GDPR Article 22

Automated individual decision-making — including profiling — with legal or similarly significant effects

Regulation reference

Data subjects have the right not to be subject to solely automated decisions with legal or similarly significant effects, subject to exceptions — with transparency, safeguards, and rights to contest.

EUR-Lex — GDPR Article 22

MARKO ŽIVKOVIĆ In review

Article 22 of the GDPR addresses solely automated decisions — including profiling — that produce legal or similarly significant effects on a person.

Official text: EUR-Lex — GDPR Article 22

Read the official article for binding wording. Summary below is for corpus navigation only — not legal advice.

What Article 22 establishes (plain language)

General rule: The data subject has the right not to be subject to a decision based solely on automated processing (including profiling) if it produces legal or similarly significant effects — unless a narrow exception applies (contract necessity, authorised by EU/member-state law with safeguards, or explicit consent with safeguards).
Safeguards when automated processing is permitted: At minimum, rights to obtain human intervention, express their point of view, and contest the decision.
Special categories: Profiling based on sensitive data has additional restrictions (Art. 22(4) cross-ref Art. 9).

What it means for this corpus

Article 22 is a regulatory floor for contestability in personal-data, automated, high-impact contexts:

GDPR Art. 22	Corpus
Human intervention	Mandatory human at catastrophic/significant boundaries (Decision Framework)
Express point of view	Affected party standing to challenge
Contest the decision	Contestability pattern — L0 contest and resolution events
Solely automated	Hybrid human-in-loop may fall outside Art. 22 but still needs harness for trust

Not identical: Our contestability principle applies to human and hybrid consequential binds where error propagates — broader than Art. 22’s automated-only scope. Art. 22 does not replace epistemic humility or H0.

Compliance theatre risk: A “contact us” link with no recorded contest path violates the spirit of both GDPR and our compliance theatre failure mode.

Implementation hints (non-exhaustive)

Original automated bind: L0 with model id, version, features snapshot, policy threshold.
Contest and outcome: separate L0 events referencing original id (contestability pattern).
Human review on escalation: named authority, not rubber-stamp (Rule 3).

See Enterprise Decision map rows citing Art. 22 (e.g. automated credit, card applications).

Corpus stance

Context A2 — legal provision cited as alignment and constraint on automated decision architecture. Wording and exceptions are member-state and case-law sensitive A3 — deployment-specific T12.