law. A general lawful basis for the product is not the same thing and will not carry the decision.