Automated decision-making (GDPR Art. 22)

GDPR Article 22 protects people from decisions taken solely by a machine, including profiling, that produce legal effects or similarly significantly affect them: refusing credit, rejecting a candidate, setting an insurance premium.

They are only allowed if necessary for a contract, authorised by law or based on explicit consent. Even then, safeguards are required: the right to obtain human intervention, to express one's view and to contest the decision, plus meaningful information about the logic involved. The EU Court of Justice has held that even an automated score can be a "decision" if it determines the outcome.

It fits with the AI Act: many of these uses are high-risk and require genuine human oversight.