Does the GDPR Prohibit Automated Decision-Making?
Résumé
Article 22 is one of the most discussed articles of the GDPR. Scholarship has focused on many aspects of this cryptic article: its scope of application, the right to be informed about automated decision-making, the notion of appropriate measures to safeguard the data subject’s legitimate interests, etc. Among these elements, the talk will focus on article 22 (1) of the regulation.
In particular, it will concentrate on the interpretation of the “right not to be subject to a decision based solely on automated processing”. The ambiguous formulation of this right has led to two antagonistic interpretations. The first, supported by the ex-Article 29 Working Party qualifies article 22(1) as a general prohibition. In this interpretation, controllers cannot make decisions based on automated processing unless one of the exceptions of article 22(2) applies. In a conflicting interpretation, legal scholars have shown that the wording of article 22(1) and the travaux préparatoires of the regulation favour the interpretation as a right to object to automated decision-making. Controllers can therefore make a decision based on automated processing and data subjects have a right to object unless one of the exceptions of article 22(2) applies.
Certain Member States have already favoured one of the interpretations. France, for example, has chosen to establish a general prohibition of automated decision-making in its loi informatique et libertés. However, if the European Court of Justice would explain that the GDPR entails a mere right to object, such a general prohibition would be incompatible with the regulation.