Have you been subjected to a decision based solely on automated processing?
You have the right to demand human involvement in decisions that concern you.
Some decisions concerning you can be made automatically. This means that humans are not involved in the decision-making, but the decisions are made by machines on the basis of your personal data. Automated decision-making is sometimes used in filtering loan or job applications, for example.
Personal data refers to information by which you can be identified.
A company, authority or corporation that collects your personal data is called a controller.
Automated decision-making is permitted if
- the decision is necessary for entering into, or the performance of, a contract between you and the controller
- the decision has been approved in an act applying to the controller or
- you have given your specific consent to the decision, for example with a signature or two-factor authentication.
In such cases, at minimum, you have the right to demand human involvement in decisions that concern you. You also have the right to express your opinion and dispute the decision.
How to proceed
Make the request directly to the controller. Additional information on the correct channels can usually be obtained from the controller's website or customer service.
In the request, specify the measures you want the controller to take. For example, you can ask the controller to have a human make the decision concerning you, or you can dispute a previous decision by stating your own position. If you believe the controller to lack a lawful basis for automated decision-making, you can also express this.
The controller is required to reply to your request within one month. If the requests are numerous or complex, the controller can reply that it needs more time to process them. If the controller announces that it needs more time for processing, the deadline for replying will be three months from your original request. Wait for the controller's reply. Notifying you of a longer processing time does not mean that the controller will refuse your request. If the controller does not reply to you within the deadline, you can contact the Data Protection Ombudsman.
If the controller refuses your request, it must state the reasons for its refusal. If you feel that the controller did not have legal grounds for its refusal, you can contact the Data Protection Ombudsman if necessary.
Notification to the Data Protection Ombudsman