Part 2: General processing Chapter 2: The GDPR Section 14: Automated decision-making authorised by law: safeguards
This section relates to Article 22 of the GDPR. It provides the safeguards that apply in relation to certain types of automated decision making.
	Article 22 of the GDPR provides data subjects with the right not to be subject to "a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them", unless it is:
	necessary for creation and performance of a contract between a data subject and data controller (Article 22(2)(a));
	authorised by law to which the data controller is subject and which also lays down suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests (Article 22(2)(b)); or
	based on the data subject’s explicit consent (Article 22(2)(c)).
	Decision making "based solely on automated processing" is not further defined in the GDPR. The Article 29 Working Party guidelines on automated decision-making suggest that a decision will be "based solely on automated processing" where there is no "meaningful" human involvement in the decision making process.1
	"Profiling" is a new term. It is defined in Article 4(4) of the GDPR as "any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements".
	Article 22(2)(b) of the GDPR does not require the law to expressly provide that a decision can be made based solely on automated processing before that decision can be taken on the basis of automated processing. It is enough that automated processing is a reasonable way of complying with a requirement, such as a regulatory obligation or licence condition. Such obligation may be provided in general terms, such as a requirement to maintain fraud and financial crime detection systems.
	This section provides the "suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests" that apply where the automated decision making is authorised by law (see above).
	Subsection (4) requires the data controller to inform the data subject within a reasonable time frame that a significant decision has been taken about the data subject based solely on automated processing. The data subject can request the data controller to reconsider the decision or take a new decision using human intervention within one month from being informed of the original decision.
	Subsection (6) provides a signpost to Article 12 of the GDPR which confers powers, and places obligations, on controllers to whom this section applies.
	Subsection (7) provides that the Secretary of State may, by regulations, provide for additional safeguards where, for example, developments in technology require it. This is based on section 12(5)(b) of the 1998 Act.