Fiche 39/54 Part 4 — Data Subject Rights Advanced Reviewed 2026-08-23

Automated Individual Decisions & Profiling (Art. 22)

Article 22 protects individuals from being subject to decisions based solely on automated processing (without genuine human intervention) that produce legal or similarly significant effects. Strict st

Open in interactive reader

⚖️ General Prohibition with Exceptions 🏛️ CJEU C-634/21 SCHUFA

Automated Decisions & Profiling (Art. 22)

⚡ In 30 seconds

Article 22(1) establishes the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the individual or similarly significantly affects them. It is structured as a general prohibition, permissible only under three narrow statutory exceptions accompanied by safeguards.

3 Statutory Exceptions (Art. 22.2)	Application Scope	Mandatory Minimum Safeguards (Art. 22.3)
1. Contractual Necessity	Necessary for entering into, or the performance of, a contract.	Right to obtain human intervention on the part of the controller.
2. Statutory Authorization	Authorized by Union or Member State law providing safeguards.	Right to express their point of view regarding the automated score.
3. Explicit Consent	Based on the data subject's explicit opt-in consent (Art. 9.2.a).	Right to contest the decision and demand manual reassessment.

⚡ Key Takeaways

CJEU SCHUFA (C-634/21): automated credit scoring heavily determining a bank loan constitutes an Art. 22 decision.
Meaningful human intervention: rubber-stamping an algorithm's output does not qualify as genuine human review.
Special categories of data (Art. 9) cannot be processed in automated decisions unless explicit consent or public interest applies.

⚠️ Common Pitfall

Relying on purely cosmetic human oversight where human clerks automatically confirm AI rejection decisions 100% of the time.

🛠️ In Practice

Train decision officers empowered with real operational authority to overturn algorithmic recommendations upon appeal.

⚖️ Official Sources: Art. 22 GDPR · Recital 71 · CJEU C-634/21 SCHUFA Holding · WP29 Guidelines on Automated Decision-Making (WP251) ✓ Legal review: 23 August 2026