Section 80 amends the UK GDPR and Data Protection Act 2018 (DPA 2018) to establish new rules governing decisions based solely on automated processing of personal data, including profiling, that produce legal or similarly significant effects for data subjects. Subsection (1) of section 80 repeals Article 22 of the UK GDPR and replaces it with new Articles 22A-D. These provisions remove the conditions that had previously been included in Article 22 for relevant decisions based on processing of non-special category data but retain those conditions for decisions based on processing of special category data. The new provisions require controllers to put in place certain safeguards when making significant decisions based solely on automated processing and provide the Secretary of State with certain regulation-making powers described below. Similar changes are made to equivalent provisions in the data protection regime for law enforcement processing set out in Part 3 of the DPA 2018.
	Article 22A(1)(a) clarifies that a decision based solely on automated processing is one that involves no meaningful human involvement. Article 22A(1)(b) sets out the meaning of a significant decision as one that produces legal or similarly significant effects for the data subject.
	Article 22A(2) requires controllers to consider, among other things, the extent to which a decision has been reached by means of profiling when establishing whether or not any human involvement has been meaningful.
	Article 22B(1)-(3) prohibits the use of special categories of data for significant decisions based solely on automated processing unless one of two conditions is met.
	The first condition is that the data subject has provided explicit consent to the processing of their personal data on which the decision is based.
	The second condition, as an alternative, has two requirements:
						<
The first requirement is that the decision is either:
Necessary for entering into, or the performance of, a contract between the data subject and a controller; or
Required or authorised by law.
The second requirement is that Article 9(2)(g) applies to the processing of the special category data; that is, the activity must be necessary for reasons of substantial public interest, which are set out in Schedule 1 to the DPA 2018 (see section 10 of that Act).
	Article 22B(4) prohibits reliance on new Article 6(1)(ea) as the lawful ground for the processing on which relevant decisions are based.
	Article 22C(1) and C(2) require controllers to put safeguards in place for any significant decisions in relation to a data subject based either entirely or partly on personal data and solely on automated processing and sets out some measures that the safeguards must consist of or include. The safeguards apply for all significant decisions based solely on automated processing. The safeguards must consist of or include: a requirement for the controller to provide information to the data subject about any significant decisions being taken in relation to them based solely on automated processing, the right of the data subject to contest or make representations about any such decision, and the right of the data subject to require the controller to have a human intervene in the decision.
	In regard to the information that must be provided to data subjects, controllers can use varying techniques since they have different ways of communicating with their end-users, customers or members, depending on their operation. This could be in-person or digital and through personalised notifications or general notices. The key requirement is that the information is clear, easily accessible, and helps individuals exercise their rights to contest and to obtain human intervention if they are unhappy with the outcome of the solely automated decision-making.
	Article 22D(1) and D(2), confers powers to the Secretary of State to make secondary legislation, in the form of regulations, to describe:
Circumstances that are, or are not, to be taken to have meaningful human involvement; and
Decisions that are, or are not, to be taken as a having a significant effect for the data subject
	The first of these powers enables the Secretary of State to clarify when meaningful human involvement can be said to have taken place in light of constantly emerging technologies. The second power enables the Secretary of State to clarify what constitutes a significant decision in light of changing societal expectations.
	Article 22D(3) confers a regulation making power on the Secretary of State to make provision in relation to the safeguards controllers are required to put in place when making a significant decision based solely on automated processing, as required by new Article 22C. This power may be exercised: (i) for the safeguards to include measures in addition to those described by Article 22C(2); (ii) to impose requirements which supplement what is currently required for the measures in Article 22C(2); and (iii) to specify measures which are not to be taken to amount to measures required by Article 22C(2). As new technologies emerge, these powers enable the Government to provide legal clarity on the circumstances in which safeguards must apply to ensure individuals are protected and have access to safeguards.
	Article 22D(4) provides that regulations made under paragraph 3 may not amend Article 22C.
	Article 22D(5) makes any regulations made under the powers in Article 22D subject to the affirmative resolution procedure.
	Subsection (3) of section 80 amends equivalent provisions on automated decision making in Part 3 of the DPA 2018, repealing sections 49 and 50 and replacing them with sections 50A to 50D. With some exceptions, these new sections broadly mirror the approach taken under Articles 22A – D of the UK GDPR. These notes highlight where the Government has taken a different approach between the two regimes.
	Unlike Article 22A, section 50A(1)(b)(i) and (ii) restricts a significant decision to those that produces an adverse legal or similarly significant adverse effect on a data subject rather than all such decisions. This is because under Part 3, data subjects are unlikely to perceive the majority of decisions taken by competent authorities as positive, whereas the effect of a significant decision under the UK GDPR may be more nuanced.
	As with Article 22B, section 50B restricts the taking of significant decisions based entirely or partly on the processing of sensitive personal data (the equivalent of special categories of personal data under the UK GDPR), solely via automated processing, to situations where either the data subject has given their explicit consent or the processing is required or authorised by law. Unlike Article 22B(3)(a), however, processing for the purposes of entering into a contract between the data subject and the competent authority is not a valid condition for taking such a decision. This is because it is not considered likely that such a situation would ever arise under Part 3.
	Section 50C(1) and (2) mirror the list of safeguards available to data subjects under article 22C(1) and (2). However, section 50C(3) provides an exemption to the requirement to apply the safeguards provided: that:
It is required for one of the reasons set out under section 50C(4), such as to avoid obstructing an inquiry or, to protect national security;
The controller reconsiders the decision and this is carried out as soon as is reasonably practicable; and
The reconsideration of the decision includes meaningful human involvement.
	Subsections (4) and (5) of section 80 make amendments to sections 96 and 97 of the DPA 2018. The amendment to section 96 provides a definition of automated decision making for Part 4 of the DPA 2018. A decision is based on entirely automated processing if the decision-making process does not include an opportunity for a human being to accept, reject or influence the decision. Minor consequential changes have been made to section 97 to reflect this new definition.
Part 5: Data Protection and Privacy Automated decision-making Section 80: Automated decision-making