According to Article 21 of the GDPR, “the data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”. Under Article 22(2)(b), the Member or EUState law that authorises the processing must also incorporate appropriate safeguarding measures. Such measures should include, as a minimum, a way for the data subject to obtain human intervention, express their point of view, and contest the decision.

Human intervention is a key element. Any review must be carried out by someone who has the appropriate authority and capability to change the decision. The reviewer should undertake a thorough assessment of all the relevant data, including any additional information provided by the data subject.^[1]The controller must incorporate qualified human intervention that is capable of recovering biases that machines may create in relation to the right to not be subject to automated individual decision-making in Article 22 of the GDPR.^[2]

^[1]Article 29 Data Protection Working Party, Guidelines on Automated individual decision-making and Profiling for the purposes of Regulation 2016/679, WP251, 3 October 2017.

^[2] EDPB, Guidelines 4/2019 on Article 25 Data Protection by Design and by Default, 13 November 2019.