Article 22 gives data subjects the right to opt-out of automated decision-making if it is not strictly necessary.

The data subject always has the right not to be subjected to decisions that are solely based on automatic decision-making or profiling. This if the processing affects the data subject significantly or has any legal effect.

Automatic decision-making can be described as a decision that has been made without any human involvement. An example of this would be a multiple-choice exam where the system is pre-programmed with which answers are right. This system can, without any human involvement, correct the students’ test and decide if they pass the test.

Profiling is defined in GDPR Article 4(4) as “any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.”

Profiling can, for example, be used in medical treatments to predict patients’ health based on specific group characteristics.

For more information regarding Article 22, see EDPB guidelines on profiling and automatic decision-making.